Your data, handled with care.

Comet is operated by Comet Website Builder Ltd, company number SC903672, registered at 39 Countesswells Crescent, Aberdeen, AB15 8LN.

For personal information that we collect for our own purposes, Comet Website Builder Ltd is the data controller.

Questions about privacy can be sent to contact@cometwebsitebuilder.com.

1. Information we collect

Depending on how you use Comet, we may collect:

Account information. This may include:

• your name;
• email address;
• account details;
• login and authentication information;
• account preferences; and
• information about your subscription.

Billing information. Our payment provider processes payment details on our behalf. We may receive information such as:

• billing name and address;
• transaction identifiers;
• subscription status;
• payment status; and
• limited payment-method information.

We do not intend to store complete payment-card numbers ourselves.

Website and content information. When you build a website using Comet, we may process:

• text;
• images;
• videos;
• files;
• website settings;
• domain information; and
• other content you choose to upload.

Usage and technical information. We may collect information about how Comet is used, such as:

• IP address;
• browser and device information;
• pages and features used;
• timestamps;
• error and diagnostic information;
• security logs; and
• general usage information.

Communications. If you contact us, we may retain your message and related correspondence so that we can respond and provide support.

Reports. If you report a website or a problem, we keep your report, the address you reported, and your name and email address if you give them. For a problem with Comet we also keep your browser type and the Comet page you came from. We use this to investigate, act on and reply to your report.

2. Why we use personal information

We use personal information where necessary to:

• create and manage Comet accounts;
• provide the website-building service;
• host and publish websites;
• process subscriptions and payments;
• authenticate users;
• provide customer support;
• send important service communications;
• prevent fraud, abuse and security incidents;
• maintain and improve Comet;
• understand how the service is used;
• comply with legal and accounting obligations; and
• send marketing communications where permitted.

Staff access to your websites. Comet staff may view your websites, including unpublished drafts, only where this is necessary to provide support you have asked for or to investigate suspected abuse, fraud or a breach of our policies. Our staff draft-viewing tool requires a written reason, records the view before displaying content, and does not allow content editing. These controls apply to that tool; access through our infrastructure providers is separately restricted.

3. Our legal bases

Depending on the circumstances, we process personal information because:

• Contract — processing is necessary to provide the Comet service you have requested.
• Legitimate interests — processing is reasonably necessary to operate, secure, support and improve Comet, provided those interests are not overridden by your rights.
• Legal obligation — we need to retain or process certain information to comply with the law.
• Consent — where required, we will ask for your permission, for example for certain marketing communications or non-essential cookies.

You can withdraw consent where processing is based on consent.

4. Emails

We may send you service-related emails concerning matters such as:

• account verification;
• password resets;
• subscription status;
• payments;
• security;
• service changes; and
• important account information.

These are different from optional marketing communications. If you subscribe to marketing emails, you can unsubscribe using the link provided in those emails.

We currently use specialist email providers to help deliver communications.

5. Payments

Payments may be processed by Stripe or another payment provider identified during checkout. Payment providers process certain information under their own privacy terms and security arrangements.

6. Service providers

We use trusted service providers to operate Comet. These may include providers for:

• hosting and content delivery;
• cloud infrastructure and database storage;
• email delivery;
• payment processing;
• analytics;
• customer communications;
• security;
• print-on-demand or ecommerce integrations; and
• other infrastructure required to operate Comet.

Our providers may include services such as Cloudflare, Supabase, Stripe, Resend, OpenAI, Unsplash and Google Analytics, depending on the features being used. We only share information where reasonably necessary for the relevant service.

AI features. The site assistant and the AI site builder are answered by our AI provider, OpenAI. When you use them, Comet sends your request to OpenAI together with what it needs to answer: for the assistant, an outline of your site (its pages, their words, buttons, links and settings, the pictures already in your site, and the business notes the assistant keeps); for the builder, your answers to its questions. If you choose to let the assistant see the page, a screenshot of the page you are editing is sent too, and photos you attach are added to your site’s files and sent with the request. If you ask the assistant to look at other websites, OpenAI searches the web for you. To suggest stock photos, Comet sends search words based on your site to Unsplash, and photos you keep load from Unsplash. We send AI requests with the provider’s option to store them switched off; the provider may still keep them for a limited period under its own terms, for example to detect abuse. Comet does not keep the content of your requests. We record how much each request used, for your AI balance, and the business notes are saved with your site. Please don’t put other people’s personal information into a request unless you need to.

7. Websites created by Comet customers

Comet customers may create websites that collect personal information from their own visitors. In those circumstances, the owner of that website will generally decide why and how the visitor information is collected. The website owner may therefore be the data controller, while Comet may process certain information on their behalf. Website owners are responsible for providing appropriate privacy information to their own visitors and for complying with applicable privacy and data-protection requirements. Additional data-processing terms may apply where Comet acts as a processor.

