The Terms

Eligibility

The Services are offered to natural persons aged eighteen (18) or over, and to organisations that are either (a) registered in the United Kingdom or (b) lawfully entitled to engage in commerce within the United Kingdom. By creating an account, the Customer warrants that they meet these conditions and have the authority to bind the organisation, where relevant, to these articles.

The account

The Customer shall maintain one (1) account per business or person, with accurate and current contact details. The Customer is responsible for the security of their account credentials and for all activity carried out under their account. The Company will never ask the Customer for their password.

Subscription & billing

The Customer pays a one-off build fee and a recurring monthly hosting fee (the “Subscription”) for the Services, the Subscription billed monthly in advance, at the rates published on the pricing page. The Company may revise its rates with thirty (30) days' notice; existing Customers retain their original rate for the duration of any active Subscription.

The build fee is paid once, when the Customer starts, at the rates on the pricing page. The build fee is non-refundable once the build has started. The exceptions are these: where a domain bought through the Company cannot be registered, or where the Customer uses Stop and refund on a Site Rescue before the Company starts reading the site, the Company asks its payment provider to refund that payment. Occasionally such a payment is held for a check first, and the Company will tell the Customer. If a page the Customer added later cannot be built, a person on the Company's team either finishes it for the Customer or refunds it in full.

Cancellation

The Customer may cancel the Subscription at any time through the Customer's account settings, confirming the cancellation with the Company's payment provider. The Services continue until the end of the paid-for period; no partial-month refunds are offered, save where the Company is unable to deliver the Services for reasons within its reasonable control. Upon cancellation:

• (a) the Customer's site remains online until the end of the paid-for period and for thirty (30) days thereafter;
• (b) the Company will send the Customer one email at least seven (7) days before the site is taken offline;
• (c) taking the site offline deletes nothing: the Company retains every file of the site for twelve (12) months, during which the site remains offline;
• (d) if the Customer resubscribes within those twelve (12) months, the same published site is restored without being rebuilt;
• (e) the Company will send the Customer one email at least thirty (30) days before the site's files are deleted, and will not delete them sooner than twelve (12) months after the site was taken offline; thereafter the files are permanently deleted;
• (f) the Customer may download the whole site as a .zip file from the Customer's dashboard at any time, whether the site is online, within the thirty (30) day period, or archived. The download is available only to the Customer, signed in to the account, and is never sent as a link by email;
• (g) a domain bought or transferred through the Company continues to renew automatically each year, charged to the Customer's card, after the Subscription ends. For a domain bought through the Company, the Customer may turn auto-renewal off at any time, including after cancelling. For any domain registered through the Company, the Customer may obtain a transfer code and move the domain to another registrar, which ends its renewal by the Company.

Suspension

The Company reserves the right to suspend access to the Services in the event of (a) non-payment of fees fourteen (14) days past due, (b) breach of Article IV on acceptable use, or (c) suspected unauthorised account access. Suspension is communicated to the Customer at the time of action; the Customer is given a reasonable opportunity to remedy the cause before any further action is taken.

What we collect

In the course of providing the Services, the Company processes the following categories of personal data:

• Account data: name, email, business name, billing address.
• Payment data: handled by the Company's payment processor; the Company does not store card numbers.
• Site content: content the Customer chooses to publish on their site, including any personal data the Customer includes (testimonials, contact details, photographs).
• Search performance data: for each site the Company hosts, the searches it appeared in on Google, with impressions, clicks and average position, as described in § 2.07.
• Correspondence: emails, and their attachments, that the Customer or anyone else sends in reply to the Company's emails.
• Usage analytics: how our marketing pages and the studio are used. Marketing uses cookieless analytics (aggregate only, identifying no individual), Google Analytics and Microsoft Clarity, as described in § 3.02; within the studio we use product analytics linked to the account to improve the Services.
• How the Customer found us: the first page of our website or the studio that the Customer visited and when, and any referral or partner code and campaign tags in the link they followed, as described in § 3.02. This is saved with the Customer's account when it is created, or with their order if they pay first, and is added to their payment records at the Company's payment processor, Stripe.
• Research on public business websites: the public pages of UK business websites and what we observed on them, as described in § 2.10.
• Free website checks: the business name, town, website, email address and, if given, phone number and a description of the business, sent through our free website-check form, as described in § 2.11.

How we use it

Personal data is processed (a) to provide the Services contracted for; (b) to bill the Customer; (c) to provide support; (d) to improve the Services through usage and product analytics; and (e) to understand which pages, partners and campaigns bring the Company its customers, and to pay referral rewards and partner commissions (§ 2.09). The Company does not sell personal data to any third party. Google Analytics' advertising features are described in § 3.02.

