Information we use
This policy describes how Subaya Web LLC (“Subaya Web,” “we,” “us,” or “our”) handles information for its website design and hosting services. The service is intended for customers aged 18 or older.
Subaya Web uses the information you provide to build and manage your website: your email address, account details, order instructions, uploaded files, support messages, and requested changes. We also keep purchase and renewal records, payment authorizations and reminder records, consent records, and timestamps. Limited technical and security records, such as IP addresses and request logs, help us operate, protect, and troubleshoot the service.
The public Contact form collects your email address, subject, and message so we can respond. It also uses Cloudflare Turnstile to check for automated abuse. We keep the message in our private support queue and use Resend to deliver it to our support mailbox, with your email address as the reply address. Sending a message does not create an account or subscribe you to marketing.
Inquiries for businesses and organizations include your contact details, organization name, selected project type, existing website, description, and any files you supply. We use them to review the project and contact you about scope and pricing. Inquiry submission does not authorize publication.
For quoted projects, we also keep the purchasing organization and authorized contact, quote versions, acceptance records and applicable terms, account verification records, invoices, payment references, and project correspondence and attachments. Quote acceptance creates or connects your account before payment. Acceptance records help us identify the work you approved. They do not establish that payment was made or publication authorized.
For organization websites or applications that handle their users' personal data, including sensitive information, we agree the privacy requirements and responsibilities directly with the customer before receiving that data. We do not take on a project if we believe our development or hosting process cannot meet those requirements and applicable law. Where required, the project agreement includes data-processing terms. This policy does not replace the client's own privacy notice to its users.
Personal order and organization inquiry drafts save your entered text, choices, and attachment names in this browser's local storage so you can return to the form. Draft storage does not contain the files themselves. It remains until you submit the form, use Clear draft, or clear the browser's site data. The server's seven-day and 90-day submission cleanup periods do not remove a draft on your device.
For personal sites, we record your optional footer-credit choice with the order and site. The checkout choice starts checked and can be turned off. You may ask us to remove the credit later without a fee. This choice does not give permission to use your site in our portfolio.
Referrals and promo codes
If you join the referral program, we keep your enrollment and applicable terms, referral link, attributed visits and purchases, confirmed progress, earned rewards, redemptions, and the personal sites or domains selected for rewards. We use these records to credit referrals, provide rewards, and prevent duplicate or fraudulent claims. Already-earned rewards remain recorded if the referral count is later corrected, so the reward stays available and cannot be earned a second time. Promo records include the code used, eligibility checks, discount, resulting order total, and any associated payment, refund, or usage-limit records.
When you follow a referral link, we use its identifier and visit time to associate the referral with a later website purchase where we can identify that connection. The latest eligible link visited within the 90 days before purchase receives credit. We fix the credited referral at purchase, even if confirmation depends on later publication. A later visit cannot change credit for that purchase. Browser restrictions, cleared site data, or an unrecognized change of device can prevent attribution. We do not recreate deleted browser identifiers through device fingerprinting.
Referral links use a cookie named subaya_referral. It contains a random identifier rather than your email address, and expires 90 days after the latest accepted referral-link visit. Ordinary browsing does not extend that period. Its server record identifies the link and visit time so we can connect a purchase to the referral. This cookie is separate from account-session and remembered-device cookies. Choosing to remember a device for sign-in does not authorize referral tracking, and you do not need to join the referral program to create an account or buy a website.
Referrers see aggregate visits, pending purchases, confirmed referrals, and their own reward status. We do not disclose referred customers' names, email addresses, order details, or payment amounts through that dashboard. A referral becoming confirmed may still let someone infer that a person they invited has purchased. Subaya's operators can access the records needed to administer the program and investigate errors or abuse.
We also create campaign links to compare advertisements and other promotions. These use the same attribution period. Operator reports show aggregate visits, attributed purchases, revenue, and reversals. Campaign measurement does not by itself enroll an advertiser in the customer reward program or establish a commission agreement. Visit totals and estimates of distinct visitors can be affected by bots, repeated visits, and browser restrictions.
