Privacy Notice

1. Who controls your data

The data controller is WEBLOCK MEDIA LTD (registered office: 9a Wick Road Business Park, Wick Road, Burnham-On-Crouch, Essex, CM0 8FA, United Kingdom; company no. 12103785).

For anything about your data, write to hello@weblockai.com. We answer every request within one month.

2. What we hold, and why

We only ask for what the service genuinely needs. No profiling, and we never sell data to anyone.

Email address, name: To identify your account and to send you emails about the service. Lawful basis: performance of the contract.
Password: Stored only as a cryptographic hash — not even we can recover the original. Lawful basis: performance of the contract.
What you create in the service: Projects, text, prompts, reference images you upload. Without these the service couldn't work. We never analyse your images on our own — they only reach the AI if you ask for a description. Lawful basis: performance of the contract.
Sign-in time and IP address: To protect your account and prevent abuse. Lawful basis: legitimate interests.
Subscription details: Which plan you're on, when it renews, which currency you pay in. We do NOT store card details. Lawful basis: performance of the contract.
Language and notification settings: So we write to you in the right language, and so we respect it if you don't want reminders. Lawful basis: performance of the contract.

3. Who else sees it

A few tasks need outside providers. We have a data-processing agreement with each, and each only receives what its own job requires.

Stripe Payments Europe: Payments and invoicing. Receives your name, email address and billing details. Your card details are held only by them.
Anthropic: Produces the text for the AI steps. Receives only what you typed for that step. If you specifically ask for a description of an uploaded image, it receives that image too — we never send an image of yours on our own. Nothing is used to train the model.
Cloudflare: Serves and protects the site against attacks. Sees technical data: IP address, time of request.
Our hosting provider: The server where the database and files physically live.

We disclose data to authorities only where the law requires it.

4. Where we keep it, and for how long

Data sits on servers in the United Kingdom and the European Union. Processing by Anthropic may also take place in the United States — for that we rely on the contractual safeguards recognised in law.

We keep your account data for as long as the account exists.
After you delete your account we erase everything within 30 days — apart from what accounting rules require us to keep.
Billing records must be kept for 6 years by law.
Reference images you upload are deleted automatically after 30 days.

5. Your rights

You have the following rights over your data. Ask for any of them in an email — you don't have to give a reason.

Find out what we hold about you, and get a copy.
Have anything inaccurate corrected.
Have your account and its data erased.
Restrict what we do with your data.
Take your data with you in a machine-readable format.
Object to us processing it on the basis of legitimate interests.

If you think we're handling your data badly, you can complain to a supervisory authority. In the UK that's the Information Commissioner's Office (ico.org.uk); in the EU, the data protection authority where you live.

6. Cookies

We only use cookies the service needs: keeping you signed in, remembering your language and your currency. We have no tracking or advertising cookies.

We don't ask for separate consent for these, because without them the service wouldn't work — and they tell no third party anything about you.

7. Emails

We send two kinds of email. Reminders — such as when your trial ends — can be turned off any time: with a switch in your account, or one click at the bottom of the email.

Payment notices — successful charges, cancellations, failed payments — can't be turned off. They're part of the contract and the law requires us to send them.

We don't send a newsletter, and we don't plan to.