Baumeister — Privacy Policy

DRAFT FOR ATTORNEY REVIEW. Not legal advice; not final. Must be reviewed and finalized by counsel and must accurately match your actual data practices before use. Items in [BRACKETS] require your input.

Last updated: [DATE]

This Privacy Policy explains how [LEGAL ENTITY NAME] ("Baumeister," "we," "us") collects, uses, and shares information when you use the Baumeister platform (the "Service"). By using the Service you agree to this Policy.

1. Information We Collect

Information you provide:

• Account information: your email address (used for magic-link sign-in).
• Content: the websites, text, images, logos, and other materials you create, upload, or generate.
• Business description: information you type to guide the AI in building your site.
• Payment information: processed by our payment processor, [Stripe]. We do not store full card numbers; we receive limited billing details and a customer identifier from the processor.

Information collected automatically:

• Usage data: basic logs such as actions taken, credits used, timestamps, and device/browser information, to operate and secure the Service.
• Cookies/local storage: we use browser local storage to keep you signed in. [If/when analytics or non-essential cookies are added, disclose here and provide a consent mechanism.]

Information from your site visitors (Message Portal):

• When a visitor submits a message through a form on your published site, we collect the information they provide (e.g., name, email, message) and make it available to you, the site owner. You are the controller of that information; we process it on your behalf.

2. How We Use Information

• To provide, operate, maintain, and secure the Service;
• To generate and publish your websites (including via AI) and deliver Message Portal messages to you;
• To process payments and manage subscriptions;
• To communicate with you about your account, security, and service updates;
• To detect, prevent, and address fraud, abuse, security, and technical issues;
• To comply with legal obligations and enforce our Terms.

3. How We Share Information

We do not sell your personal information. We share information only:

• Service providers who help us operate the Service (e.g., [Cloudflare] for hosting/infrastructure, [Stripe] for payments, [Resend] for email, [domain registrar/OpenSRS] for domain services), under contracts limiting their use of the information;
• Legal/compliance: when required by law, legal process, or to protect rights, safety, and the integrity of the Service;
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to this Policy.

4. AI Processing

To generate and edit your site, your inputs (such as your business description and current site content) are sent to our AI provider, [Anthropic], to produce output. [Confirm provider data-handling terms; state whether inputs are used for model training — per provider's API terms, typically not — GC to confirm and disclose accurately.]

5. Data Retention

We retain your information for as long as your account is active and as needed to provide the Service, then for a reasonable period for backups, legal, and security purposes. You may request deletion as described below; some data may be retained where required by law.

6. Your Rights and Choices

Depending on where you live (e.g., California/CCPA, EU/UK/GDPR, and other state laws), you may have rights to access, correct, delete, or port your personal information, and to opt out of certain processing. To exercise these rights, contact [PRIVACY EMAIL]. We will respond as required by applicable law. We will not discriminate against you for exercising your rights.

California residents: [CCPA-specific disclosures — categories collected, sold/shared (we do not sell), retention, and rights — GC to finalize.]

EU/UK residents: [If you have EU/UK users: legal bases for processing, international transfer mechanism, and DPO/representative info — GC to finalize. If you do not serve EU/UK, state scope accordingly.]

7. Security

We use reasonable technical and organizational measures to protect information (including encryption in transit and storage of secrets in protected systems). No method of transmission or storage is completely secure; we cannot guarantee absolute security.

8. Children's Privacy

The Service is not directed to children under 13 (or the applicable age), and we do not knowingly collect their personal information. [GC to confirm threshold and COPPA applicability.]

9. Changes to This Policy

We may update this Policy. We will post the new version with an updated date and, for material changes, provide additional notice.

10. Contact

[PRIVACY EMAIL] · [BUSINESS MAILING ADDRESS]