Sign-in verification, cookies, and local storage
Account sessions use security cookies to recognize your authenticated requests. Login sessions currently last up to 14 days unless they end or are revoked earlier. They are separate from the optional remembered-device cookie described below. Security controls may require you to sign in again.
Email sign-in confirmation is enabled by default. We use your account email, login-attempt reference, confirmation status, and expiry to verify the sign-in. Resend delivers the confirmation link and other account-security messages. Links are tied to the sign-in attempt, expire, and can be used only once. Confirming a link authorizes the original sign-in attempt rather than signing the email-opening browser into your account.
If you enable authenticator 2FA, we keep the protected setup secret and verification state needed to check your codes, together with recovery-code verification records and whether a recovery code has been used. Your QR code is generated in your browser, without sending the setup key to an external QR-code service. Keep your setup key and recovery codes private. Authentication secrets and recovery codes are not project materials and are not supplied to website-building AI tools.
The optional Remember me for 7 days checkbox starts unchecked. After successful verification, it stores a cookie on that device so later sign-ins can skip email confirmation for a fixed seven days. It does not skip the password or an enabled authenticator. The cookie contains a random identifier. Its server record links it to your account, expiry, and revocation status. It does not contain your password, email address, or authenticator secret.
Use Forget this device in your account to revoke the remembered-device record and remove its cookie. Clearing the cookie also stops that browser from using it. Signing out ends the login session but does not itself forget the device. Relevant account-recovery, credential, or security changes can revoke remembered access. Expiry does not extend merely because the device is used.
We keep limited security records, including request and attempt times, IP addresses, verification outcomes, settings changes, and revocations, to protect accounts, enforce attempt limits, and investigate abuse. Disabling email sign-in confirmation does not stop essential security-change notices. These records and login cookies are not used to track referrals or advertise to you.
If you request assisted account recovery, we use your correspondence and the account or payment-ownership information needed to assess the request. We keep a record of the decision and resulting security changes. Recovery is not guaranteed. Do not send passwords, authenticator setup keys, recovery codes, or full payment-card details to support.
Private material and public websites
We use your information to take the steps you request before a contract and to provide the agreed service. Where applicable data-protection law requires a legal basis, we also rely on legal obligations for required records and legitimate interests in security and resolving disputes. Optional portfolio use relies on your separate permission, which you may withdraw.
Submitting a résumé, photograph, or other file does not make the whole submission public. We use your instructions and publication authorization to decide which material belongs on your website. Public pages, approved contact details, and downloadable files can be accessed and copied by visitors and search engines. Portfolio use requires separate permission.
Service providers
We share information with service providers only as needed to operate the service, or when required by law. These may include hosting and backup providers, Namecheap for domains, payment processors, Resend for service emails, and external tools used in the build process. Domain registration requires registrant contact information. The registrar's rules determine verification and any public registration disclosure.
Cloudflare Turnstile processes browser and device signals, such as an IP address and browser characteristics, to distinguish people from automated abuse on the Contact form. Cloudflare's Turnstile Privacy Addendum describes that processing. We use the verification result to decide whether to accept the message.
Resend processes service-email recipients and content. We record delivery, failure, bounce, and complaint information to manage message delivery. Support messages delivered to our Proton Mail mailbox are also stored there. Removing a record from the website's database does not by itself remove a delivered email from a mailbox.
AI tools we use to create your website may have access to any or all of the information you submit for the project, including your text, contact information, images, documents, and other uploaded files. Subaya Web does not itself use your information to train AI models or use private submissions for marketing. Portfolio use requires your separate permission. External providers' processing, including retention and any use for model training, depends on the provider, product, settings, and applicable agreements. We take reasonable precautions to limit exposure, but private submission does not mean that AI tools cannot access the material.
Providers may process information in countries other than your own. We share only what is needed for the relevant service and use reasonable safeguards to limit exposure.
Payment details are handled by the payment provider. We retain transaction references and payment status, not full card numbers or security codes. We do not sell personal information or use private submissions for advertising.
