Privacy Policy

TheWebSuite (“TheWebSuite,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the information we collect and process. This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you:

• visit thewebsuite.co or any website operated by us;
• contact us or submit an inquiry;
• request a quote or consultation;
• purchase our services;
• subscribe to a service or support plan;
• use a website, application, portal, or other digital experience we operate;
• upload or provide files, documents, images, or other content;
• communicate with us regarding a project or support request; or
• otherwise interact with TheWebSuite.

This Privacy Policy applies to information we process as part of our own business operations. When TheWebSuite processes information on behalf of a client as part of providing technology, automation, website, database, portal, or other services, our client may be the organization responsible for determining how that information is collected and used. In those circumstances, we may process information on the client’s behalf as a service provider or processor under applicable law.

Client Information. For purposes of this Privacy Policy, “Client Information” means information provided to TheWebSuite by or on behalf of a client in connection with the services, including information contained in files, databases, applications, websites, forms, documents, integrations, workflows, or other systems that TheWebSuite is authorized to access or process.

Clients retain responsibility for determining whether they are authorized to provide Client Information to TheWebSuite and for complying with any privacy, consent, contractual, regulatory, professional, or other obligations applicable to that information. Where TheWebSuite processes Client Information on behalf of a client, the parties may enter into additional data processing terms or a Data Processing Addendum governing that processing.

1. Information We Collect

The information we collect depends on how you interact with TheWebSuite.

Information you provide directly

You may provide information when you submit a contact or inquiry form; request a proposal or quote; schedule a consultation; purchase or subscribe to our services; create or use an account; submit a support request; communicate with us by email or other channels; upload documents, images, files, or other materials; provide information about your business, project, systems, or workflows; or otherwise communicate with us. This may include:

• name;
• email address;
• telephone number;
• business or organization name;
• job title or role;
• billing information;
• project requirements;
• budget and timeline information;
• website and technical information;
• support requests;
• communications;
• files and documents;
• links and other content you provide; and
• information necessary to provide the services you request.

Account and authentication information

If a service we provide requires an account, we may collect information necessary to create and secure that account, such as your name, email address, authentication identifiers, account preferences, and access-related information. We do not intentionally collect or store passwords in plain text.

Payment information

Payments may be processed by third-party payment processors such as Stripe. Payment card information is generally entered directly into the payment processor’s secure environment rather than being transmitted to or stored by TheWebSuite. We may receive information such as the transaction amount, payment status, billing details, payment method type, and transaction identifiers necessary to administer your account and services. We do not intentionally collect or store your full payment card number.

When you tick a box agreeing to our License Terms before you pay for an order, or to our Terms of Service and License Terms before you pay an invoice, we record the version you agreed to, the date and time, your IP address, your browser information, your email address and what the payment was for, and keep that record as proof of the agreement.

Files, documents, and client content

Depending on the services you purchase, you may provide screenshots, documents, images, contracts, forms, spreadsheets, databases, customer information, project materials, or other content. We process this information only as reasonably necessary to provide, maintain, secure, troubleshoot, or improve the services you have requested and as otherwise described in this Privacy Policy or applicable agreement. You are responsible for ensuring that you have the necessary rights and permissions to provide information to us for processing.

Electronic signatures

Signatures a law firm collects from its own clients through a business system we host are covered under Hosted business systems in section 5, and belong to that firm. When you sign a proposal, agreement, or other document with us electronically, we record the name and title you enter, your email address, the date and time of signing, your IP address, your browser information, and a fingerprint of the exact document text you signed. We keep this record with the signed document as evidence of the signature and of what was agreed.

Purchases made on Etsy

If you bought a product from our Etsy shop and claim it at thewebsuite.co/etsy, we collect the Etsy order number, the name you type, your email address and your firm’s name. We ask Etsy to confirm the order: whether it is paid, refunded or cancelled, what it includes, the name on the order and the buyer’s Etsy account number, which we use to match later seat purchases to the same buyer. We keep a record of the claim, when you agreed to the License Terms and which version, whether you asked for the training email, sign-in links we send, sign-ins, downloads (each download carries a code tied to your license) and license changes, to provide your license and to resolve questions or disputes about the order. To stop abuse, we briefly count requests by internet address. If you asked for the training email, we send it once, with a link to stop further training emails. We do not receive your payment details from Etsy. Messages you send from that page are handled like any other message to us. Etsy’s own privacy policy covers your purchase on Etsy.

