Back to create account
Privacy policy
Last updated: 26 October 2026
In short
- We keep what is needed for you to have an account and build your stores: your email, a hashed version of your password and whatever you create inside.
- We do not sell your data, there is no advertising and we use no cookies or tracking tools. If you give us permission in the cookie notice, we count your visit in aggregate, without storing anything that identifies you.
- You can delete your account whenever you like from Settings, and everything of yours is deleted with it.
1. What data we process
Your account
- Your email address, which you use to sign up and sign in.
- Your password, never in plain text. We only keep a hash (scrypt) from which the password cannot be recovered. Nobody at Weblym can see it.
- Whether you confirmed your email, when you created the account and when you last signed in.
- If you signed up with the launch offer, the discount percentage we promised you.
- The verification codes we email you. We only keep their hash; they expire after one hour and can only be used once.
Your profile (you fill it in)
- A username. When you sign up we create it from the part of your email before the “@” (for example, [email protected] becomes ana). It may therefore reveal the start of your email. You can change it whenever you like in Settings.
- Your full name and what you do, only if you choose to enter them.
- Your profile photo, only if you upload one. An account starts without a photo, and we do not take one from anywhere else.
- Your app preferences (theme, language, text size…) and how you want the AI assistant to behave, including any text you write to guide it.
Your sessions and devices
When you sign in to your account we store, for each session:
- the IP address you signed in from;
- the browser and device (for example, “Edge on Windows”), as reported by your browser;
- when the session started and when it was last used.
This lets you see in Settings where your account is open and close anything you do not recognise. We do not store your city or your country.
To warn you when someone signs in to your account from a new device, your browser stores a random identifier. It is not derived from any of your data, it is only sent to our server and it cannot be used to follow you across other websites. With it we remember which devices have already signed in to your account.
What you create in Weblym
- Your workspaces, folders, stores and pages, with all their content.
- The images you upload for your pages.
If you upload photos or data of other people, you are the one who must have the right to do so. We store them so that you can use them in your stores.
The emails we send you
We log each email sent: which address it went to, what type it was (sign-up code, password code, sign-in alert or launch discount), when it was sent and whether it was delivered. We do not keep the content of the email. It is only used to help you if an email does not reach you, and these logs are deleted after 90 days.
The messages you write to us
If you write to us from the “Contact us” page, we receive your name, your email and your message. They reach us as an email in our inbox, so we can reply; we do not store them in the Weblym database. To prevent abuse, when you send it your browser solves the same small calculation as when you sign up.
If you join the waitlist, we receive your name and your email the same way, only to write to you when Weblym opens to everyone.
Technical logs
The provider that hosts our server logs, like any web server, the IP address of each request. We use those IPs to stop abuse, such as mass attempts to sign in or create accounts. Your email is not written to these logs. They are deleted automatically when the provider’s retention period ends, at most 30 days.
To stop automated account creation, when you sign up your browser solves a small calculation (our own captcha, with no third-party services). If your connection appears to come from a data centre, a VPN or the Tor network, the calculation takes a little longer. To find out, we compare your IP with public lists that we download from the providers themselves: your IP is not sent to anyone and the result is not stored.
Visit statistics
To know how many people visit Weblym and how they find us, each time you open one of our public pages your browser tells us which page it is, which website you came from, your time zone (for example, “Europe/Madrid”) and the language you chose. With that, and the browser type your browser reports, we add up daily totals: how many visits, from what type of device, in which language, from which time zone. We also count how many accounts are created and how many sign-ins there are each day.
We do not store your IP address, any identifier or the time of your visit: only the totals. To avoid counting you twice on the same day we use a digest of your IP and your browser mixed with a key that changes every day and is never stored; the next day that digest can no longer be recalculated. We do not use cookies for this and there is no third-party service involved. These totals are only seen by the Weblym team.
Visits are only counted if you accept it in the notice that appears when you enter the site; if you reject it, your browser does not tell us anything. You can change your answer at any time from the cookie policy. Sign-ups and sign-ins are always counted, because they happen on our server and not in your browser.
What we do not do
- We do not use cookies.
- We do not use third-party analytics, advertising or cross-site tracking.
- We do not sell or rent your data to anyone.
- We do not request fonts or other resources from third parties when loading our pages: they are served from our own domain.
