Privacy Policy
Effective date: 12 August 2026 · Last updated: 12 August 2026 · Version 1.0
Contents
1. Who we are
Vuyolusha Bhebhe, trading as Lintel — a sole trader based in London, United Kingdom — is the data controller for the personal data described here. Contact us at support@lintelapp.co.uk.
2. What we collect
| Category | Examples |
|---|---|
| Account | Name, email address, password (stored encrypted, never in readable form) |
| Billing | Subscription plan and status, billing history. Card details go directly to Stripe — we never see or store your full card number. |
| Content | The briefs you type, files you upload, and the websites generated for you |
| Usage | Number of builds, which features you use, timestamps |
| Technical | IP address, browser and device type, and basic log data |
| Support | Messages you send us, including conversations with Ray, our AI advisor |
3. How we use it
- To provide the service, generate your sites and host what you publish
- To manage your account, subscription and payments
- To enforce usage limits fairly
- To provide support and respond to you
- To keep Lintel secure, prevent abuse and investigate misuse
- To improve the service and understand how it is used
- To meet our legal obligations, including tax and accounting
- To send service messages (and, with your consent, occasional product updates)
We do not sell your personal data, and we do not use your content to train AI models.
4. Legal bases
- Contract — to provide the service you have signed up for
- Legal obligation — for tax, accounting and responding to lawful requests
- Legitimate interests — to secure the service, prevent abuse, and improve Lintel, balanced against your rights
- Consent — for any marketing email, which you can withdraw at any time
5. Who we share it with
We use a small number of carefully chosen processors:
| Provider | Purpose | Where |
|---|---|---|
| Supabase | Database, account logins and file storage | Ireland |
| Vercel | Hosting the platform and published sites | US / global edge |
| Stripe | Payments and subscriptions | US / EU |
| Anthropic | AI model that generates sites and powers Ray | US |
| OpenAI | Generates images for your sites when a site is first built | US |
| Resend | Sends our emails, such as password resets and form notifications | US |
| Google Fonts | Serves the typefaces on our pages; your browser requests them directly from Google, which receives your IP address | US |
| jsDelivr | Serves one open-source JavaScript library; operated by Volentio JSD Limited and delivered through third-party networks, so your IP address may be processed outside the UK | UK / global edge |
We may also share data where the law requires it, to protect our rights or someone's safety, or if the business is sold or reorganised (in which case we will tell you).
6. AI processing
When you ask Lintel to build or change a site, your brief and the current version of your site are sent to Anthropic's API so a model can generate the result. Please do not include personal data about other people, or confidential information, in your briefs.
Conversations with Ray, our AI advisor, are processed the same way to produce an answer. These providers process your prompts and site code to generate each result, and retain them only as long as needed to provide and secure their service. Their own policies set out the detail.
7. Enquiries sent through websites you build
If your site has a contact or enquiry form, we store what visitors submit so you can read it in your dashboard, and we email you a copy. We keep the form's fields, the time it was sent, the browser's user-agent string, and a one-way hash of the visitor's IP address, which we use to spot spam. We do not store the IP address itself.
For this data you are the controller and we are your processor: it is your visitors' information, held on your behalf. We use it only to deliver it to you, never for our own purposes and never for marketing.
We keep enquiries for 12 months, then delete them automatically. You can delete any individual enquiry from your dashboard sooner.
Because it is your data, it is your responsibility to tell your visitors what you collect and why, and to answer any requests they make about it.
We also count visits to your published site so you can see how it is doing. This is cookieless: nothing is stored on the visitor's device, and no cross-site or advertising profile is built. For each view we record the section they looked at, the host of the referring site, the country, and whether they were on a desktop, mobile or tablet — never the IP address, and never the full referring URL. To tell one visitor from another within a single day we store a one-way hash of their IP address, browser and the date; because the date is inside the hash, the same person is an unrelated value tomorrow. We honour Do Not Track and Global Privacy Control and record nothing at all when either is set. Raw view records are deleted after 90 days, leaving only daily totals.
8. Cookies
We use essential cookies and similar storage to keep you signed in and to run the service — these do not require consent. See our Cookie Policy for detail and how to change your choice.
9. How long we keep it
- Account and content — while your account is open, then deleted or anonymised within 30 days of closure
- Billing records — 6 years, as tax law requires
- Support messages — 2 years
- Security logs — 12 months
10. International transfers
Some of these providers, or the networks they rely on to deliver their service, are based outside the UK. Where personal data is transferred internationally, it is handled under the safeguards required by UK data protection law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
11. Security
We use appropriate technical and organisational measures, including encryption in transit, encrypted password storage, access controls, and database rules that stop one customer reading another's data. No system is perfectly secure, but we take this seriously and will tell you and the ICO about a qualifying breach within the required timescales.
12. Your rights
Under UK data protection law you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to how we use it; or provide it in a portable format. Where we rely on consent, you can withdraw it at any time.
Email support@lintelapp.co.uk and we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
13. Children
Lintel is not intended for under-18s and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.
14. Changes and contact
We may update this policy and will post the new version here with a revised date. For anything privacy-related, email support@lintelapp.co.uk.