Privacy Policy

1. Introduction

This Privacy Policy explains how Squarepaste (“Squarepaste,” “we,” “us,” or “our”) collects, uses, discloses, and safeguards information when you use the Squarepaste app (the “App”), our private client live chat web application for the websites you build; when you visit squarepaste.com (the “Site”); when you purchase a plugin or template; when you join our affiliate program; or when you engage us for custom design work. By using the App or the Site, you acknowledge that you have read and understood the practices described here.

For your account, purchases, and visits to the Site, Squarepaste is the “controller” of your personal information. When a designer uses the App to chat with their own clients, the designer decides what is shared and why, and Squarepaste processes that content on the designer’s behalf as their service provider (a “processor”). If you are a designer’s client, questions about your messages are best sent to that designer first; we will help them respond. Our Data Processing Addendum sets out how we handle that content.

2. Information We Collect

We collect the following categories of information:

• App account information: When you create or manage an App account, your name, email address, and the website domains you connect to your account.
• Content you send through the App: Messages, tasks, files, photos, and voice notes exchanged between you and your clients through the chat widget and dashboard.
• Provided directly on the Site: Your email address (entered at checkout, in a form, or in correspondence), your name (if provided), the Squarespace site URL you intend to license a plugin onto, and any project details you share with us through our forms or by email.
• Affiliate information: If you join our affiliate program, your name, email address, your affiliate code, the visits and sales credited to it, and the payout account you connect through Stripe.
• Payment information: Card and billing details are collected and processed by Stripe, Inc. We do not see or store your full card number. We receive a confirmation that payment succeeded along with the customer email and the last four digits of the card.
• Usage information on the Site: The pages you view, the links you click, how long you stay on a page, the page that referred you, your browser and device type, and an approximate location (city, region, and country) derived from your IP address. We do not store your IP address with this information; we keep only a one-way code made from it that changes every day, so visits cannot be linked to you over time.
• Server logs: Our hosting providers keep standard request logs containing IP address, browser type, referring page, and timestamps. These are used for operational and security purposes only.

We do not ask for, and ask you not to send us, sensitive information such as health, financial account, or government ID numbers.

3. How We Use Your Information

We use the information we collect to:

• Operate, maintain, and improve the App, including authentication, managing your subscription, enabling chat, and notifying you of activity in your account.
• Process and fulfill plugin and template orders, including delivering Squarespace invitations and transferring template ownership.
• Send order receipts, delivery notifications, and support replies.
• Operate the order-recovery flow at /requests/recover so you can recover your files using your order ID and email.
• Respond to support inquiries and custom-project requests.
• Credit affiliates for the visits and sales they refer, and pay their commissions.
• Understand how the Site is used and improve it, using the usage information described above.
• Prevent fraud and abuse, and keep the Site and the App secure.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell or rent your personal information, and we do not share it for cross-site or targeted advertising. We do not use it to make automated decisions that have legal or similarly significant effects on you. We do not send unsolicited marketing email: you will receive account-, order-, and program-related correspondence only, unless you have explicitly opted in to our newsletter, which you can leave at any time.

4. Legal Bases (EEA, UK, and Switzerland)

If you are in the European Economic Area, the United Kingdom, or Switzerland, we rely on the following legal bases to process your personal information:

• Contract: to provide the App, fulfill your orders, run the affiliate program, and deliver custom work you request.
• Legitimate interests: to understand how the Site is used, credit affiliate referrals, prevent fraud, and keep our services secure. We limit this processing to what is necessary and design it to protect your privacy, and you may object to it at any time.
• Consent: for our newsletter. You may withdraw consent at any time.
• Legal obligation: to keep tax and accounting records.

5. Third-Party Services

We share limited information with the following service providers, each of which processes it solely to deliver its contracted services and under its own privacy policy:

• Stripe, Inc. processes all payments, subscription billing, and affiliate payouts. See Stripe’s privacy policy.
• Supabase manages authentication, database operations, and the storage of account-related data and Site usage information.
• Cloudflare hosts and runs the App, including the dashboard and the chat widget, and routes email sent to our addresses.
• Vercel Inc. hosts squarepaste.com, processes standard request logs, and provides Vercel Web Analytics, which counts page views without cookies. See Vercel’s privacy policy.
• Resend sends our transactional email, such as receipts, form confirmations, and account notices.
• Anthropic processes the text you type into the Site’s template finder to suggest matching templates. Do not enter personal information there.
• Squarespace, Inc. hosts the templates we transfer to you and receives the email address you used at checkout so we can issue an Administrator invitation. See Squarespace’s privacy policy.
• Google (YouTube) serves videos embedded in some of our blog posts.

