How we use your information
Who is responsible
Creaton Talent Limited operates FreeWebsiteClub. Contact hello@creatonmgmt.com with privacy questions or requests. This notice covers your use of FreeWebsiteClub. Your own website will have a separate notice for its visitors.
Company details
Creaton Talent Limited is registered in England and Wales, company number 17489877. Registered office: 1 Coldbath Square, London, EC1R 5HL, England.
Account setup and payments
Email accounts use Better Auth on Cloudflare with private D1 account records, secure session cookies and hashed passwords. Resend sends verification and password-recovery emails. Stripe handles payment details; we keep order, customer and subscription references and payment results, not card numbers. Verified accounts are linked only to their confirmed paid orders. Password confirmation is not retained and passwords are excluded from website briefs. The sign-in page shows any available social sign-in options.
Starting your website request
When you click Build Now, we ask for your name, email address, optional phone number and business name before you choose your website. Submitting the contact form asks us to help with, and contact you about, that website request. We may follow up the same day about this request, including on WhatsApp if you supply a phone number, even if you have not bought. This is to respond to your request and take steps towards the service, not permission for unrelated marketing. Tell us not to contact you, or reply STOP on WhatsApp, to stop the follow-up. It does not create an account or place an order. Your contact details can be carried into the later business form so you do not have to enter them again.
What we collect
Contact and account email, account/session identifiers, business details, website choices, supplied text, images and documents, draft progress, confirmations and order/payment references. Each verified account and paid order has separate private storage. Please send only information you are entitled to share and avoid unnecessary sensitive information in files or text.
Why we use it
We use the information you choose to supply to prepare and manage your requested website and draft, respond to you, and take steps at your request towards providing our service. These uses rely on the contract basis where applicable. We also use necessary security information to protect accounts, private files and the service, relying on our legitimate interest in preventing unauthorised access. We do not treat approving a website as consent to marketing.
Who receives it
Cloudflare hosts the website and private account/order databases and file storage. Resend delivers account and service emails. Stripe processes payments. Initial contact enquiries are copied to our private Google Sheets enquiry tracker for requested website follow-up, whether or not you pay. Confirmed briefs and project files reach our authorised team through the private Telegram workflow and its Google Sheets client tracker. Our team uses Claude Code and Anthropic to prepare and revise website source from the supplied brief and relevant files. If you order a new domain when that option is available, your separately confirmed registration name, email, international phone and postal details are shared with Cloudflare Registrar and the relevant domain registry for registration. If you choose Google sign-in, Google shares your name, verified email and profile picture to create or access your account. Meta receives the limited advertising events described below.
International transfers
These providers and authorised team members may process information outside the UK. We use the providers’ applicable data-processing terms and international-transfer arrangements where available. Contact hello@creatonmgmt.com for the arrangements relevant to your project. A Western Europe storage location hint does not guarantee that every operation remains in the UK or Europe.
Unused drafts
Unused contact enquiries and unlinked drafts are cleared after 90 days without a saved change. Paid project files are treated separately as service records.
Active service records
Completed briefs and project files remain available during your subscription for building, reviewing, revising and maintaining the website. Deletion is reviewed when you cancel or request it. Account, payment, approval, cancellation, support and accounting records are kept separately where necessary for the service, disputes or legal obligations; contact us for the records relevant to your request. Domain registration and consent records are separate from your website draft. Contact us to access or correct those details, arrange renewals, or discuss removal where registry and service record requirements allow.
Backups and copies
Cloudflare D1 keeps provider recovery history. The team workflow also has private R2 recovery copies, saved source archives and its Google Sheets tracker. Deletion requests are reviewed across the active stores, saved source and tracker; recovery copies may remain until their provider or backup lifecycle ends. We do not use deleted information from backups for ordinary service work.
Security records
Lead rate counters expire after their configured window. Necessary account/session, payment audit and minimal deletion/concurrency records support security and reliable billing. We review their removal with account closure and customer requests, retaining records where needed for security, disputes or legal obligations.
Cookies and browser storage
Essential secure HttpOnly cookies identify the saved enquiry, order and verified account session. Private files require their owning verified account/order or a scoped team service key. Temporary session storage preserves website choices, form progress and checkout confirmations while you view policies or return from Stripe. Production advertising measurement uses a separate 24-hour measurement-session cookie, Meta browser/click identifiers and campaign storage as explained below. The Cookies link opens this information.
Analytics and advertising measurement
On the production website, Meta advertising measurement loads when you open a page. We use it to measure advertising and the steps from an enquiry to payment. It does not wait for a cookie-banner choice. First-party funnel analytics remains a separate setting.
Advertising measurement information
Meta receives PageView, Lead, InitiateCheckout and confirmed Purchase events, the funnel label and actual GBP amount, including zero-value test orders. We retain campaign labels, Meta click and browser identifiers (_fbc and _fbp), and checkout IP address and browser information. The Conversions API sends SHA-256 hashed email and phone where collected, identifiers, IP and browser information for advertising measurement and matching. Hashing is not anonymisation. Brief text, photos and documents are not sent to Meta.
Meta and browser information
Meta’s browser script runs on production pages with automatic event configuration disabled. We send the advertising events and identifiers described above, not your brief text, photos or documents. Requests disclose page, browser and network information to Meta. Browser settings can restrict advertising cookies and requests. Meta’s privacy and cookie policies explain its processing and retention.
Measurement retention
Advertising identifiers and a secure HttpOnly measurement-session cookie last up to 24 hours. Advertising event IDs are retained for up to 90 days to prevent duplicate conversions. Attribution and pending server matching data expire after 24 hours. Successful server delivery removes its matching payload. Meta applies its own retention rules.
Advertising controls
You can restrict Meta advertising using your browser’s cookie and tracking controls and Meta’s advertising settings. Contact us using the details in this notice with privacy questions.
Other processing
Email accounts, free/existing website addresses and supported standard-domain purchases are available. Google sign-in is optional and uses only basic identity details: name, verified email and profile picture. Apple sign-in is not available. Supplying a brief does not authorise public release of private contact details or client website publication; those use the separate review and approval workflow.
Your choices and rights
You can ask to access, correct, erase or restrict your information. Where applicable, you can ask for portability or object to processing. These rights depend on the circumstances and legal basis. Contact hello@creatonmgmt.com to make a request.
Your right to object
You can object to uses relying on legitimate interests, including the relevant security processing, on grounds relating to your situation. Contact hello@creatonmgmt.com and we will consider your request.
Complaints
You can contact us about a concern and you also have the right to complain to the Information Commissioner’s Office.
Supplying information
You can browse without sending a draft. We need the required business and contact details to prepare your requested website. Optional photos, reference sites and design interests can be left blank. We will identify any additional information needed for a selected feature.
Notice version: production-page-load-meta-2026-10-26. Updated: 2026-10-26