Privacy

Last updated: 2026-06-03. Effective on signup or first use of the StaticOwl service.

1. Who we are

StaticOwl is operated by Weber AI LLC (a Texas LLC). This policy describes how we handle personal data. By using StaticOwl, you agree to the practices described here.

2. What we collect

• Account info: name, email, organization, password hash (via AWS Cognito; we never see the plaintext)
• Billing info: Stripe customer reference + subscription state. We never see or store your card number — that data lives only at Stripe (a PCI DSS Level 1 service provider)
• Content you author: stored in the StaticOwl graph; encrypted at rest in S3
• Trial signup info: email + use-case description you provide on /signup-key; verification IP + user-agent for abuse prevention
• Build metadata: timestamps, file sizes, deploy events; used for billing and observability
• Diagnostic logs: request IDs, error messages, query latencies; retained 30 days, then deleted

3. What we don't collect

• No third-party analytics trackers on staticowl.com or the admin UI
• No selling of customer data, ever
• No reading of your content for ML training
• No card numbers — Stripe handles all payment data directly; we receive only a customer reference

4. How we use it

• To operate the service — render your site, serve your content, run your queries
• To bill you — Stripe processes payments; we attribute subscription state to your account
• To support you — diagnose and fix issues you report
• To comply with law — respond to lawful requests (subpoena, court order). We'll notify you unless legally prohibited

5. Your rights

• Export everything at any time — POST /api/access/me/export or the Export my data button in the admin Billing tab. JSON bundle of your sites + content + metadata.
• Delete everything at any time — Delete account button. We keep a 30-day soft-delete window for accidental deletes, then hard-delete from the graph + audit chain (a hashed tombstone is retained for tamper-evidence; it contains no recoverable content).
• Request a copy of any logs we hold about your account — email privacy@staticowl.com
• Correct, restrict, or object to processing — same email
• Self-host — Enterprise can run StaticOwl on their own infrastructure with no data leaving their environment

EU/UK residents: you can also lodge a complaint with your local Data Protection Authority. We will respond to verified data-subject requests within 30 days.

6. Subprocessors

We share data only with the following providers, all of which operate under data-processing agreements that bind them to our standards:

• AWS — primary hosting + database + storage (us-east-1)
• AWS Cognito — user authentication; receives email + password hash
• Stripe Payments — payment processing + Customer Portal; receives email + billing address + card data (we never see card data)
• Amazon SES — transactional email delivery
• Amazon CloudFront — CDN + DDoS protection
• Anthropic / OpenAI / Replicate / fal.ai — AI features; only when you explicitly opt in or BYO key. Per-call only; no persistent data

We don't transfer data outside the US except as needed to use AWS multi-region failover (currently us-east-1 only) and to deliver email/CDN content globally via the respective providers' edge networks.

7. Cookies

The admin UI uses one functional cookie/local-storage entry (gcms_token) to keep you signed in. The marketing site (staticowl.com) does not set any cookies. Stripe-hosted checkout pages set their own cookies governed by the Stripe Privacy Policy.

8. Data retention

• Active account data: retained as long as your account is active
• After account deletion: 30-day soft delete, then hard delete (hashed tombstone retained for audit chain)
• Diagnostic logs: 30 days from collection
• Trial signup records: 12 months for fraud-prevention (email + IP + UA only)
• Billing records: 7 years (US tax requirement)

9. Changes to this policy

Material changes notified by email to the account email on file at least 30 days before they take effect. Continued use after the effective date means you accept the updated policy.

10. Contact

Privacy questions: privacy@staticowl.com. Data-subject requests: same address. Legal notices: legal@staticowl.com.