Information collected automatically

When you visit our website or use our services, we and our service providers may automatically collect certain technical information, including IP address; browser type; operating system; device type; pages or screens viewed; referring and exit pages; approximate geographic information; dates and times of activity; interaction information; diagnostic information; authentication and security logs; and information about how our website or services are used. We use this information primarily for security, operation, troubleshooting, analytics, and service improvement.

2. Information We Receive From Third Parties

We may receive information from third parties when necessary to provide our services. For example, this may include information from payment processors; scheduling services; authentication providers; analytics providers; cloud hosting providers; database and storage providers; communications platforms; business software and integrations; CRM systems; APIs connected at your direction; and other technology providers you authorize us to connect to your project. When you ask us to integrate your systems, the information available to us will depend on the permissions and access you authorize.

Public business information we use to contact businesses. We find businesses that may need our services, such as law firms, from public sources: map listings (OpenStreetMap), the business’s own website, and web search. From these we collect business information such as the business name, address, website, public business email address, phone number and the kind of work it does, and we may email the business about our services. These emails may be drafted with the help of our AI assistant and are approved by us before they are sent. Every email says who we are, gives our postal address and includes a way to unsubscribe. If you unsubscribe, reply asking us to stop or tell us you are not interested, we stop emailing you and keep your address on a do not contact list so you are not emailed again. You can also ask us to delete this information at any time (see section 13).

3. How We Use Information

We may use information to provide, operate, and maintain our services; respond to inquiries; communicate with you; prepare proposals and quotes; schedule consultations; create and manage client accounts; provide customer support; manage projects and workflows; process payments and subscriptions; administer invoices and billing; deliver websites, applications, portals, databases, automations, and integrations; troubleshoot technical issues; monitor system performance; maintain security and prevent fraud or abuse; authenticate users and control access; maintain logs and audit records; comply with legal and contractual obligations; enforce our agreements; improve our products and services; analyze website and service usage; develop and test features; provide requested AI-assisted functionality; and otherwise fulfill the purpose for which you provided the information.

We do not use personal information for purposes that are materially incompatible with the purposes described in this Privacy Policy without providing additional notice where required by law.

4. AI and Automated Processing

We may use artificial intelligence and automated processing technologies to assist with software development, analysis, summarization, drafting, workflow automation, customer support, and other services.

Depending on the service and the configuration used, information may be processed by third-party AI service providers. These providers may process information in accordance with their applicable privacy policies, terms, and contractual requirements.

Replies to your messages. When you write to us through the chat or a form on our website, or reply to one of our emails, our AI assistant may read the conversation to draft our answer. A person at TheWebSuite reviews every drafted answer, edits it if needed and approves it before it is sent; nothing our assistant drafts is sent without that approval. For this, the conversation is processed by our AI provider (currently Anthropic).

TheWebSuite does not operate or train its own artificial intelligence models using Client Information.

At this time, TheWebSuite may use third-party AI tools for development and other business purposes. We do not intentionally submit Client Information to consumer AI services for model training. Where AI processing is incorporated into a client’s production system or workflow, the applicable project agreement, data processing terms, and technical configuration will govern the permitted processing of Client Information.

AI-generated or AI-assisted output may be incomplete, inaccurate, or unsuitable for a particular purpose. AI output should be reviewed by an appropriately qualified person before being relied upon for legal, financial, medical, employment, compliance, or other consequential decisions.

5. Client Systems and Information Processed on Behalf of Clients

Some of our services involve building or operating technology for businesses. This may include websites; client portals; CRM integrations; databases; internal tools; document workflows; AI workflows; automated communications; intake systems; reporting systems; business process automations; and integrations between third-party applications.

In these circumstances, TheWebSuite may process information belonging to the client’s customers, employees, leads, vendors, or other individuals. Our client generally determines what information is collected, why it is collected, and how it should be used. We process that information according to the client’s instructions and our agreement with the client, subject to applicable law.

