Privacy policy

Last updated: November 4, 2026

This policy explains what information Weblisy ("we", "us") collects when you visit weblisy.com or create an account, how we use it, and the choices you have. We decide how and why this information is processed, which makes us the controller under data protection laws such as the GDPR and Brazil’s LGPD.

Information we collect

  • Account information. Your email address and, if you sign up with a password, a salted hash of that password. We never store your password in plain text.
  • Google sign-in. If you choose “Continue with Google”, Google tells us your email address and a unique Google account identifier. We request no other Google data: not your name, photo, contacts or any other account content.
  • Sessions and security data. When you sign in we create a session, stored as a hash, that expires after 30 days. On a paid plan, up to 2 sessions (devices) can be active at once. To prevent abuse, we temporarily keep request counts linked to your IP address and email address.
  • Subscription and payment data. When you buy a plan, our payment provider, Dodo Payments, collects your payment details and billing information. We never see or store your card number. We receive and store your email, a customer and subscription identifier, the plan, its status and the end date of the current billing period, so we can give your account the right access.
  • MCP access. If you connect an AI tool to the MCP server, we store the name of the app, a hash of its access tokens, and when it was connected and last used. If you create an MCP key, we store only a hash of it, its name and its last four characters. We do not store the content of your requests.
  • Download history. We record which templates you download and when, to apply the download limits of your plan.
  • Emails. We send transactional emails only, such as account confirmation, password reset and sign-in notices. Payment receipts are sent by Dodo Payments. If you email us, we keep your message and our replies so we can help you.
  • Anonymous usage statistics. We use Cloudflare Web Analytics to understand how many people visit weblisy.com and which pages and campaign links bring them here. It records the page address (including campaign tags such as utm_source), the referring site, country, browser and device type and page speed. It is privacy-focused: it does not use cookies or local storage and does not track you across other sites.
  • Technical data. Our hosting provider processes standard request data (such as IP address and browser type) to deliver the site and keep it secure.

Cookies and local storage

We use only essential cookies: one to keep you signed in and a short-lived one used while you sign in with Google. We also store two true/false flags in your browser’s local storage, whether you are signed in and whether you have a paid plan, so the navigation and the component buttons can show the right state without delay. We do not use advertising cookies, and our analytics does not use cookies.

How we use your information

  • To create and secure your account and keep you signed in.
  • To manage your plan, give you the right access and apply download and device limits.
  • To send the emails described above.
  • To detect and prevent abuse, fraud and security incidents.
  • To understand how the site is used, in aggregate, and improve it.
  • To respond to your messages.

We do not sell your personal information and we do not use it for advertising.

Service providers

We rely on a few providers to run Weblisy, and they process data on our behalf:

  • Cloudflare for hosting, our database, file storage, DNS, email forwarding, anonymous analytics and security, including Turnstile, a bot check that may process your IP address and browser signals when you sign in or sign up.
  • Dodo Payments for payments, taxes, invoices and refunds, as Merchant of Record.
  • Resend to deliver emails.
  • Google if you choose to sign in with Google.

Dodo Payments handles your payment information under its own privacy policy. Your data may be processed in countries other than your own, including the United States, by these providers. Where the law requires it, we rely on safeguards such as the providers’ standard contractual clauses for those transfers.

Why we use your information

Depending on where you live, we rely on one or more of these legal bases:

  • to carry out the agreement with you, which means providing your account, plan and downloads;
  • our legitimate interest in keeping Weblisy secure, preventing abuse and understanding aggregate usage;
  • to meet legal obligations, such as accounting and tax rules;
  • your consent where we ask for it, for example when you choose to sign in with Google.

Google API Services

Weblisy’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google email address only to sign you in and to link your sign-in to your Weblisy account.

How long we keep information

We keep your account information until you ask us to delete your account, which also removes your sessions and download history. We may keep subscription and payment records for as long as the law requires for accounting and tax purposes. Messages you send us are kept for as long as needed to help you. Sessions expire after 30 days, confirmation and password reset links expire within hours, and abuse-prevention records are kept only for minutes to hours.

Your rights and choices

You can sign out at any time, which ends your session on that device. Depending on where you live, including under the GDPR and the Brazilian LGPD, you may have the right to:

  • confirm that we process your information and access it;
  • correct information that is wrong or out of date;
  • delete your information or ask us to stop using it, where the law allows;
  • receive a copy of your information in a portable format;
  • know which providers we share it with;
  • withdraw your consent, and object to processing based on our legitimate interest.

To exercise any of these rights, or to reach our data protection contact, email hello@weblisy.com from the address on your account. We may need to confirm who you are first, and we will reply within the time the law requires. If you are not satisfied with our answer, you can complain to your local data protection authority, which in Brazil is the ANPD.

Security

We protect your information with encryption in transit (HTTPS), password hashing, hashed session and verification tokens, and rate limiting. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a security incident affects your personal information, we will tell you and the authorities as the law requires.

Children

Weblisy is not directed to children under 16, and we do not knowingly collect their information.

Changes to this policy

We may update this policy from time to time. When we do, we will change the date at the top of this page, and for significant changes we will take additional steps to let you know.

Contact

Questions about this policy? Email us at hello@weblisy.com.