Privacy Policy
Last updated: 1 September 2026 · Effective: 1 September 2026
This Privacy Policy explains what personal information Dovetail
Ventures LLC ("Mostly Hostly", "we", "us"), a Texas limited liability
company, collects, why, who we share it with, and what choices you have. It
covers the website-hosting service at mostlyhostly.com and its
subdomains, and the customer websites we host at
*.mostlyhostly.site and on connected custom domains (together, the
"Service"). It sits alongside our Terms of Service.
It is written for two audiences:
- Customers — people who create a Mostly Hostly account and build a site.
- Site visitors — people who visit a website we host. See section 3.
Who is responsible for your data (controller / processor)
- For account, billing, and support information, and for the security and abuse logging described in section 2.5, Mostly Hostly is the controller.
- For the content of a customer's site and information about that site's visitors, the customer who owns the site is the controller and Mostly Hostly acts as their processor (service provider), handling that data only to run the Service and on the customer's instructions. Customers are responsible for having their own privacy notice where the law requires one.
If you are a customer and need a Data Processing Addendum for your own
compliance, contact hello@mostlyhostly.com.
1. Quick summary
| We collect | Examples | Why |
|---|---|---|
| Account data | email address, hashed password, account and verification status, marketing opt-in | create and secure your account, contact you about the Service |
| Site content you provide | onboarding wizard answers (business name, description, address, phone, hours, menu/services, "vibe"), uploaded logo and photos, text and code you push to your repository | build and host your website |
| Payment data | billing name, address, and card details — entered directly with Stripe; we receive only a customer/subscription identifier and payment status | take subscription payments |
| AI feature inputs | the wizard answers, images, and edit instructions you submit — sent to our AI provider to produce the output | generate and edit your site |
| Security / abuse logs | IP address, timestamps, and account actions (signup, site create/delete, domain claim, AI usage), CAPTCHA result | prevent fraud, abuse, and runaway cost; enforce usage limits |
| Support messages | what you send to hello@mostlyhostly.com and our replies | help you |
| Site-visitor data | for visitors to sites we host: IP address, request time, page path, referring site, and browser user-agent, from server access logs | give the site owner basic traffic statistics; keep the Service secure |
We do not use cookies or scripts to track visitors across sites, run advertising networks, sell personal information, or use your content or your customers' data to train our own models.
2. Information we collect
2.1 When you create an account
- Email address — your username and how we contact you.
- Password — stored only as a salted hash by our authentication system.
- Verification and account state — whether your email is confirmed, the verification token we email you, and your account status (active / flagged / suspended).
- Marketing opt-in — a yes/no flag from an unchecked box at signup. You can change it or unsubscribe at any time.
- Access code / invitation — we may require one to register; we record that it was used.
2.2 When you build and manage a site
- Onboarding wizard answers — the information you type about your business: name, what it does, address, phone number, opening hours, menu or service list, events, and a free-text description of the style or "vibe" you want.
- Uploads — images you add (logo, menu photos, room photos). These are stored on our server and committed into your site's git repository.
- Repository content — everything in your site's git repository, including anything you or a tool you connect pushes to it, and the built website.
- Site settings — your subdomain, any custom domain you connect, plan and trial status, and activity logs (deploys, publishes, AI edits, reverts).
- Developer / AI-tool access — if you enable it: a git username we create for you, and metadata about the access tokens you generate (a short prefix and the issue date — never the full token or a password). If you connect an external AI tool over our connector, the OAuth client registration and the access/refresh tokens issued to it.
Wizard answers and site content are visible to anyone who views your published site or its preview URL, because that is their purpose.
2.3 Payment information
Payments are processed by Stripe. You enter your card details on Stripe's hosted checkout — we never see or store your full card number. From Stripe we receive and store a customer identifier, a subscription identifier, and the status of your subscription (trialing, active, past due, cancelled). Stripe's own Privacy Policy governs how it handles your payment data.
2.4 AI features
The onboarding generator and the "describe a change" editor send the information you provide — your wizard answers, uploaded images, and edit instructions, together with the current files of your site — to our third-party AI provider (currently OpenAI, via its API) to produce the draft or edit. We also keep a usage ledger: which type of job ran, the model used, token counts, and the approximate cost, so we can enforce your monthly allowance.
We use the provider's API, not its consumer products. As of September 2026, OpenAI states that data submitted through its API is not used to train its models and is retained for up to 30 days for abuse and misuse monitoring, after which it is deleted, unless a longer period is required by law. Do not put confidential information into the AI tools.
