Privacy Policy
Last updated October 5, 2026 · Version 2026-10-05 · Terms of Service
The short version: we collect what we need to build, host and bill for your sites; we do not sell or share personal information or use it for advertising; we do not use your content to train AI; the Builder sets one sign-in cookie and no trackers; and visitors to your site are your customers, whose information we hold only for you.
1. Who we are and what this covers
This policy explains how Jacob Joseph Campbell, doing business as Built2WinWeb (also BuiltToWinWeb and AIWebBuilding) ("we", "us"), 7322 Ashley Shores Circle, Greenacres, FL 33467, United States, handles personal information in AIWebBuilding (the "Builder") at aiwebbuilding.built2winweb.com and on websites published with it.
It covers two groups of people differently:
- Builder customers — people who create an account to build sites. For your information we decide how it is used (we are the "controller" or "business").
- Visitors to customer sites — people who use a site built with the Builder. The owner of that site decides what it collects and is responsible for it; we store and process it for them as their service provider. See section 9.
Our marketing site, https://built2winweb.com, has its own privacy policy.
2. Information we collect
| What | Details | Where it comes from |
|---|---|---|
| Account | Email address and a one-way hash of your password (we never store the password itself); sign-in and password-reset records. | You |
| Your sites and brief | Everything you enter to build a site: business name, contact details, address, hours, services, prices, story, team names and bios, reviews you paste, social links, images and videos you upload, and the text of any site you import. | You, or the site you import |
| Purchases | What you bought, amount, date and Stripe's payment reference. Card details go straight to Stripe; we never see the full number. | You, Stripe |
| Domain registrations | Registrant name, organization, postal address, phone and email, which registries require. | You |
| Shop and payout connection | Your Stripe account ID and connection status if you connect Stripe for a shop. We do not receive your bank details. | Stripe |
| AI use | The prompts and site text sent to the AI writer and assistant, and a record of usage and cost. | You |
| Support and reports | Emails you send us; copyright notices, counter-notices and abuse reports, including the sender's contact details. | You or the person reporting |
| Security and usage logs | IP address, browser user agent, the action taken and when (for example "site published"), used to secure accounts, prevent abuse and fraud, and enforce rate limits. | Your device |
We do not ask for, and you should not enter, sensitive information such as health, financial-account or government-ID data.
3. How we use it
- To provide the Builder: build, preview, publish and host your sites; register and configure domains; run forms, bookings, newsletters and shops on your sites.
- To take payments, send receipts and send renewal reminders.
- To generate copy and answer questions when you use AI features.
- To keep the Service secure: detect and prevent fraud, spam and abuse, screen new sites, and every change saved to a site, against our acceptable-use rules, and handle copyright and abuse reports.
- To send service messages (account, billing, security, legal notices). We do not send you marketing email from the Builder without your consent, and every marketing email has an unsubscribe link.
- To meet legal obligations, enforce our Terms, and defend legal claims.
- To understand and improve the Builder using aggregate statistics.
We do not sell personal information, and we do not "share" it for cross-context behavioral advertising. We do not use your content, or your visitors' information, to train AI models, and we do not permit our AI providers to do so.
Legal bases, where GDPR or UK GDPR applies: performance of our contract with you; our legitimate interests in securing and improving the Service; compliance with law; and consent where we ask for it.
5. Cookies and analytics
- The Builder sets one strictly necessary cookie,
b2wb, to keep you signed in. It is not used for tracking or advertising, and it is not set for visitors who are not signed in. - The Builder has no advertising cookies, third-party trackers or third-party analytics.
- Published sites count visits without cookies. Each visit is recorded as a short code made from the visitor's IP address, browser and site, scrambled with a key that changes every day and is never stored, so visits cannot be linked across days or sites, and the IP address itself is not kept. Shops keep a visitor's basket in their own browser.
- Because we do not sell or share personal information, Global Privacy Control and Do Not Track signals are honored by default.
6. How long we keep it
| Information | Kept for |
|---|---|
| Account and sites | While your account is open; deleted within 30 days after you close it, except where we must keep it longer |
| Security and activity log (with IP addresses) | 180 days |
| Admin audit log | 365 days |
| Rate-limit and visit-count records | 120 days |
| AI-assistant tool-call log | 90 days |
| AI usage and cost records | 400 days |
| Payment, refund and tax records | As long as tax and accounting law requires (generally up to 7 years) |
| Copyright and abuse records | As long as needed to apply our repeat-infringer policy and defend claims |
| Backups | Overwritten on a rolling basis |
Information collected by a customer's site (leads, bookings, subscribers, orders) is kept until the site owner deletes it or closes their account.
7. Security
We use HTTPS everywhere, hash passwords, keep data outside the public web folder, sign preview links, rate-limit sign-in and forms, restrict administrator access, and screen sites and every saved change for abuse. No system is perfectly secure; if a breach affects your personal information we will notify you and the authorities as the law requires.
8. Your choices and rights
You can see and change most of your information in the Builder, and export any site as a Markdown blueprint. You can also ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct it;
- delete it, or close your account;
- stop or restrict a particular use, or object to it;
- transfer it to you in a portable format.
Email [email protected] from your account address. We will confirm your identity, reply within 30 days (45 days where California law allows), and will not treat you differently for using these rights. You may use an authorized agent, and if we decline a request you may appeal by replying to our decision. If you are in the EU or UK you may also complain to your data-protection authority.
California residents: in the last 12 months we collected the categories listed in section 2 — identifiers (such as email and IP address), customer records (such as name, address and phone for domains), commercial information (purchases) and internet activity (security logs) — for the purposes in section 3, and disclosed them to the service providers in section 4 for business purposes. We have not sold or shared personal information, including of anyone under 16.
9. Visitors to sites built with the Builder
When you use a site built with the Builder — submit a form, book an appointment, sign up for a newsletter or buy something — the site's owner decides what is collected and how it is used, and their own privacy notice applies. We store and process that information for them as their service provider, only to provide the Builder to them, and we do not use it for our own purposes or sell it.
- Form and booking submissions are stored for the site owner and emailed to them.
- Newsletter sign-ups use double opt-in: nothing is sent until you confirm by email, and every email has an unsubscribe link.
- Shop payments are processed by the site owner's own payment provider. We never receive card details.
To access, correct or delete information you gave a site, contact its owner. If you cannot reach them, email [email protected] with the site address and we will pass your request on or help where we can.
10. Children
The Builder is for adults; account holders must be 18 or older. We do not knowingly collect personal information from children under 13 (or under 16 where local law sets a higher age). If you believe a child has given us information, contact us and we will delete it. Sites built with the Builder must not be directed at children under 13 unless their owner complies with COPPA.
11. Where information is processed
We are based in the United States and our providers process information in the United States and other countries. Where we transfer personal information from the EU, UK or Switzerland, we rely on our providers' lawful transfer mechanisms, such as Standard Contractual Clauses or the Data Privacy Framework.
12. Changes to this policy
We will post any update here with a new date. If a change is material, we will email account holders before it takes effect.
13. Contact
Jacob Joseph Campbell, doing business as Built2WinWeb · 7322 Ashley Shores Circle, Greenacres, FL 33467, United States · [email protected]