Website
Privacy Factsheet — Hosting, Forms and Mailbox
WebsitePublisher.ai · legal entity: M25 · Version 2.3 · 4 November 2026
This factsheet describes how WebsitePublisher processes personal data when hosting websites, forms and mailboxes for its customers. It applies to every customer and complements the Data Processing Agreement.
Roles. The customer decides what its website, forms and mailboxes contain and is the controller. WebsitePublisher (M25) hosts them and is the processor. For its own customer accounts, billing and support, M25 is controller.
1. Supplier
| Processor | M25, trading as WebsitePublisher.ai |
| Address | Brandemaat 78, 7943 EX Meppel, Netherlands |
| Chamber of Commerce | 04072374 |
| VAT | NL001629875B23 |
| Privacy contact | privacy@websitepublisher.ai |
2. Where data is processed
| Component | Supplier | Location |
|---|---|---|
| Application servers, load balancer, databases, session store | DigitalOcean LLC | Amsterdam, Netherlands |
| File storage (images, CSS, JS) | DigitalOcean Spaces | Amsterdam, Netherlands |
| Database backups | DigitalOcean Spaces; Hetzner Online GmbH | Amsterdam, Netherlands; Falkenstein, Germany |
| Mail servers and mailbox storage | Hetzner Online GmbH | Falkenstein, Germany |
| Delivery of site files (CDN) | BunnyWay d.o.o. (Bunny.net) | Slovenia; worldwide edge network |
| Platform e-mail to account holders | Resend, Inc. | United States |
| AI assistant of our support team (only when the team looks into a project) | Anthropic, PBC | United States |
| Cloud AI models for AI build jobs (only when the customer runs one on a cloud model) | OpenRouter, Inc., with the provider of the selected model | United States |
| DNS | M25 | own nameservers |
| Domain registration (if registered through us) | Openprovider (Hosting Concepts B.V.) and the relevant registry | Netherlands; registry location |
Outside the EEA. Website and mailbox data are stored in the EEA. Four exceptions:
- Bunny.net: a visitor outside Europe gets site files from an edge location near that visitor, so the request is processed there. Cached files are site assets, kept at edges for up to one month.
- Resend: only platform e-mail to the account holder (login, billing). Resend is certified under the EU-U.S. Data Privacy Framework and its UK Extension.
- Anthropic: when our support team looks into a project, it works with an AI assistant (Claude, by Anthropic). What the team reads for that question is processed by Anthropic in the United States. The data processing terms and the transfer basis for Anthropic are being put in place.
- OpenRouter: when the customer runs an AI build job on a cloud model, the instruction and page content of that job are processed by OpenRouter and the provider of the selected model in the United States. The data processing terms and the transfer basis for OpenRouter are being put in place.
For UK customers: the EEA is recognised as adequate under UK data protection law.
Access. Only M25. M25 is a small organisation; the owner holds administrative access to all systems and separation of duties is not possible. Content is accessed only for fault investigation, security incidents or at the customer's request. Infrastructure suppliers have no functional access to content.
Support access. When you ask us for help, our support team can look into the project concerned for a limited time: one hour per request, renewed for a follow-up question.
- Masked by default. Personal data such as form submissions is masked. A single value is only revealed when your question needs it, and that is logged.
- Recorded. Every access is recorded and the record is kept for 13 months.
- Visible to you. Each time our team opens a project, it appears in the project's AI activity.
- Changes only after confirmation. We only change something after explicit confirmation; the change also appears in your AI activity and can be undone.
3. Websites
| Data | Retention |
|---|---|
| Pages, files and settings | Until the customer deletes them; deleted 30 days after termination |
| Deleted pages, fragments and public files | Kept in a private trash for 30 days, so the customer can restore them; then deleted for good, together with the version history of the page. Private files are deleted at once |
| Form submissions (only if the customer configures forms) | Until the customer deletes them; no automatic expiry; deleted 30 days after termination |
| Visitor statistics (server-side, see §5) | 90 days (see §7) |
What a website contains — its content, forms, the fields they collect, where notifications go, and any external fonts, scripts, embeds or tracking the customer adds — is determined by the customer. The customer can see and manage this in its dashboard.
4. Mailboxes
| Delivery | Mail is delivered to the customer's mailbox only. No forwarding, copy, journaling or capture rule exists on the platform |
| Spam filtering | Own systems; no external filtering party |
| Storage | Hetzner Object Storage, Falkenstein, Germany |
| Retention | As long as the customer keeps messages; no platform-imposed retention |
| Deletion | Immediate and final. Storage versioning is disabled and mailbox storage is not backed up, so a deleted message cannot be restored |
| Mail logs | Kept on the mail servers only, rotated by size, in practice a few days; not archived or shared |
| Termination | Mailbox and contents deleted 30 days after termination |
The WebsitePublisher e-mail archive is a separate, opt-in service with its own agreement and does not apply unless the customer has enabled it.
5. Logs, cookies and statistics
| Item | Content | Retention |
|---|---|---|
| Web server access logs | IP address, user agent, URL, time | About 10 days |
| Application logs | Errors and request context | About 7 days |
| Support access log | Which project our support team opened, when, for which request, and what was read or changed (not the data itself) | 13 months |
Cookie XSRF-TOKEN |
Protection against cross-site request forgery | 4 hours |
Cookie laravel_session |
Technical session identifier | Browser session |
| Visitor statistics | Page, referrer, device type, hashed session identifier, IP address hashed with the date (no raw IP stored) | 90 days (see §7) |
The platform sets no advertising or analytics cookies and adds no third-party tracking. Visitor statistics are collected on the server for the site owner's dashboard.
6. Backups
| Databases | Nightly. Kept 7 days on the application server and copied to object storage (Amsterdam and Falkenstein) |
| Mailboxes | Not backed up |
| Retention of backup copies | 90 days (see §7) |
7. Termination and deletion
| Data | Deleted |
|---|---|
| Website content, files, form submissions, mailboxes | 30 days after termination |
| Items in the trash of a deleted project | At the next daily clean-up |
| Logs | By rotation, within about 10 days |
| Database backup copies and visitor statistics | Within 90 days |
On request, M25 confirms deletion in writing.
The mechanism that enforces the 90-day expiry is being implemented. Until it is in place, backup copies and visitor statistics are not yet deleted automatically.
8. Security
- TLS for websites, mail protocols and storage connections
- Private network between application servers
- Rate limiting on public endpoints
- Access control per project on all APIs
- Integration credentials stored in a separate vault, never in site code
9. Further information and audits
The Data Processing Agreement, this factsheet and the sub-processor list are the documentation M25 provides to demonstrate compliance. They are published at websitepublisher.ai/legal. Requests beyond this documentation are handled as an audit under the Data Processing Agreement.