Privacy Policy

Effective date: 7 October 2026

What The Web is a mission-driven company (SAS à mission), registered in Paris under RCS 999 506 132, 27 avenue de l'Opéra, 75001 Paris, France. We build and run websites for social and solidarity economy organisations. Contact: [email protected].

This policy covers our platform: the website builder, the back-office (the Admin), the What The Web mobile app, the e-shop, and the What The Web connector (https://mcp.whattheweb.org), which lets an AI assistant work on your sites for you.

The websites we host belong to the organisations that use our platform. Personal data those organisations collect from their own visitors and members (forms, memberships, online sales) is processed by us on their behalf; their own privacy policy applies to it.

Our Terms of Service set out how we process this data on their behalf (section "Protecting your users' personal data").

• Account data: your email address and password, or your Google or Apple identity if you choose to sign in with one of these services.
• Content you create: your sites, pages, images, data tables, voice notes and internal documentation (Memory).
• Payment data: payments are processed by Stripe. Card details are entered on Stripe's secure interface and never pass through our servers.
• Cookies: our services use no cookies or trackers that require consent. Scripts an organisation adds to its own site fall under that organisation's policy.

The connector lets an AI assistant (such as Claude or ChatGPT) read and edit, on your behalf, your sites, your data tables and your internal documentation (Memory). It only reaches the accounts and sites you already have access to.

• Sign-in uses OAuth 2.1: you log in to What The Web and authorise access. We store a hash of the token, never the token itself. The access token is valid for 30 days and renewable for 90 days. You can revoke it at any time from your account, or by disconnecting the connector in your AI assistant.
• Changes made by the assistant stay as drafts: nothing is published without a human action. Some changes are sent as proposals that a person accepts or rejects; we keep these proposals as a history.
• We keep no log of the content exchanged through the connector: no tool arguments, no IP addresses. We only record the date the token was last used.
• Semantic search (text and images) runs on our own servers. No data is sent to OpenAI or any other AI provider for this.
• Memory documentation is versioned on our own Git server (https://git.whattheweb.org).
• When you ask to import an image from a URL, our server downloads that URL.
• What the AI assistant does with data on its side is governed by its own provider's privacy policy (Anthropic, OpenAI…).

We use your data to provide and run the service: hosting your sites, giving you access to your account, processing payments and answering your requests. We never use your data to train AI models.

As set out in our Terms, we may showcase an organisation's published site on whattheweb.org. Minors may use our services with the permission of a parent or guardian.

Legal basis - Providing the service rests on our contract with you; keeping invoices rests on our legal accounting obligations; securing the platform and the connector (such as recording a token's last use) rests on our legitimate interest.

Where your data is stored - Our servers are hosted by Hetzner in Germany. Files are stored on Hetzner Object Storage in Falkenstein, Germany, and served from https://media.whattheweb.org. All of this stays within the European Union.

Security - All connections are encrypted (HTTPS). Passwords are stored hashed, and connector tokens as a hash. Access to production servers is restricted to the What The Web technical team.

We share your data only with the providers we need to run the service:

• Hetzner (Germany): hosting and file storage.
• Stripe: payment processing.
• Google and Apple: sign-in, for users who choose it.
• Expo (United States), Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): delivery of mobile app notifications. They receive the device's notification identifier and the notification text.
• SMTP2GO: delivery of service emails (notifications, password resets).
• Google Workspace: our email correspondence with you.

Transfers outside the EU - Stripe, Google and Apple are certified under the EU-US Data Privacy Framework and bound by the European Commission's standard contractual clauses. SMTP2GO is based in New Zealand, which the European Commission recognises as offering adequate protection.

• Active accounts and their content: for as long as the subscription runs.
• Deleted accounts: erased within 30 days; backups are overwritten on a rolling 90-day cycle. Invoices are kept for 10 years, as required by French accounting law.
• Connector proposals history: kept for as long as the site exists, and deleted with it.
• Connector tokens: until they expire or are revoked; we keep only a hash and the date of last use.

Under the GDPR you can access, correct and delete your data, and object to or restrict its processing. To exercise these rights, write to [email protected]; we reply within one month.

You can also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

What The Web, 27 avenue de l'Opéra, 75001 Paris, France — [email protected]

We will post any change to this policy on this page with its new effective date.

Terms of Service, which include our legal notices.