We may also disclose information if required by law, to protect our rights or the safety of others, or as part of a merger, acquisition, or sale of assets, in which case this policy will continue to apply to your information.

6. Cookies and Browser Storage

We do not use advertising cookies, tracking pixels, or cross-site trackers. We use only the following:

• Affiliate cookie (sp_ref): set only when you arrive through an affiliate’s link, so the affiliate is credited if you buy within 90 days. It holds only the affiliate’s code and expires after 90 days.
• Sign-in storage: the App stores a session in your browser to keep you signed in.
• Visit ID: a random ID kept in sessionStorage so the pages you view in one visit can be counted together. It is not linked to your identity and is erased when you close the tab.
• Cart and in-progress builds: kept in your browser so they are still there when you come back. They never leave your device until you check out.
• Stripe: Stripe’s checkout components may set their own cookies for fraud prevention, governed by Stripe’s privacy policy.
• YouTube: videos are embedded in YouTube’s privacy-enhanced mode, which does not set cookies until you play a video.

You can clear or block cookies and browser storage in your browser settings; the Site will still work, though your cart will not be saved. If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as an opt-out and do not record usage information for your visit.

7. Data Security

We take commercially reasonable steps to protect the information we store, including encryption, HTTPS across the Site and the App, server-side request validation, least-privilege access to our internal tools, and reputable infrastructure providers. Payment card data never touches our servers; it goes directly from your browser to Stripe.

All chat messages sent through the App are encrypted. Each website is assigned a unique access code that safeguards its messages, so they can only be decrypted and accessed by authorized users through the Squarepaste system. Messages are stored encrypted and decrypted server-side on retrieval, so each website’s messages remain independently protected.

No method of transmission or electronic storage is 100% secure, and we cannot guarantee absolute security. If a breach affects your personal information, we will notify you and the relevant authorities as the law requires.

8. Data Retention

App account information is kept until you delete your account or it is terminated under our Terms of Service. Messages sent through the App are kept for 180 days and then automatically deleted. When you delete your App account, it is closed right away and its data is kept for 30 days so you can restore it; after that, all data associated with it, including personal information and stored communications, is permanently removed from our systems.

Order records (your email, the product purchased, the amount, and the Squarespace site URL where applicable) and affiliate commission records are retained for at least seven (7) years to comply with U.S. tax and accounting requirements. Site usage information is kept for up to 26 months. Server logs are retained for up to 90 days. Project files and correspondence for custom engagements are retained for the duration of the engagement plus a reasonable archival period for follow-up support, generally not longer than two (2) years.

9. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or restrict the processing of your personal information; to obtain a copy of your data in a portable format; to object to certain processing; and to withdraw consent you have given. You may also ask us to permanently delete your App account and all associated data. To exercise any of these rights, email us at [email protected]. We may need to verify your identity before acting on a request, and you may use an authorized agent. We will respond within 30 days. We do not discriminate against users who exercise these rights.

United States: Residents of California, Colorado, Connecticut, Virginia, and other states with consumer privacy laws have the rights above, including the right to know what categories of information we collect and why. We do not sell personal information or share it for cross-context behavioral advertising, and we honor Global Privacy Control signals. If we decline your request, you may appeal by replying to our decision, and we will respond to your appeal within 45 days.

EEA, UK, and Switzerland: You also have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first, so please contact us.

10. Children’s Privacy

The Site and the App are not intended for anyone under the age of 16, and we do not knowingly collect personal information from children. If we learn that such information has been collected, we will promptly delete it.

11. International Users

Squarepaste is based in the United States and processes data in the U.S. If you use the Site or the App from outside the U.S., your information will be transferred to, stored in, and processed in the U.S., which may have data-protection laws that differ from those of your country. Where the law requires it, these transfers are protected by our providers’ safeguards, such as the European Commission’s Standard Contractual Clauses or the EU-U.S. Data Privacy Framework.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal obligations. The “Updated” date at the top of this page shows the most recent revision. Material changes will be posted here and, where appropriate, sent by email to active customers. Continued use of the Site or the App after changes are posted constitutes acceptance of the revised policy.

13. Contact

Questions or requests? Email us at [email protected] or write to Squarepaste, 4015 Travis Dr., Ste 211, Nashville, TN 37211.