If you interact with a website, portal, form, or system that was built or operated by TheWebSuite for one of our clients, you should generally direct privacy requests concerning that information to the organization operating that service. Where required by applicable law, TheWebSuite may enter into a separate data processing agreement or similar agreement with the client governing our processing of personal information.

What we host. We host the websites and systems we build for clients and the products we sell them, by default, unless the client chooses their own host. The data in them belongs to the client, who can export all of it at any time, with no fee. While we host a build, the client may bring in their own developer, and we give that developer only the access their work needs, and we share the client’s data with that developer only if the client asks us in writing. If TheWebSuite ever goes silent for 60 days, every client automatically receives their own records and a copy of their build that runs on its own; each client receives only their own records.

Hosted business systems. When we host a business system such as Casekeep for a firm, the data the firm enters (for example its clients, contacts, matters, time, invoices and trust records, the firm’s own clients’ client portal sign ins and messages, electronic signature records the system captures from signers such as name, email address, IP address, browser, consent wording and a fingerprint of the signed document, emails the firm files into the system, and the audit and deletion logs) is stored with Supabase, which runs the database, and served through Vercel, which runs the app. It is stored in the United States unless the firm asks for another region we support. The firm owns that data, decides what goes into it and is responsible for its clients’ information; we process it on the firm’s behalf. Only TheWebSuite staff working on the firm’s setup, hosting, Care or custom work can access it, and only as needed for that work. The database is backed up regularly. When hosting ends, we hand the firm a full export of its data and a copy that runs on its own accounts within 14 days of its written request, and once that handover is done we delete the data from our hosting; copies in routine backups are removed as those backups expire. A firm that runs the system on its own accounts, by agreement with us, controls where its data is stored, and we can access it only if the firm gives us access for work it asks us to do. A copy the firm runs itself sends none of the firm’s data to TheWebSuite. When a license key is entered, and about once a day after that, it sends us the license key, a random install number, the address of the site it runs on and the number of people with access (a number only, never who they are), so we can activate the key and limit it to the installations and seats the license allows; we keep that record for as long as the license exists and for our business records after that. Nothing else leaves the copy unless someone presses one of its two buttons in Settings, Feedback and help. Send feedback sends what they wrote and an optional score with their name, email, business and license number, the product and its version; with Send anonymously on it sends only what they wrote, the score, the product and its version, and nothing that says who they are. Request help always sends what they wrote with their name, email, business, the product, its version and the license number, so we can answer. Report a problem sends the same, with the notes they pin on the screen and any screenshots they choose to take; a screenshot shows whatever is on the screen at that moment, which can include the firm’s own records, so the system warns before the first one. Screenshots are kept privately with the support ticket and seen only by TheWebSuite staff working on it. The same two buttons appear in the editor of a website we sell or host, only for its owner and never for its visitors, and send the site’s address instead of a license number. We keep feedback and help requests with our support records.

6. Third-Party Service Providers and Subprocessors

We use third-party providers to operate our business and provide our services. Depending on the services involved, our primary subprocessors include:

The full, current list of every service we use, what each one does for us and a link to its own security page is at thewebsuite.co/subprocessors. We update it before we start using a new service that receives personal information.

These providers may process information on our behalf or, depending on the service, process information under their own terms as independent providers. We do not authorize service providers to use information processed on our behalf for purposes unrelated to providing the services, except where otherwise permitted or required by law.

7. Information Sharing and Disclosure

We may disclose information to service providers that help us operate our business; to technology providers necessary to provide requested services; to third-party systems you instruct us to integrate; when you authorize us to do so; to comply with applicable law; in response to lawful requests from governmental authorities; to protect our rights, property, systems, or users; to investigate fraud, abuse, security incidents, or other unlawful activity; in connection with a merger, acquisition, financing, sale, restructuring, or other business transaction; or where otherwise permitted by law.

We do not sell personal information for monetary consideration.

While we advertise, and only if you turn on Marketing in our cookie settings, we use the Google Ads tag and the Meta Pixel to measure whether one of our ads brought you to our website and whether you then sent a request, booked a call, or made a purchase. Google and Meta receive browser and device identifiers and information about those visits, and may use it under their own terms. Under some state laws, including California’s, this may count as “sharing” personal information for cross-context behavioral advertising. Marketing is off unless you turn it on, you can turn it off at any time from the Cookie settings link in the footer, and a Global Privacy Control signal from your browser keeps it off.

