Information
We process account email and authentication information, business and website content you submit, and subscription and billing status to provide and secure the service. Stripe processes payments; OnlyForTen does not store full card details. Vercel hosts the application and PostgreSQL stores application data. Session cookies are required for authentication, and service/security logs may be retained.
Operational and abuse-prevention data
To keep the service reliable and control abuse, OnlyForTen may record limited operational information such as website-generation counts, whether the OnlyForTen Smart Engine or an optional external model handled a request, execution timing, model token counts when available, rate-limit counters, and security events. Rate-limit identifiers are designed to be hashed rather than storing a raw IP address in the rate-limit table. Website-generation telemetry does not intentionally store the full customer prompt in the AI usage record.
Domain registration
If you claim an included custom domain, domain registries require contact information such as your name, email, phone number, and postal address. OnlyForTen transmits the registration details you provide to Vercel and its upstream registrar or registry providers as needed to register and manage the domain. OnlyForTen does not intentionally store those registration-form fields in your profile after the registration request, although service providers may retain them as required by registration rules or law.
Google sign-in
Google may provide your name, email address, profile image, and Google account identifier for authentication and account creation. OnlyForTen does not receive your Google password.
Use and sharing
Information is used to authenticate accounts, operate websites, provide hosting, manage billing, register domains, measure service usage, improve reliability, and protect the service. Necessary service providers may receive data for these purposes. We do not sell personal information.
Retention and requests
We retain information while an account, active service, security need, or legal obligation exists. When paid website publishing ends, site content may be retained privately for at least 30 days to support reactivation, after which it may be deleted under normal lifecycle practices. Registered-domain records may need to be retained longer because registrar, registry, accounting, dispute, or legal obligations can outlast the website subscription. Send reasonable access, correction, or deletion requests to [email protected].
Security, children, and changes
We use reasonable security measures, but no system is completely secure. The service is not intended for children under 13. We may update this policy as the service changes.