Privacy Policy

1. Who we are

Website Kit, run by Joana Nushi, Albania ("we", "us") sells ready-made website templates and sets them up for small businesses, along with AI chatbots and automations. Our address is Tirana, Albania. We are the controller of the personal data described in this policy. For any privacy question, contact us at hello@websitekit.store.

2. What we collect

Information you give us

• Order and contact forms: your name, email, phone or WhatsApp number, business name, the plan you chose and your message.
• Website details: the content you send for your site - texts, services and prices, opening hours, logo, photos, social links and contact details.
• Chat assistant: the messages you type into the chat on our website, and your name, email or phone if you choose to share them there.
• Emails and WhatsApp messages you send us.

Information collected automatically

• Anonymous visit statistics: pages viewed, referrer, country and device type, collected without cookies and without identifying you personally.
• Technical logs: IP address, browser and error information kept briefly by our hosting provider to keep the site secure and working.

Payment information

Website purchases are processed by Lemon Squeezy, our authorised reseller and Merchant of Record. Lemon Squeezy collects your payment details, billing address and the information it needs to calculate tax and prevent fraud, and acts as an independent controller of that data under its own privacy policy. We receive an order confirmation (product, amount, date, name, email and country) but we never see or store your full card or bank details. Custom projects paid by invoice may use PayPal, which handles that payment data under its own privacy policy.

3. Why we use it, and our legal basis

• To deliver what you ordered - building and hosting your website, chatbot or automation, and replying to you (performance of a contract).
• To answer questions before you buy (steps taken at your request before entering a contract).
• To issue invoices and keep accounting records (legal obligation).
• To keep the website secure and improve it using anonymous statistics (our legitimate interest).
• To send you news or offers - only if you have opted in, and you can unsubscribe at any time (consent).

4. Who we share it with

We never sell or rent your personal data. We share it only with service providers that help us run the business, under contracts that require them to protect it:

• Vercel - website hosting and anonymous analytics.
• Our database provider - storing orders and website details.
• Google (Gmail) - sending and receiving email.
• Lemon Squeezy - our authorised reseller and Merchant of Record: checkout, payments, tax, receipts and refunds.
• PayPal - only if you pay a custom project invoice with PayPal.
• Anthropic - generating the chat assistant's replies.
• n8n - automating how we process your website details.
• WhatsApp (Meta) - if you choose to message us there.

We may also disclose data if the law requires it, or to protect our rights in a dispute.

5. International transfers

Some of these providers process data outside your country, including in the United States. When they do, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

6. How long we keep it

• Order requests that don't become a project: deleted after 12 months.
• Website content: kept while we host your site, and deleted within 90 days after hosting ends.
• Chat assistant conversations: kept for up to 12 months, then deleted.
• Invoices and payment records: kept as long as tax and accounting law requires.

7. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and get a copy of it;
• correct data that is wrong or incomplete;
• ask us to delete your data;
• object to, or ask us to restrict, how we use it;
• receive your data in a portable format;
• withdraw your consent at any time, where we rely on consent.

To use any of these rights, email hello@websitekit.store. We reply within one month. You also have the right to complain to your local data protection authority.

8. Cookies

We don't use advertising or tracking cookies. See our Cookie Policy for details.

9. Security

We use encrypted connections (HTTPS), access controls and trusted providers to protect your data. No system is perfectly secure, but if a breach affects you we will tell you and the relevant authority as the law requires.

10. Chatbots and automations we build for clients

When we build a chatbot or automation for a business, that business decides how its own customers' data is used. We act as its processor and handle that data only on its instructions, under a data processing agreement.

11. Children

Our services are for businesses and are not directed at children under 16. We don't knowingly collect their personal data.

12. Changes to this policy

We may update this policy. The date at the top always shows the latest version, and if a change is significant we will let our clients know by email.