For ordinary orders placed through a Comet-hosted shop’s Stripe checkout, Comet stores the purchased items, payment reference and totals, buyer name and email, delivery address, checkout answers and dispatch or tracking details. We make these available to the shop owner and use our email provider to send order and dispatch messages. Card details are handled by Stripe.

When a shop uses Printful fulfilment, its checkout collects the buyer’s name, email and delivery address to calculate delivery and submit a paid order. Comet stores that delivery information in encrypted form while checkout and order processing are pending, and shares it with Printful to fulfil a paid order. It is removed from Comet’s quote storage after Printful accepts the order; abandoned quotes expire after seven days and are removed by scheduled cleanup. Failed removals are retried.

Where a published website uses analytics, this works as follows. The website shows a short cookie banner asking visitors whether analytics can be used; Google Analytics is not loaded until a visitor agrees. If they decline, our integration sends no analytics events or cookieless analytics pings and sets no analytics cookies. Necessary hosting and security logs are separate from analytics. If a visitor agrees, Comet collects basic visit statistics about that visit — which pages were viewed, roughly where the visitor came from, and simple interactions such as button clicks — using Google Analytics, to help us and the website's owner understand how the website is being used. Our analytics events do not read form contents, and our integration removes URL fragments and non-campaign query parameters and filters recognisable email addresses and phone numbers. Advertising features are disabled by our integration. Website owners must keep personal information out of page addresses, titles and campaign tags, and configure any additional integrations they enable accordingly. A website owner can also connect their own, separate Google Analytics account to their site; when they do, that account receives the same kind of visit information under the owner's own control, and Comet does not read or store reports from a customer's own Google Analytics account.

8. International data transfers

Some of the service providers we use may process information outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, we will use an appropriate legal mechanism or work with providers that provide suitable safeguards.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the reason it was collected. The periods and criteria below apply to different records:

• Active account information — for as long as the account remains active;
• Closed accounts and deleted websites — account closure disables sign-in and takes websites offline. Deleted sites and closed accounts become eligible for permanent cleanup after 30 days. Scheduled cleanup removes their active records and associated stored media; incomplete removals are retried. This is not a promise that all backups, provider logs or legally required records disappear on day 30;
• Financial and accounting records — retained for the period required by applicable tax and accounting law;
• Support correspondence — retained while needed to resolve your request, handle follow-up questions or disputes, and meet legal obligations;
• Reports — retained while needed to investigate, record decisions, handle appeals, prevent repeated abuse or respond to legal claims or requests from authorities;
• Security and technical logs — retained according to their purpose, incident-investigation needs and the storage and deletion controls of the relevant provider;
• Marketing information — used for marketing until you unsubscribe or close your account. We keep the minimum opt-out record needed to avoid contacting you again;
• Ordinary shop orders and order emails — kept with the website for order fulfilment, customer support and the owner’s records, and removed from Comet’s active storage when the website is permanently purged. Copies held by the shop, email recipients and payment providers have their own retention periods;
• Pending Printful checkout delivery details — removed after successful order submission, with a seven-day expiry for abandoned quotes and scheduled retries for failed cleanup.

Backup and provider-held copies may remain after records are removed from the active service, subject to the provider’s retention and deletion controls. We do not promise a separate recoverable backup of each website or its uploaded files. Browser storage and copies you download remain on your devices until cleared or deleted; closing your account cannot erase copies on another device. We review the need to retain support, report and security records and remove or anonymise them when they are no longer needed.

10. Security

We take reasonable technical and organisational measures designed to protect personal information. These measures may include:

• access controls;
• authentication;
• encryption where appropriate;
• restricted administrative access;
• logging and monitoring;
• secure cloud infrastructure; and
• limiting access to people and service providers who need it.

No online system can guarantee absolute security.

11. Cookies and analytics

Comet may use cookies or similar technologies to operate the service, remember settings, understand usage and improve performance. Strictly necessary technologies may be used where required to provide the service. Where consent is legally required for analytics, advertising or other non-essential technologies, we will request it before using them — see section 7 for how this works on websites published with Comet. See our Cookie Policy for more information.

12. Your rights

Depending on the law that applies to you, you may have rights relating to your personal information, including the right to:

• access information we hold about you;
• correct inaccurate information;
• request deletion;
• restrict certain processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• complain to a data-protection authority.

In the UK, you can complain to the Information Commissioner's Office (ICO). You can exercise your rights by contacting contact@cometwebsitebuilder.com. We may need to verify your identity before completing certain requests.

13. Children's privacy

Comet is not intended to be purchased or operated by children. We do not knowingly seek to collect personal information from children for the purpose of creating paid Comet accounts.

14. Changes to this Privacy Policy

We may update this Privacy Policy as Comet develops, our providers change, or legal requirements change. Where a material change affects how we use personal information, we will take reasonable steps to bring it to users' attention.

15. Contact

Comet Website Builder Ltd
Registered office: 39 Countesswells Crescent, Aberdeen, AB15 8LN
Company number: SC903672
Email: contact@cometwebsitebuilder.com