Privacy Policy

For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), the data controller is KoalaWeb ("KoalaWeb", "we", "us" or "our"), a UK business.

You can contact us about anything in this policy at hello@koalaweb.io.

This policy applies to:

• anyone who visits koalaweb.io;
• anyone who uses our mockup tool to generate a preview of a website;
• anyone who leaves their email address to unlock or save a preview, or otherwise contacts us (a "warm lead");
• customers who buy our website build and hosting service; and
• people at UK businesses we contact directly to tell them about KoalaWeb, using publicly available business information (see section 6).

Using the mockup tool

When you paste a website address or business name into the mockup tool, we collect:

• the URL or business name you entered, and information we scrape from that public website (text, images, business details) to build the preview;
• your IP address, kept briefly to enforce fair-use rate limits and stop the tool being abused; and
• standard technical/log data generated by using a website (browser type, general device information, request timestamps), collected by our hosting provider.

Leaving your email (warm leads)

If you unlock or save a preview, or contact us directly, we collect your email address, the business name and URL you entered, and the date you did so.

Becoming a customer

If you buy the website build and hosting service, we additionally collect your name, contact details, billing information, and the content (text, photos, logos, hours, menu, etc.) you give us to build your site. Payments are handled by our payment provider — we don't store your full card details ourselves.

Business outreach

Separately, we identify UK businesses that might benefit from a better website and contact them by email. For this, we collect publicly available business information — business name, category, address, phone number, and a business contact email — sourced from public listings such as Google Maps/Google Business Profiles and business email-lookup tools, plus a note of how that business's existing website looked when we assessed it. See section 6 for more detail and how to opt out.

Under UK GDPR, we can only use personal data where we have a "lawful basis" to do so. Here's what we use each category for, and which basis applies:

• Generating and improving mockups — to show you a preview and keep the tool reliable and free of abuse. Lawful basis: our legitimate interest in operating the tool, and taking steps at your request before a contract (you asked us to generate the preview).
• Following up with warm leads — emailing you about the preview you built, answering questions, and inviting you to buy the service. Lawful basis: legitimate interests (following up on an enquiry you initiated) and, for any wider marketing, the "soft opt-in" under the Privacy and Electronic Communications Regulations (PECR) because you gave us your details in the context of a similar enquiry; you can opt out at any time (see section 11).
• Delivering the paid service — building, hosting and supporting your site, taking payment, and providing customer support. Lawful basis: performance of our contract with you, and legal obligation for things like tax records.
• Business outreach (cold email) — telling UK businesses about KoalaWeb. Lawful basis: legitimate interests in marketing our service to businesses, balanced against your right to object at any time — see section 6.
• Security and abuse prevention — rate-limiting, fraud prevention, and keeping the Site and tool available. Lawful basis: legitimate interests.

We keep this deliberately minimal. The Site does not currently use analytics, advertising, or tracking cookies. The mockup tool uses your browser's local storage (not a cookie) to remember, on your own device only, that you've already unlocked a preview for a given business, so we don't ask twice. This is strictly necessary for the tool to work and isn't used to track you across other sites.

Our hosting provider may set essential cookies or use equivalent technology needed to serve the Site securely and reliably. If we ever add analytics or advertising cookies in future, we'll update this policy and ask for your consent first, where the law requires it.

As well as this website, KoalaWeb runs a direct-outreach programme: we look for UK cafés, shops, takeaways and tradespeople whose website looks outdated or is missing, and email them to introduce our service. If that's how you found this page, here's what you should know:

• We source the business name, address, phone number and a business contact email from publicly available listings (such as Google Maps/Google Business Profiles) and business email-lookup tools — never from a private or purchased consumer list, and never by scraping personal social media profiles.
• We only assess how a business's public-facing website looks in order to decide whether to reach out; we don't use any personal data beyond what's needed for that assessment and to send the email.
• Emails are sent from dedicated sending addresses, always clearly identify KoalaWeb as the sender, and include a way to stop hearing from us.
• You can opt out at any time, with no need to give a reason, by replying "unsubscribe" to the email or emailing hello@koalaweb.io. We keep a suppression list so we don't re-contact you, and we stop promptly once you ask.
• Where you reply expressing interest, we keep the resulting conversation and any information you share with us for as long as reasonably needed to follow it up.

