Privacy policy

Who we are

Tweak Pub is operated by Serophin, the trading name of [LEGAL ENTITY], registered under number [COMPANY NUMBER] at [REGISTERED ADDRESS] ("we", "us"), which is responsible for the personal data described here. You can reach us at support@serophin.com or through our contact page.

Serophin is the data controller for the personal information described here, except for the visitor messages described below.

Our representative in the European Union and the United Kingdom, where one is required: [EU/UK REPRESENTATIVE, if required].

What we collect

Account and sign-in

When you sign in we collect your email address. You sign in with a code we send to your email, or with Google, in which case Google tells us your email address. We use it to recognise you, to keep your websites tied to you and to write to you about your account.

Registrant details for domains

To register a web address in your name, the registry requires your name, postal address, email address and phone number. We pass these to our domain registrar, and we ask the registrar to hide them from the public WHOIS listing with WHOIS privacy where the ending allows it.

Your site content and uploaded images

We store the text, settings and images you add to your websites so we can show them to you in the editor and publish them. A published website is public, so anything on it can be seen by anyone.

Contact form submissions and tickets from visitors

If a website built with Tweak Pub has a contact form, the name, email address and message a visitor enters are collected and delivered to the website's owner. For those messages the website owner is the controller and decides how they are used; we handle them on the owner's behalf as a processor, under our Data Processing Agreement with the owner. The owner can see them and reply to them on plans that include a contact inbox. A visitor who wants to use their rights over such a message should ask the website's owner, and we help the owner answer.

Messages and tickets sent to us directly are kept so we can help and keep a record of what was said.

Abuse reports

Anyone can use Report this site on a published website. We keep the report, what it says and the address of the site it names, and the email address of the person reporting if they give one, so we can review it and follow up.

Payments

Card and billing details are entered with our payment provider and held by it. We do not store your full card number. We keep a record of what you bought, its price and when, together with the last digits and brand of a saved card so you can recognise it.

Who processes data for us

We use these service providers, each only for its role and under a data processing agreement:

• Stripe (payments). Takes and holds card and billing details, and calculates tax.
• Openprovider (domain registration). Registers web addresses in your name, with WHOIS privacy where available, and passes registrant details to the registry of the ending.
• Amazon Web Services (hosting and email). Runs the service, stores our records and your images, and sends and receives our email.
• Cloudflare (hosting and spam check). Serves published websites and their images, holds your web address's DNS, and runs the spam check (Turnstile) on forms.
• Anthropic (translation). Translates the text of your pages when you choose more than one language, so the text of your pages is sent to it.
• Google (sign-in and fonts). When you sign in with Google, Google tells us your email address and name; published websites load the fonts their owner picked from Google Fonts, so a visitor's browser contacts Google for them.

How we use information, and on what legal basis

We use personal information only for these purposes, each on the legal basis named. We do not sell personal information and we do not use it for advertising.

• Providing your account, websites, plans and web addresses, taking payment and answering your messages: to perform our contract with you.
• Registering a web address with your registrant details: to perform our contract with you, and the registry's rules that require them.
• Keeping tax, payment and accounting records: to meet our legal obligations.
• Securing the service, preventing spam and abuse (including the spam check on forms), and reviewing abuse reports: our legitimate interest in a safe service that others can trust.
• Delivering contact form messages for website owners: on the owner's instructions, as their processor.
• Emails about your account, plans and web addresses: to perform our contract with you. We send no marketing email.

International transfers

Our providers process information in the United States and other countries outside the European Economic Area and the United Kingdom. Where that happens we rely on an adequacy decision (such as the EU-U.S. Data Privacy Framework for providers certified under it) or on the European Commission's Standard Contractual Clauses and the UK addendum, with the safeguards they require. Ask us for a copy of the safeguards that apply.

Cookies

We use only cookies the service needs: one that keeps you signed in and one that renews your sign-in, and one that keeps the website you are building tied to your browser before you sign in. A published website remembers the language a visitor chooses in a cookie, and the spam check may set its own. We do not use cookies for advertising or analytics.

How long we keep it

A website published without an account is removed after 3 days if nobody keeps it, together with its content and images.

We keep your account, websites and content while your account is open, and delete them when you delete your account, except what we must keep for tax, payment and legal records. Contact messages and reports are kept for as long as they are needed for the purpose above.

Your rights

You can ask to see the personal information we hold about you, to correct it, to delete it, to receive a copy, to restrict how we use it, or to object to how we use it on the basis of our legitimate interest. You can delete your account yourself; for anything else write to support@serophin.com and we will answer within one month.

You also have the right to complain to a data protection authority, in particular in the country where you live or work. Our lead authority is [LEAD SUPERVISORY AUTHORITY].

Children

Tweak Pub is not meant for anyone under 18, and we do not knowingly collect information about children.

Changes to this policy

If this policy changes, we update this page and the date at the top.

Contact

For questions about this policy, or any request about your data, email support@serophin.com or use our contact page.