Storage and retention
Inactive organization inquiries and their uploaded files are scheduled for removal from active storage 90 days after the last recorded contact. Explicit quote acceptance restarts that 90-day period. An accepted but unpaid project's materials remain subject to the same cleanup rule. Accepting a quote does not retain them indefinitely. Further contact restarts the period, but merely opening a quote link or reading an inquiry does not. We retain limited quote, acceptance, invoice, and payment records where needed for an active invoice, payment reconciliation, security, disputes, or legal obligations.
Public Contact messages in our support queue are scheduled for removal 90 days after the last recorded contact. Correspondence connected to an account or project follows the service and support retention rules below. The queue's cleanup does not automatically erase copies already delivered to our support mailbox or a recipient's mailbox.
Once a project is paid, or a free personal order is confirmed, we retain the quote or order, account and project records, and materials needed to provide the service and meet financial, security, dispute, or legal obligations. Unneeded material remains subject to cleanup. Limited records remain to prevent duplicate processing and support security. Records needed to reconcile a payment in progress remain until it is resolved. Any backup copies expire through their configured retention schedule.
A remembered-device identifier stops authorizing access when it expires after seven days or is revoked. Login and confirmation credentials stop working at their own expiry or revocation. Authenticator verification material is retained while that method remains enabled, and replaced recovery codes stop working when a new set is issued. Limited audit records may remain after a credential stops working to investigate abuse, resolve disputes, or satisfy legal obligations. They do not preserve sign-in access.
The browser referral association expires after 90 days. A new eligible referral-link visit can replace it with a new 90-day period. Expired identifying visit records are removed when no longer needed to reconcile a purchase already in progress. Purchase attribution and aggregate campaign totals may remain after browser identifiers expire. Confirmed referral and reward records remain while needed to provide earned benefits, including lifetime rewards, and to prevent duplicate claims. Promo and redemption records remain while needed to enforce the offer's limits and maintain the related order, payment, refund, or dispute history. Retaining an earned reward does not require keeping every underlying visit log indefinitely.
An unpaid personal website submission must be paid within seven days after submission to remain available. The selected subaya.site address of an unpaid personal website is reserved only for the first 30 minutes after submission. After seven days, unpaid submissions and private uploads are scheduled for removal from active storage. We retain limited records needed to prevent duplicate processing and investigate security issues. If payment is already in progress or its outcome is uncertain, relevant records and materials remain until reconciliation is complete.
Your website source and all saved versions remain available while your account exists and Subaya Web operates, including when hosting is unpaid or discontinued. Security incidents or legal obligations may require additional verification or restrictions. On business closure, we provide at least 30 days’ notice and download access during that period. We retain private order materials and support records as needed to provide the service. Access controls and other safeguards help protect this information, but no system can guarantee absolute security.
You may request deletion of your account or files by emailing subayaweb@protonmail.com. Relevant financial, security, or legally required records may need to remain after deletion. We remove information from active systems when it is no longer needed for the service or those obligations. Any backup copies expire through their configured retention schedule. If a backup is restored, applicable deletion records must be reapplied before deleted submissions can return to normal service. Deleting a submission does not recall an email already sent or remove copies held by its recipient.
Your choices and contact
Where applicable data-protection law provides these rights, you may request access, correction, deletion, restriction, or portability of your information, object to processing, or complain to the relevant supervisory authority. You can withdraw consent for optional uses, such as portfolio inclusion, without affecting processing already lawfully carried out.
Use your account to download available source revisions and manage renewal payments. Personal sites also have self-service update, upload, publication, and visibility controls. For an organization site, contact Subaya through your account or by email about changes or publication. Contact subayaweb@protonmail.com to request access to, correction of, or deletion of your information, withdraw portfolio permission, or raise a privacy concern. We may request information reasonably needed to verify your identity. No particular request form is required.
Where the GDPR applies, we respond to privacy-rights requests without undue delay and within one month of receipt. If the complexity or number of requests requires up to two additional months, we notify you within the first month and explain why. If we cannot grant a request, we explain the reason and your available complaint rights within one month.
Turning a public site off does not remove copies already held by others. We will communicate material changes to the effective policy through the website and, where appropriate, your account email. See the Terms of Service for the hosting, ownership, and domain arrangements.