Who we share with

The Company engages a small number of third-party processors (“Subprocessors”) to deliver the Services: primarily for hosting infrastructure, payment processing, transactional email, analytics, and the AI models that write and change the Customer's site. Content the Customer gives the Company, and the content of the Customer's site, is sent to these AI model providers to do that work: Amazon Web Services (Amazon Bedrock), Google Cloud (Vertex AI), OpenAI and xAI, and Anthropic, which the Company uses directly when Amazon Bedrock is unavailable. The Company also uses Vercel to host its website and the studio, Sentry to record errors in its software (an error report can include account details), and Meta to carry messages when the Customer contacts the Company on WhatsApp. Cloudflare checks that a request sent through our free website-check form comes from a person, not an automated program (Cloudflare Turnstile); to do so it processes the sender's IP address and browser details. Some of these providers process data in the United States (§ 2.06). The Company maintains a list of current Subprocessors on request and notifies active Customers of any addition or change to that list within thirty (30) days. All Subprocessors are bound by data-processing agreements consistent with these articles.

The Customer's rights

Under the UK General Data Protection Regulation, the Customer has the right to (a) access their personal data, (b) request its correction, (c) request its erasure, (d) request its export in a portable format, (e) object to certain processing, and (f) lodge a complaint with the Information Commissioner's Office. Requests under this section are handled within thirty (30) days at no charge; reach the Company at privacy@themesmith.ai.

Retention

The files of the Customer's site are retained while the Subscription is active and, after cancellation, as set out in § 1.04: for twelve (12) months after the site is taken offline, after which they are deleted permanently. Personal data linked to the Customer's account, including the Company's own records of the Customer's payments, is retained until the Customer deletes their account or asks the Company to erase it, and is deleted then; deleting the account also deletes the files of the Customer's sites at once, without waiting for the twelve (12) months. Enquiries submitted through the Customer's site forms are deleted one hundred and eighty (180) days after they are received. Emails sent in reply to the Company's emails, and their attachments, are kept for three (3) years after they are received, and then deleted. Search performance data for a site (§ 2.07) is deleted within one day of that site being deleted. The record of how a visitor found us (§ 3.02) is deleted from the Company's servers ninety (90) days after their first visit, or sooner if they turn analytics off (§ 3.04); once saved with an account, or with an order that becomes part of an account, it is kept while the account exists and deleted with it. Invoices and payment records held by the Company's payment processor, Stripe, remain with Stripe under its own retention obligations; this includes the record of how the Customer found us that was added to them (§ 2.01), which deleting the account does not remove from Stripe. Records of referrals, referral rewards and partner commissions (§ 2.09) are kept as financial records after an account is deleted, no longer linked to the account; they hold amounts, dates and the payment processor's references, not the Customer's name or email address. Free website-check requests, the check we send and any marketing consent given with them are deleted twelve (12) months after the request (§ 2.11). Aggregate, anonymised analytics may be retained indefinitely for the purpose of product improvement.

International transfers

The primary processing region for personal data is the United Kingdom. Where Subprocessors operate outside the UK, transfers are made under the UK International Data Transfer Agreement or under an applicable adequacy decision. The current list of regions for each Subprocessor is available on request.

Search engines

To help the Customer's site appear in search results, the Company verifies each site it hosts with Google Search Console using the Company's own Google account, submits the site's sitemap, and tells search engines that support IndexNow (such as Bing) when the Customer publishes changes. The Company stores the search performance data Google provides for the site (the searches it appeared in, impressions, clicks and average position) to show it to the Customer in the studio. If the Customer connects their own Google account, the Company adds the Customer as an owner of the site's Search Console property. When the site is deleted, the Company deletes this stored data within one day.

Business-to-business emails

We sometimes email limited companies and LLPs about our services, using a business email address the company publishes on its own website. We hold the company name, that address, the website address and what we observed on the site's public pages, and for a newly registered company, its name and date of incorporation from the public Companies House register, on the basis of our legitimate interest in offering a relevant service to businesses. We keep this for as long as the conversation is active and for no more than 12 months after it, except that if you ask us not to contact you, we keep the address on a suppression list so we never email it again. You can object at any time by replying “no”, by using the unsubscribe option if your email app shows one, or by writing to privacy@themesmith.ai.

Referrals and partners

A Customer may share a referral link. When someone creates an account through it, the Company records that they were referred and by whom. Through their account, the referrer can see, for each person who joined through their link, a masked form of that person's email address (its first two characters and its domain, such as ch***@example.com), the date they joined, and whether that person has yet earned the referrer a free month. A free month can be earned once the referred Customer's payment has cleared: the Company adds the value of one month of the referrer's plan as a credit on the referrer's account at Stripe, and that credit is taken off the referrer's next invoice.

