Privacy Policy

Last updated: October 29, 2026

This Privacy Policy explains how AI Centery (the "Service") collects, uses, and shares personal data. In this policy, "we", "us", and "our" refer to AI Centery. We act as the data controller for personal data we process about our account holders and website visitors. For personal data that our customers collect through the sites they build with the Service, our customers are the controllers and we act as their processor.

1. Personal data we collect

  • Account data: name, business name, email address, password (stored hashed), and subdomain.
  • Billing data: subscription plan and billing status. Card details are handled by our payment providers and are not stored on our servers.
  • Content data: the text, images, and settings you provide or generate to build your sites.
  • Usage and device data: log data, IP address, browser type, pages viewed, and similar analytics. (For how we count visits to websites, see section 5.)
  • Communications: messages you send us and email engagement.

2. How we use personal data

  • to provide, operate, secure, and improve the Service;
  • to process payments and manage subscriptions;
  • to generate content you request through our AI features;
  • to communicate with you about your account, support, and updates;
  • to detect, prevent, and address fraud, abuse, and security issues; and
  • to comply with legal obligations.

3. Legal bases

Where the EU or UK General Data Protection Regulation applies, we rely on one or more of the following legal bases: performance of a contract, our legitimate interests (such as securing and improving the Service), your consent (for example for non-essential cookies), and compliance with legal obligations.

4. Service providers and sub-processors

We share personal data with trusted providers who process it on our behalf, under contract and only for the purposes we specify. These currently include:

  • Stripe and Paddle for payment processing;
  • SendGrid for transactional email;
  • Twilio for messaging and telephony features;
  • Amazon Web Services (S3) for hosting and file storage;
  • AI providers (including Anthropic, OpenRouter, and Google) to generate text and images;
  • Google Analytics and Google Tag Manager for usage analytics;
  • Vercel to host our website and our customers' websites. Vercel also tells us a visitor's approximate country, region and city, based on their connection;
  • PostHog to see how people move from our website to sign-up and into the admin. It runs only where your consent choices allow it, and never when your browser sends a Global Privacy Control (GPC) signal.

We do not sell your personal data. We may disclose data if required by law or to protect our rights and the safety of others.

5. Cookies and analytics

Our visit counter. We count visits to our website, and to the websites our customers build with the Service, with our own visit counter. It uses no cookies and saves nothing on a visitor's device. To tell visits apart, it makes a random code from your IP address and your browser details, using a secret key that changes every day and is deleted the day after (copies stay in our backups for a while). The same person gets a new code each day, so the counter cannot follow anyone from one day to the next.

For each page view, the counter saves: the page address (without the part after a "?", and with private codes removed), the page title, the campaign tags in the link (such as utm_source), the name of the website that sent the visitor, the browser's full description of itself (its "user agent", which names the browser, its version and the device type), the approximate country, region and city that our host Vercel works out from the connection, the time, and how long the page was on screen. For visits from October 29, 2026 on, it never saves an IP address in any form, the full address of the page that sent the visitor, or the codes that ad networks add to links. Visit records from before October 29, 2026 keep a shortened IP address (its last part removed) until they are deleted after 13 months.

On the websites our customers build, the counter also notes taps on a phone number and opening the chat. When a visitor sends a request through a form or the chat, the request keeps details of the visit it came from, only when the visitor is counted: how the visitor found the website, the first page they saw, their approximate country, region and city, their type of device, browser and operating system, the page they sent the request from, and when the visit started. The request goes to the business that runs the website.

Who is counted. Visitors in the European Economic Area, the UK and Switzerland are counted only after they choose "Accept all". Visitors elsewhere are counted unless they choose "Necessary only". A browser that sends a "Do Not Track" or "Global Privacy Control" (GPC) signal is never counted, and on the sites we run it also gets no Google tags and no PostHog.

Your own visits. When an account holder opens their admin, we keep that day's code for their device for 13 months, and their browser keeps a small mark, so their own visits to their sites are not counted.

How long. Visit records are deleted after 13 months. We keep daily totals, which hold no visitor codes. Copies also stay in our backups.

Your choices. The counter never knows who a visitor is, so we cannot find, show or delete one person's visit records. To stop being counted, choose "Necessary only", or turn on Do Not Track or GPC in your browser.

Other analytics. We and our analytics providers (Google Analytics, Google Tag Manager and PostHog) use cookies and similar technologies, only where your consent choices allow. For details, see our Cookie Policy.

6. Data retention

We keep personal data for as long as your account is active and as needed to provide the Service, then for a reasonable period to meet legal, accounting, and dispute-resolution needs, after which we delete or anonymize it. Website visit records are deleted after 13 months, as section 5 explains.

7. International transfers

We may process and store data in countries other than where you live, including the United States. Where required, we use appropriate safeguards (such as standard contractual clauses) for international transfers.

8. Your rights

Depending on where you live, including under Jordan's Personal Data Protection Law and the GDPR, you may have rights to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, contact us at support@aicentery.com. You may also have the right to complain to your local data protection authority. New website visit records hold no name, email or IP address (records from before October 29, 2026 keep a shortened IP address until they are deleted after 13 months), so we cannot link them to you; section 5 explains how to stop being counted.

9. Security

We use technical and organizational measures designed to protect personal data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Children

The Service is intended for business users and is not directed to children under 18. We do not knowingly collect personal data from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and, where appropriate, notify you.

12. Contact

For privacy questions or requests, contact our team at support@aicentery.com.

How this website counts visits

This website counts visits with a visit counter from AI Centery, the platform it is built on. The counter uses no cookies and saves nothing on your device. To tell visits apart, it makes a random code from your internet connection and your browser. The code changes every day, so the counter cannot follow you from one day to the next, and new visit records keep no IP address (older records keep a shortened one until they are deleted after 13 months). For each page you view, it saves the page, the page title, the campaign tags in the link (such as utm_source), the name of the website that sent you, your type of browser and device, your approximate country, region and city, the time, and how long the page was on screen. It also notes when you tap a phone number or open the chat. If you send a request through a form or the chat on this website, the request keeps details of the visit it came from: how you found this website (for example a search engine or an ad), the first page you saw, your approximate country, region and city, your type of device, browser and operating system, the page you sent the request from, and when the visit started. This happens only when you are counted. If you are in the European Economic Area, the UK or Switzerland, you are counted only after you choose "Accept all". Elsewhere, you are counted unless you choose "Necessary only". If your browser sends a "Do Not Track" or "Global Privacy Control" signal, you are never counted. Visit records are deleted after 13 months.