We don't sell personal data. We share it only with service providers who help us run KoalaWeb (our "processors"), under contracts that require them to protect it and use it only as we instruct, and with anyone else where we're required to by law. Current categories of processor include:

• Hosting and infrastructure — for running the Site and hosting customer sites.
• Database and storage — for storing leads, mockups and customer records.
• Outreach and email tooling — for finding public business listings, verifying business contact emails, and sending and tracking outreach and transactional email.
• AI providers — to help generate mockup content and assess how a website looks; we don't use these providers to make automated decisions about individuals (see section 12).
• Payment processing — to take payment for the build and hosting service.

If we ever sell or reorganise the business, personal data may be transferred to the new owner, who would continue to use it as set out in this policy.

Some of the service providers we use are based outside the UK, including in the United States. Where that's the case, we put appropriate safeguards in place before transferring personal data — such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or relying on a UK adequacy regulation — so your data stays protected to UK standards wherever it's processed.

• Mockup tool usage and rate-limit data — kept only briefly (hours to a few weeks), just long enough to cache results and enforce fair use.
• Warm leads (email + business details from unlocking a preview) — kept while we're actively following up, and deleted or anonymised if there's been no engagement for 24 months, or sooner on request.
• Customer and contract records — kept for as long as you're a customer, and for 6 years afterwards to meet our accounting and tax obligations under UK law.
• Business outreach data — kept only while the business remains a realistic prospect; deleted or suppressed immediately on opt-out, and otherwise reviewed and removed if there's no reply or engagement after a reasonable period.

We may keep data for longer where we're required to by law, or to establish, exercise or defend legal claims.

We use appropriate technical and organisational measures to protect personal data, including encryption of data in transit, access controls that limit who can see personal data to those who need it, and restricting database access to service-level credentials rather than exposing it publicly. No system is completely secure, but we work to keep these protections up to date, and we have a process for identifying and responding to any data breach, including notifying the ICO and affected individuals where the law requires it.

Under UK GDPR, you have the right to:

• be informed about how we use your data (this policy);
• access a copy of the personal data we hold about you;
• rectification of inaccurate or incomplete data;
• erasure of your data in certain circumstances ("the right to be forgotten");
• restrict or object to our processing of your data in certain circumstances;
• object to direct marketing at any time — this is an absolute right; tell us once and we'll stop;
• data portability — receive certain data in a portable format; and
• withdraw consent at any time, where we rely on consent.

To exercise any of these rights, email hello@koalaweb.io. We'll respond within one month, may need to verify your identity first, and won't normally charge a fee. If you're not satisfied with our response, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO) — see section 15.

The mockup tool uses automation and AI to draft a preview website and to assess how an existing website looks, but this doesn't make any legal or similarly significant decision about you or your business — no one is denied a service, charged a different price, or otherwise materially affected by an automated decision alone. A human reviews and approves any site before it's built and billed. If that ever changes, we'll update this policy and give you the additional rights UK GDPR requires for solely automated decision-making.

KoalaWeb is a business-to-business service aimed at business owners and isn't directed at children. We don't knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, please contact us and we'll delete it.

We may update this policy from time to time, for example as our service or the law changes. We'll post the updated policy here with a new "Last updated" date, and where a change is material, we'll take reasonable steps to let active customers and warm leads know, such as by email.

Questions, requests, or complaints about how we handle personal data can be sent to hello@koalaweb.io.

You also have the right to complain to the Information Commissioner's Office, the UK's independent regulator for data protection:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We'd appreciate the chance to address your concern first, but you're free to contact the ICO directly at any time.