**Effective date:** November 1, 2026

**Contact:** Will Bowman, 1509 Date Ave, Torrance, CA 90503, USA · will@pagehub.dev

These terms are part of the [terms of service](/terms). They apply when you use PageHub to handle personal data about your visitors and that handling falls under GDPR, UK GDPR or a similar law. You don't need to sign anything.

## 1. Who does what

You're the controller of your visitors' data: you decide what your site collects and why. PageHub is your processor. If you run a site for a client, your client may be the controller and you the processor, and PageHub is then your sub-processor.

## 2. What we handle

- **People:** visitors, customers, members and reviewers of your sites.
- **Data:** what your forms ask for, names, email addresses, order details, chat messages, review comments, and the analytics listed in our [privacy policy](/privacy).
- **Why:** to host your sites and provide the features you turn on.
- **How long:** until you delete it, or as listed in the privacy policy.

Don't use PageHub for special-category data (health, for example) unless you've checked that these terms and your setup are enough for it.

## 3. What we promise

We will:

- handle the data only on your instructions, meaning these terms and how you use the product, unless the law requires otherwise. We'll tell you if we think an instruction breaks the law;
- make sure anyone handling the data must keep it confidential;
- keep it secure: HTTPS in transit, encrypted credentials for connected services, access limited to what's needed;
- tell you without undue delay, and within 72 hours where we can, after we learn of a breach affecting your data;
- help you answer requests from people about their data, and with security and impact assessments, as far as is reasonable;
- give you the information you need to show we meet these terms, and let you or your auditor audit us on reasonable notice, once a year unless a regulator requires more or there's been a breach.

## 4. Sub-processors

You agree we can use the companies below. We'll update this list and tell account owners by email at least 30 days before adding one. If you have a reasonable data protection objection, email us. If we can't resolve it, you can close your account. We hold each company to data protection terms like these, and we're responsible for their work.

| Company | What they do | Where |
|---|---|---|
| Vercel | Hosting, AI request routing | United States |
| MongoDB (Atlas, on AWS) | Database | United States |
| Cloudflare | File storage and delivery, published sites | Worldwide |
| Amazon Web Services (SES) | Email | United States |
| Inngest | Background jobs | United States |
| Stripe | Store checkout and billing | United States and others |
| Anthropic | AI features, including site chat if you turn it on | United States |
| OpenAI | Image generation | United States |
| Browserless | Screenshots of your draft site | United States |
| Telnyx | Text-message alerts, if you turn them on | United States |

Tools you add to your own site, such as Google Analytics or a Meta Pixel, are your own choice and aren't our sub-processors.

## 5. Transfers out of the EU and UK

PageHub runs in the United States. Where your visitors' data is protected by EU, UK or Swiss law and moves to us, the EU Standard Contractual Clauses apply and are part of these terms: Module 2 when you're a controller, Module 3 when you're a processor. Clause 7 (docking) applies, clause 9 uses option 2 with the 30-day notice above, the optional part of clause 11 doesn't apply, and clauses 17 and 18 use the law and courts of Ireland. Section 2 and section 3 above fill Annexes I and II, and section 4 fills Annex III. For UK data, the UK Addendum to the clauses applies. For Swiss data, the clauses apply with references to Swiss law and the Swiss regulator.

## 6. When you leave

You can export and delete your data at any time. Deleting your account deletes your sites and your visitors' data, except what the law requires us to keep.

## 7. What's yours to do

Your site needs its own privacy policy and a legal basis for what it collects. If your site uses tracking tags, turn on Cookie consent in Site settings under Privacy.