2. What we use it for and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and maintaining your account, letting you sign in and storing what you create | Performance of the contract (art. 6.1.b) |
| Sending you the service emails: verification and password change codes | Performance of the contract (art. 6.1.b) |
| Storing and confirming the launch discount, if you requested it | Performance of the contract and pre-contractual steps at your request (art. 6.1.b) |
| Protecting your account: alerts for sign-ins from new devices and the list of open sessions | Legitimate interest in account security (art. 6.1.f) |
| Preventing abuse of the service (attempt limits per IP) | Legitimate interest in the security of the service (art. 6.1.f) |
| Replying to the messages you send us from “Contact us” | Legitimate interest in attending to those who write to us (art. 6.1.f) |
| Letting you know about the launch if you join the waitlist | Your consent, which you give by joining and can withdraw by writing to us (art. 6.1.a) |
| Counting visits to the website in aggregate | Your consent, which you give in the cookie notice and can withdraw from the cookie policy (art. 6.1.a) |
| Counting sign-ups and sign-ins in aggregate, to understand how Weblym is used | Legitimate interest in measuring use of the service, without identifying you (art. 6.1.f) |
| Knowing whether one of our emails was delivered, so we can help you | Legitimate interest in providing proper support (art. 6.1.f) |
Today we only send service emails. If we ever send marketing communications, we will ask for separate consent, which you will be able to withdraw at any time.
We do not make automated decisions about you or build profiles.
3. Who we share it with
We use these providers, which process data only on our behalf and following our instructions:
| Provider | Purpose | Where |
|---|---|---|
| Supabase | Database and file storage (profile photos and images for your pages) | London, United Kingdom |
| Render | Hosting of the Weblym server | Frankfurt, European Union |
| Resend | Sending emails, including “Contact us” messages to our inbox | United States |
| Zoho | Our mailbox ([email protected]), where we receive and answer the messages you write to us | European Union |
Transfers outside the European Union. The United Kingdom has an adequacy decision from the European Commission. Emails pass through the United States and are covered by the EU-U.S. Data Privacy Framework, under which the provider is certified and which has an adequacy decision from the European Commission.
We will only hand data over to an authority when a law requires us to.
4. How long we keep it
- Your account and everything in it (profile, preferences, stores, pages, photo and images): as long as the account exists. Deleting it deletes everything.
- Each session (with its IP and device): until you close it, or up to 30 days if you do not use it.
- Devices that have already signed in to your account: as long as the account exists, so we do not alert you again about a device we already know.
- Verification codes: they expire after one hour.
- Logs of emails sent: 90 days.
- Visit statistics: daily totals only, with no data that identifies you, which we keep to follow how the service evolves.
- “Contact us” messages: in our inbox, for as long as needed to help you and, at most, one year after the last reply.
- The waitlist: until we let you know about the launch; it is deleted afterwards.
- Server technical logs: at most 30 days, depending on the provider.
The images on a page are not deleted when that page is deleted, because they may be used on other pages of the same store. They are deleted when the store or the account is deleted.
5. What is stored in your browser
We do not use cookies. Some things are stored in your browser’s local storage (localStorage and sessionStorage), only so that the app works:
- Your session. Essential: without it you could not stay signed in to your account.
- The random device identifier explained in section 1.
- Your interface preferences: theme, language, text size, panel sizes, cursors, etc.
- What you are editing, so you do not lose changes if the tab closes.
- Your answer to the cookie notice, so we do not ask you again on every page.
- While you sign up, the email you typed on the home page or the one being verified, only during that visit.
None of this is used for analytics or tracking. You can delete it from your browser settings; if you do, you will be signed out.
6. How we protect it
- All communication with Weblym travels encrypted (HTTPS).
- Passwords and codes are only stored as hashes, never in plain text.
- The database cannot be accessed from the browser: only our server can read and write to it.
- Each account can only see and change its own data, and that is enforced by the database itself.
- Changing your password closes all your other sessions.
Profile photos and the images on your pages can be viewed with their link, without signing in, because they have to be shown in your published stores. Their links cannot be guessed and there is no way to list all the images.
7. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability at any time:
- From the app itself: in Settings you can correct your profile, view and close your sessions and delete your account with all its content.
- By email: write to us at [email protected] from your account’s address. We will reply within one month at most.
If you believe we have not handled your data properly, you can lodge a complaint with the data protection authority of your country. In Spain it is the Agencia Española de Protección de Datos (www.aepd.es).
8. Minors
To create a Weblym account you must be over 18: with it you can open a store, sell and receive payments, and that requires being able to sign contracts yourself. If you are a minor, do not create an account. If we learn that an account belongs to a minor, we will delete it with all its data.
9. Changes to this policy
If we change this policy, we will update the date above. If the change is significant, we will email you before it takes effect.
10. Who is the controller
The controller of your data is Weblym. For any question about your data or this policy, write to us at [email protected].
In this policy, “Weblym”, “we”, “us” or “our” refers to that controller.
This is a translation provided for convenience. If there is any discrepancy, the Spanish version prevails.