Privacy, plainly.

Updated 1 October 2026.

Who is responsible

Quidsites is a trading name of RCUK TRADING LIMITED, registered in England and Wales, company number 11195059. Our registered office is Brulimar House, Jubilee Road, Middleton Manchester, England, M24 2LX. We are responsible for the personal information used to run your Quidsites account and our business. Contact hey@quidsites.com about privacy or to exercise your rights.

What we collect and why

We collect your name, email, username, business and contact details, website brief, supplied text and images, approvals, support messages and billing references. We use these to set up your account, fulfil your order, build and manage your website, take agreed payments and send essential service messages. This is necessary to perform our contract with you, or our legitimate interest in providing the service where you act for a business customer. Without your account email and required brief details, we cannot provide the service.

We store a salted password hash, never your readable password. We use access records, secure session identifiers and request limits to protect accounts and investigate faults or abuse. Our lawful basis is our legitimate interest in operating a secure, reliable service. We keep necessary accounting records to meet legal obligations. Optional marketing measurement requires your consent. We do not sell your personal information or make decisions about you with legal or similarly significant effects solely by automated means.

Your website content

The information you approve for publication, including selected photographs and contact details, becomes public when your website launches. Other uploads remain private. Only supply material you are entitled to use; avoid uploading identity documents, payment-card details, passwords or sensitive information about other people. If you supply another person's contact details, tell them that you have shared these with us.

Providers and overseas processing

Hostinger hosts the application. Supabase stores account, website and service data and private uploads; our current database project is in London. Resend delivers sign-in links and service emails. Stripe processes payments and manages subscriptions; card details go directly to Stripe and are not stored by Quidsites. Our authorised team may use OpenAI's ChatGPT to prepare website designs and draft copy from the relevant business brief. We review work before publishing it. Domain or mailbox services are arranged with the provider identified during setup.

These providers may use staff or subprocessors outside the UK. A London database does not mean all processing stays in the UK. Applicable arrangements may include UK adequacy decisions or approved contractual safeguards. Provider information is available from Hostinger, Supabase, Resend, Stripe and OpenAI. Contact us for information about the safeguards relevant to your data.

How long we keep information

We keep your account and website information while providing the service. When it ends, we review what is still needed for an agreed export or handover, outstanding support, complaints and legal claims, and delete or anonymise information that is no longer needed. Ask us for deletion or a review of your retention period at any time. Necessary company accounting records are kept for six years from the end of the financial year they concern, or longer when required by law. A deletion request does not remove records we must legally retain. Provider backups expire under their own retention schedules.

Sign-in links expire after 20 minutes and can be used once. Customer sessions expire after seven days and staff sessions after eight hours. Tokens are stored as hashes. Expired access records are periodically cleaned up. Cookie preferences are stored on your device for up to 180 days.

Cookies and advertising

Essential secure cookies keep you signed in. With your permission, we use the Meta Pixel to measure visits, views of our plans and service pages, email contact clicks, checkout starts and confirmed purchases, and to support relevant advertising on Facebook and Instagram. It loads only after you accept marketing cookies. Meta receives browser and device information, IP address, page address, advertising cookie identifiers and event details, including the amount and currency of a confirmed purchase. We do not include your form entries, account details or card details in our event payloads, and tracking is excluded from private account and staff pages. Meta may associate this information with your Meta account and process it outside the UK. See Meta’s privacy policy and cookie policy. Advertising cookies such as _fbp and _fbc may be stored on your device; withdrawing consent stops our optional events and removes these cookies for our domain. You can reject optional tracking or change your choice using Cookie settings. Rejecting marketing cookies does not prevent you from using the service.

Your rights and complaints

Depending on the circumstances, you can ask to access or correct your information, have it deleted, restrict its use, receive a portable copy or object to processing based on legitimate interests. You can withdraw consent at any time without affecting earlier lawful processing. Email hey@quidsites.com; we may need to verify your identity and normally respond within one month. Your dashboard also lets you export your saved business details.

Please contact us if you have a concern so we can investigate it. You can also complain to the Information Commissioner's Office.