8. Cookies, Local Storage, and Similar Technologies

We may use cookies, local storage, session storage, and similar technologies. These technologies may be used to maintain website and application functionality; authenticate users; maintain sessions; remember preferences; remember interface settings such as theme preferences; maintain security; prevent abuse; understand website usage; and improve our services.

We use Google Analytics to understand how visitors use our website, including information such as pages viewed, device type, approximate location, and general usage patterns. Google Analytics and any other non-essential technology load only after you turn them on in our cookie settings; until then, only technologies necessary to run the site are used. You can change your choice at any time from the Cookie settings link in the footer, and you may also control cookies through your browser settings. Disabling certain technologies may affect the functionality of portions of our website or services. When you arrive through a link that carries campaign tags (for example from one of our ads or posts), we keep those tags, the page you landed on, and the site that sent you in your browser’s session storage for that visit, and include them with any form you send, so we know which ad or post led to a request. This stays with us; it is not sent to advertisers. Our Cookie Policy lists each technology we use, why, and how long it lasts.

9. Analytics

We may use analytics services to understand website traffic and how visitors interact with our website. Analytics information may include pages viewed; approximate geographic location; device type; browser information; referral information; interaction information; approximate session information; and other technical information. Analytics providers place cookies or use similar technologies only after you consent to analytics in our cookie settings. We do not use analytics information to sell personal information or provide cross-context behavioral advertising.

10. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide services; maintain client and business records; fulfill contractual obligations; maintain accounting and tax records; resolve disputes; enforce agreements; maintain security; comply with legal obligations; and protect our legal rights.

Retention periods may vary depending on the type of information and the reason it was collected. When information is no longer required, we may delete, anonymize, or otherwise securely dispose of it. Some information may remain in backups for a limited period before being securely overwritten or deleted. Records of an Etsy license claim are kept for as long as the license exists and for our business records after that. Client-specific retention requirements may also be governed by the applicable service agreement or data processing agreement. Data in a hosted website or system is deleted from our hosting once the handover after hosting ends is done, as described in Section 5.

Your client portal. Your client portal stays available after your project is finished, so you can sign in later and find your documents, invoices and messages. If you ask us to close it, we turn off sign in and the portal is no longer available to you. We keep the records we need for accounting, tax, our agreement with you and any dispute (such as invoices, payment records, signed agreements, proposals and our messages about the project) for up to seven years after the project ends, and then delete them. If you also ask us to delete your personal information, we delete what we are not required to keep. We can reopen a closed portal if you ask.

Files you upload to your portal. Photos and files you upload to your project are stored with your project, and we keep a backup copy in your client folder in Google Drive in case the main copy is ever lost. Both are kept with your project records and deleted with them; if you ask us to delete your data, we remove the backup copy too, except where the law or our agreement requires us to keep the file.

11. Data Security

We maintain reasonable administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, or destruction.

Information transmitted to or from our services is generally protected using encrypted connections such as HTTPS/TLS. Access to systems and information is limited based on operational requirements, and we take reasonable steps to protect credentials and system access.

No method of transmission, storage, or electronic security can be guaranteed to be completely secure. Accordingly, we cannot guarantee the absolute security of information. We will take reasonable steps to investigate and respond to suspected security incidents and provide notices where required by applicable law.

12. International Data Transfers

Because we use technology providers that may operate in multiple countries, information may be processed or stored outside the country where you reside. Where applicable law requires safeguards for international transfers, we seek to use appropriate mechanisms and contractual protections for those transfers. Third-party providers may maintain their own information regarding the locations where they process or store information.

13. Your Privacy Rights

Depending on where you live and subject to applicable legal exceptions, you may have rights concerning your personal information. These may include the right to know or access personal information we hold about you; request correction of inaccurate information; request deletion of personal information; request portability of certain information; object to certain processing; restrict certain processing; withdraw consent where processing is based on consent; opt out of certain forms of sale or sharing; limit certain uses of sensitive personal information; and lodge a complaint with a relevant privacy or data protection authority.