2.5 Automated security and abuse logging
To keep an open signup form from being abused (fake accounts, subdomain squatting, running up AI cost), we record:
- your IP address and a timestamp against account actions — signup, site creation and deletion, custom-domain claims, and AI generations/edits — in an append-only event log;
- the result of a CAPTCHA / anti-bot challenge at signup, if enabled;
- rate-limit counters keyed to your IP address;
- abuse signals we derive from the above (for example, many sign-ups from one IP address, or many rapid deletions), which may lead to an account being flagged or suspended for manual review.
IP addresses in the event log are automatically erased after 90 days; the non-identifying event record is kept (see section 7).
2.6 Support and other communications
If you email us or we email you about the Service, we keep that correspondence so we can follow up and keep a record.
3. Information about visitors to sites we host
The shared web server that serves every hosted site writes a standard access log. For each request it records the visitor's IP address, the date and time, the host and path requested, the HTTP status, the referring URL, and the browser user-agent string. These raw logs are held on the server for up to about 45 days and then overwritten.
Periodically, an automated job reads the log and produces daily aggregate counts per site — number of page views, an approximate visitor count (based on the number of distinct IP addresses that day), the top referring websites, and the top pages. Only these aggregates are kept long-term (see section 7) and shown to the site owner in their console. The aggregates do not contain IP addresses or let the owner identify an individual visitor.
We do not set cookies on visitors, run client-side analytics or fingerprint scripts, or track visitors from one hosted site to another.
Note that a generated site's contact section may embed a Google Maps map of the business address. When it does, the visitor's browser contacts Google directly and Google may set its own cookies; this is Google's processing, under Google's Privacy Policy. Site owners can switch the embedded map to link-only or off.
4. Cookies and local storage
We keep our use of cookies and browser storage to the minimum needed to make the Service work. We do not use tracking, analytics, advertising, or cross-site cookies anywhere.
- The admin console stores a login token and your unsaved wizard progress in your browser (local storage), so you stay signed in and don't lose your work. This is strictly necessary for the console to function; it is not shared with us beyond what the sign-in itself sends, and clearing it just signs you out.
- The marketing site (
mostlyhostly.com) sets nothing. - Sites we host (
*.mostlyhostly.siteand connected domains) set no cookies of their own. The one exception is an optional Google Maps embed a site owner may enable, which lets Google set its own cookies in the visitor's browser (see section 3). Owners can use a link or static map instead.
5. How we use information, and our legal bases
The "legal basis" column uses GDPR / UK GDPR terminology for customers and visitors to whom those laws apply. In the United States, we process this data to provide the Service you have asked for and for our legitimate business interests in running it securely and sustainably.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create your account, authenticate you, provide the Service | account data, site content, settings | performance of a contract |
| Take payment and manage your subscription | account data, Stripe identifiers | performance of a contract |
| Generate and edit your site with AI | wizard answers, uploads, edit instructions, site files | performance of a contract |
| Send service and transactional email (verification, trial, billing, security notices) | email address | performance of a contract / legitimate interests |
| Send optional product news | email address, marketing opt-in | consent |
| Prevent fraud and abuse, enforce usage limits, keep the Service secure | security/abuse logs, IP addresses, CAPTCHA result | legitimate interests / compliance with legal obligations |
| Give site owners basic traffic statistics | visitor access logs → aggregates | legitimate interests (of the site owner, as controller) |
| Respond to support requests | support messages, account data | legitimate interests |
| Comply with law and respond to lawful requests | any of the above as required | legal obligation |
| Defend legal claims | any of the above as required | legitimate interests |
We do not carry out automated decision-making that produces legal or similarly significant effects on you. Account flagging and suspension for suspected abuse are reviewed by a person before any lasting action.
6. Who we share information with
We are a small operation. We do not sell personal information or share it for advertising. We share data only with service providers that help us run the Service, and only what each needs for its role. All of them are based in, or process data in, the United States.
