Skip to main content

Privacy Policy

Last updated: July 2026

This policy explains how Facet Cloud collects, uses, and protects personal information. We are based in New Zealand and handle personal information in accordance with the New Zealand Privacy Act 2020. Where we serve people in other regions, we also honour the additional rights described below, including under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).

1. Who we are

Facet Cloud, based in Wellington, New Zealand, is the agency and data controller responsible for the personal information processed through this service. For any questions about this policy, or to exercise your rights, contact us at [email protected].

2. What Data We Collect

We collect the following information when you use Facet Cloud:

  • Account information: Email address, password (stored as a bcrypt hash)
  • Payment information: Billing details processed securely through Stripe. We do not store your credit card numbers.
  • Site content: The content you create and publish on your Facet site, including text, images, files, and any video you upload for hosting.
  • Usage analytics: Page views, referrer data, country-level location, and browser information for your analytics dashboard
  • Technical data: Server logs, IP addresses, and request data necessary for operating the Service

3. How We Use Your Data

We use the data we collect for the following purposes:

  • Service delivery: Provisioning, hosting, and maintaining your Facet site
  • Billing: Processing payments and managing your subscription
  • Abuse prevention: Detecting and preventing violations of our Terms of Service
  • Service improvement: Understanding usage patterns to improve Facet Cloud
  • Communication: Sending essential service notifications (account, billing, security)

4. Creators and their subscribers

Facet Cloud is a platform where creators ("customers") build their own branded sites, newsletters, courses, and paid memberships. When a creator's own audience — their members, subscribers, and customers — provides personal information to a creator's site:

  • The creator is the controller of that information and is responsible for their own privacy practices, lawful basis, and communications with their audience.
  • Facet Cloud acts as a processor, handling that information on the creator's behalf and only as needed to run the Service.

If you are a member or subscriber of a site hosted on Facet Cloud and have a privacy request, please contact that site's owner in the first instance. We will assist creators in responding to such requests.

5. Legal Basis for Processing

For individuals protected by the GDPR, we process personal data on the following legal bases:

  • Contract performance (Art. 6(1)(b)): Processing necessary to deliver the Service, including site hosting, account management, and billing.
  • Legitimate interests (Art. 6(1)(f)): Processing necessary for security, abuse prevention, and service improvement, where those interests are not overridden by your rights.
  • Consent (Art. 6(1)(a)): Where we rely on consent (e.g., optional marketing communications), you can withdraw it at any time by contacting us or using the unsubscribe link provided.

Under the New Zealand Privacy Act 2020, we collect and use personal information in line with the Information Privacy Principles: we collect only what we need for the purposes above, directly from you where practicable, and use and disclose it only for those purposes or as permitted by law.

6. Cookies

We use a small set of strictly-necessary and preference cookies — for signing in, processing payments, and remembering your language and currency. We do not use advertising cookies or cross-site tracking. For the full list and how to manage them, see our Cookie Policy.

7. Third Parties

We share data with the following third-party subprocessors, solely for the purpose of operating Facet Cloud:

  • Stripe: Payment processing. Stripe handles all credit card data under their own privacy policy.
  • Hetzner: Server hosting. Your site data is stored on Hetzner infrastructure in Helsinki, Finland (EU).
  • Amazon Web Services (SES): Transactional and newsletter email delivery.
  • Bunny.net (BunnyWay d.o.o.): Video hosting and streaming. Video you upload is stored and delivered through Bunny's CDN; viewer playback requests are processed to deliver the stream.
  • Cloudflare: DNS management, CDN, and R2 object storage for the images and files you upload to your site. Cloudflare processes request data for DNS resolution and performance.

All fonts are self-hosted. No third-party font loading services (such as Google Fonts) are used.

We do not sell, rent, or share your personal data with any other third parties for marketing or advertising purposes.

8. International Data Transfers

Your site data is primarily stored and processed within the European Union. Where transfers to other countries occur, we ensure appropriate safeguards are in place:

  • Hetzner: Helsinki, Finland (EU).
  • Bunny.net: Slovenia (EU), with global CDN edge delivery.
  • Cloudflare: May process request data and store uploaded media (R2) in the US for CDN, DNS, and storage services. Covered by the EU-US Data Privacy Framework.
  • Stripe: Payment processing in the US. Covered by the EU-US Data Privacy Framework.
  • Amazon Web Services (SES): Email delivery in the US. Covered by standard contractual clauses (SCCs).

9. Data Retention

  • Active accounts: Your data is retained for as long as your account is active.
  • Deleted accounts: When you delete your account or your account is terminated, all associated data (site content, uploaded media, configuration, analytics) will be permanently purged within 30 days.
  • Billing records: Payment records may be retained as required by applicable tax and accounting laws.

10. Children's Privacy

Facet Cloud is a business tool intended for use by adults. It is not directed at children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact [email protected] and we will delete it. Creators who collect information from minors through their own sites are responsible for obtaining any required parental consent.

11. Your Rights

Depending on where you live, you have some or all of the following rights over your personal information:

  • Access: Request a copy of the personal data we hold about you.
  • Correction / rectification: Request correction of inaccurate or incomplete personal data.
  • Erasure: Request deletion of your account and all associated data. You can trigger a full account-and-data deletion from within the app at any time.
  • Restrict processing: Request that we limit how we process your data in certain circumstances (e.g., while we verify its accuracy).
  • Data portability: Request your data in a structured, commonly used, machine-readable format. We store your data in PocketBase and can provide a full export on request.
  • Object: Object to processing based on legitimate interests. We will stop processing unless we demonstrate compelling legitimate grounds.
  • Opt out of "sale" or "sharing" (CCPA/CPRA): We do not sell or share your personal information as those terms are defined under California law, so there is nothing to opt out of — but you retain the right to know, delete, and correct.
  • Non-discrimination: We will not deny you service or charge you a different price for exercising any of these rights.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

12. Complaints

If you are not satisfied with how we have handled your information, you can complain to the New Zealand Office of the Privacy Commissioner. If you are in the EU/EEA, you may also lodge a complaint with your local data protection authority; a list is available on the European Data Protection Board website.

13. Contact

For questions about this Privacy Policy, please contact us at [email protected]. See also our Terms of Service and Cookie Policy.