To exercise applicable rights, contact us using the information in the Contact Us section below. We may need to verify your identity before completing certain requests. We will not use identity-verification information for unrelated purposes. We will respond within the period required by applicable law.

You can also download a copy of your data, or delete it, yourself at thewebsuite.co/my-data. Enter the email you have used with us and we send a one-time link to that address. When you ask us to delete your data, we remove everything we are not required by law or tax rules to keep, such as invoices, payments and signed agreements, and we tell you what was kept.

14. California Privacy Rights

California residents may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. Subject to applicable exceptions, California residents may have the right to know the categories and specific pieces of personal information collected; know the categories of sources from which information is collected; know the purposes for which information is used; know the categories of third parties to whom information is disclosed; request deletion; request correction; opt out of the sale or sharing of personal information; limit certain uses and disclosures of sensitive personal information; and receive equal treatment for exercising applicable privacy rights.

The CCPA also requires covered businesses to provide information regarding categories of personal information, sources, purposes, and third-party disclosures. TheWebSuite does not sell personal information. If you turn on Marketing in our cookie settings, we may share identifiers and information about your visits to our website with Google and Meta for advertising measurement, as described in Section 7. You can opt out of this sharing at any time by turning Marketing off in Cookie settings (the link in the footer of every page). It is off by default, and a Global Privacy Control signal turns it off automatically.

California residents may submit privacy requests by contacting us at info@thewebsuite.co. If you operate exclusively online, California law permits an email address to serve as the designated method for certain consumer requests.

15. European Economic Area and United Kingdom

Where applicable, individuals in the European Economic Area or United Kingdom may have rights under the GDPR or UK GDPR. Depending on the circumstances, we may process personal information based on:

• Contract: when processing is necessary to provide services you request or perform a contract with you;
• Consent: where we ask for and obtain your consent, including for certain non-essential analytics;
• Legitimate interests: where necessary to operate, secure, maintain, improve, and protect our business and services, provided those interests do not override applicable rights; and
• Legal obligations: where processing is necessary to comply with applicable law.

Depending on the circumstances, you may have rights to access, rectify, erase, restrict, object to, or port personal information and to withdraw consent where processing is based on consent. Where TheWebSuite processes personal information strictly on behalf of a client, the client may act as the controller and TheWebSuite may act as the processor. The distinction depends on who determines the purposes and means of processing. You may also have the right to lodge a complaint with the data protection authority in your country.

16. Sensitive Personal Information

Please do not submit sensitive personal information through our public website unless we specifically request it or the service you are using is designed to process that information. Depending on applicable law, sensitive information may include government identification numbers, account credentials, precise location information, financial account information, health information, biometric information, or other categories defined by applicable law. If a client engages TheWebSuite to build or operate a system that processes sensitive information, the processing of that information may be governed by additional contractual, security, or data-processing requirements.

17. Children’s Privacy

Our services are not directed to children under 16. We do not knowingly collect personal information from children under 16 through our general website. If you believe that a child has provided personal information to us, please contact us so that we can investigate and take appropriate action.

18. Third-Party Websites and Services

Our website and services may contain links to third-party websites, applications, or services. We are not responsible for the privacy, security, or content practices of third parties that we do not control. You should review the privacy policies of third-party services before providing information to them.

19. Do Not Track

Some browsers provide a “Do Not Track” signal. Because there is currently no universally accepted standard for responding to all browser-based Do Not Track signals, our website may not respond to such signals unless required by applicable law. We treat a Global Privacy Control signal as a request to opt out of sharing: Marketing technologies stay off in a browser that sends it.

20. Business Transfers

If TheWebSuite is involved in a merger, acquisition, financing, restructuring, sale of assets, bankruptcy, or similar transaction, personal information may be transferred as part of that transaction. We will take reasonable steps to ensure that information continues to be handled consistently with this Privacy Policy or that appropriate notice is provided where required.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, business practices, legal requirements, or privacy practices. When we make changes, we will update the Last Updated date at the top of this Privacy Policy. If we make material changes that require additional notice under applicable law, we will provide appropriate notice.

22. Contact Us

If you have questions about this Privacy Policy, want to exercise an applicable privacy right, or have concerns about how your information is handled, contact:

TheWebSuite
Email: info@thewebsuite.co
Website: thewebsuite.co