| Category of provider | What we use it for | What it receives |
|---|---|---|
| Cloud hosting and infrastructure | running the servers that store and serve the Service | the data described in this policy, at rest and in transit |
| Network and security (Cloudflare) | DNS, traffic routing, and the anti-bot check on our signup form | domain names; visitor and customer IP addresses in transit; anti-bot challenge results |
| Payments (Stripe) | processing subscriptions and payments | your billing details, entered directly with Stripe, plus your email |
| AI provider (OpenAI) | generating and editing your site | the wizard answers, images, edit instructions, and current site files you submit to the AI tools |
| Email delivery | sending verification, trial, billing, and security emails | your email address and the message content |
| Off-site backup | keeping a secondary copy of each site's repository for disaster recovery | your repository content and the author name/email set on your commits |
| Certificate authority | issuing HTTPS certificates | domain names, which appear in public certificate-transparency logs |
| Maps (Google) | the optional map embed on a generated site, served by Google straight to the visitor's browser | the visitor's IP address and the map request |
We may also disclose information:
- to comply with law, a court order, or a valid request from a public authority;
- to enforce our Terms or protect the rights, safety, and property of Mostly Hostly, our customers, or the public (including sharing details of an abuse report with the reporter or a hosting/abuse contact);
- in connection with a merger, acquisition, or sale of assets, in which case we will require the recipient to honour this policy or notify you of any material change.
We update this section when the categories of providers change. A customer with a Data Processing Addendum can request the current list of named providers and will be told of changes as that addendum provides.
7. How long we keep information
| Data | Retention |
|---|---|
| Account record | while your account exists, then deleted within 30 days of account closure, except records we must keep for legal, tax, or dispute reasons |
| Site repository, uploads, settings, and traffic aggregates | while the site exists; after a site is taken offline they are kept for the 14-day grace period in the Terms (a never-published draft: 5 days), then permanently deleted |
| Off-site backup mirror of a repository | removed when the repository is deleted; short-lived backup snapshots age out within 30 days |
| Payment records | as required for tax and accounting — 7 years; card details are never held by us |
| AI usage ledger (job type, model, token counts, approximate cost — no site content) | 7 years, as a financial record |
| Security / abuse event log | the event record is kept for 24 months; the IP address is erased after 90 days |
| Raw web-server access logs | overwritten after about 45 days |
| Offboarding / deprovision audit record (no site content) | 24 months |
| Support correspondence | 7 years after the matter closes |
8. Security
- The server accepts SSH connections by key only, with password login and root login disabled, a host firewall, and automatic security updates.
- Passwords are stored only as salted hashes. Secrets and API keys are held in restricted files, not in our code repository.
- Site builds run in a locked-down, throwaway sandbox with no access to other customers' data, and every deploy is screened automatically before it goes live.
- Access to the production server and database is limited to the operator.
- Backups exist to help us recover the Service; see the Terms — they are not a substitute for keeping your own copy of your repository.
No system is perfectly secure. If we become aware of a breach affecting your personal information we will notify you and any regulator as required by law.
9. International transfers
Our servers and our providers (section 6) are in the United States. If you use the Service from outside the US, your personal information is transferred to and processed in the US. Where the law requires a transfer safeguard (for example, the EU/UK Standard Contractual Clauses), we rely on the provider's incorporation of those clauses in its data processing terms.
10. Your rights
Depending on where you live, you may have some or all of these rights over your personal information:
- access — a copy of what we hold;
- rectification — correct what is wrong;
- erasure — delete it (subject to records we must keep);
- restriction and objection — limit or object to certain processing, including direct marketing (which you can always opt out of);
- portability — receive certain data in a portable format. You can already clone your site's git repository and export your traffic aggregates from the console at any time;
- withdraw consent — where we rely on consent, without affecting past processing;
- complain to a data protection authority.
To exercise a right, email hello@mostlyhostly.com.
We will respond within the time the law allows (generally one month for GDPR/UK
GDPR requests). We may need to verify your identity.
If your request is about your data as a visitor to a site we host, or about data a customer holds about you, we will pass the request to the site owner, who is the controller for that data, and help them respond.
Complaints. If you are in the EEA or UK, you may lodge a complaint with your local data protection supervisory authority. If you are a California resident, the CCPA/CPRA gives you rights to know, delete, and correct your personal information and not to be discriminated against for exercising them; we do not sell or "share" personal information as those laws define it. Other US states may give you similar rights.
11. Children
The Service is not directed to children. You must be at least 18 to have an account. We do not knowingly collect personal information from children. Site owners are responsible for ensuring their own sites comply with any rules that apply to content directed at children.
12. Changes to this policy
We may update this policy. For material changes we will email your account address before the change takes effect. The "Last updated" date at the top always shows the current version. Continuing to use the Service after a change takes effect means you accept the updated policy.
13. Contact
- Privacy questions and requests:
hello@mostlyhostly.com - Abuse reports:
abuse@mostlyhostly.com - Data controller of record: Dovetail Ventures LLC (Texas,
USA). A postal address is available on request at
hello@mostlyhostly.com. - EU/UK representative or Data Protection Officer: not appointed — the Service is offered from the United States to a small, invitation-based group and we do not currently target the EEA or UK.