The Company also works with partners who introduce clients through a partner link. For each partner the Company holds its name, a contact email address and the bank details for paying it; the bank details are stored encrypted and used only to pay the partner's commission. A partner's commission is calculated from its clients' payments, so the Company records, against that partner, the payments and any refunds of each client who joined through the partner's link. When a client claims a partner's offer, the Company keeps a one-way hash of the email address used to claim it, so that each address can claim an offer only once; the email address itself is held with the client's order like that of any other Customer (§ 2.01).

Research on public business websites

We read the public pages of UK business websites, from the Common Crawl archive and with our own crawler (ThemeSmithResearchBot), to publish research about small business websites and to improve our service. Where a website belongs to a sole trader or partnership, its business details are personal data. We hold the page text and what we observed on it (the business's trade, area, and facts such as whether prices are shown). We do this on the basis of our legitimate interest in market research. We never publish a business's name or details, never sell or share them, and never send marketing to a sole trader or partnership found this way. We keep page copies for up to 36 months. You can object at any time: write to privacy@themesmith.ai with your web address and we'll remove it and stop reading your site, or block ThemeSmithResearchBot in robots.txt.

Free website checks

When you ask us for a free website check, we collect your business name, town and website address, the email address you give for your report, and, if you choose to add them, a phone or WhatsApp number and a description of what you sell. We also record when you asked, your IP address and browser details, and the page you came from. We use these to check your website by hand, to send you the check, and to reply if you write to us about it, because you asked us to. We may use AI tools to help prepare your check; a person reviews every check before we send it. We use your IP address to limit how many checks can be requested, on the basis of our legitimate interest in keeping the check free of abuse. Before the form is sent, Cloudflare checks that the request comes from a person (§ 2.03). A request for a check is never added to our outreach lists and is never used to email you unasked.

We send you marketing only if you tick the box on the form: a re-check of your website after 30 days, at most one website tip a month, and one relevant ThemeSmith offer. We record your answer, the wording you agreed to and when you agreed. Every one of those emails tells you how to unsubscribe, and once you do we send no more; we keep your email address on a suppression list so we never email you again.

We keep your request, the check we send you and any marketing consent for twelve (12) months after you ask, and then delete them, unless you have since become a customer, in which case § 2.05 applies. You can ask us to delete them sooner, or use any of the rights set out in § 2.04, by writing to privacy@themesmith.ai.

Strictly necessary

The Company sets a small number of cookies that are strictly necessary for the Services to function: for authentication, session management, and shopping-basket persistence on commerce-enabled sites. A single further cookie remembers the visitor's analytics choice (§ 3.02) so they are not asked repeatedly; being a record of a consent decision, it too is essential and exempt from consent. These cookies cannot be refused without impairing the Services.

Analytics

To understand how its marketing pages are used and how visitors found them, the Company runs four kinds of analytics. None of the data is ever sold.

• Cookieless analytics that set no cookies and identify no individual. These run for every visitor.
• Google Analytics, which sets cookies. It is on by default for every visitor, with Google's advertising features (advertising storage, ad user data and ad personalisation) enabled through Google Consent Mode. A visitor can turn it off at any time (§ 3.04); it then stops setting cookies and stops using advertising features for that visitor.
• Microsoft Clarity, which records how visitors move through and use the marketing pages (clicks, scrolling and the page as displayed) so the Company can see where pages are confusing. It runs for every visitor to the marketing pages and may set its own cookies.
• First-visit cookies, set by the Company itself on themesmith.ai and its subdomains, including the studio. On a visitor's first page they record the time of that visit, the page the visitor landed on (its address only, never the rest of the link), any referral or partner code in the link, and any campaign tags in it (utm_source, utm_medium, utm_campaign, utm_content and utm_term). The record is kept in a cookie (ts_acquisition_landing) and sent to the Company's servers, which store it under a random identifier held in two further cookies (ts_acquisition_id and ts_acquisition). All three cookies last ninety (90) days from the first visit. The record does not include the visitor's IP address, the site that sent them, details of their browser or the rest of the link; the Company's servers use the IP address only to limit repeated requests and do not store it with the record. If the visitor creates an account or pays within those ninety (90) days, the record is saved with the account or order and added to their payment records at Stripe (§ 2.01). These cookies are on by default and are turned off by the same choice as Google Analytics (§ 3.04). Turning them off deletes them and the record held under them, but does not remove a record already saved with an account or order, or added to payment records at Stripe.

Within the studio, the Company uses product analytics linked to the Customer's account to learn which features help and where customers get stuck. This respects the same analytics choice.

Advertising and social trackers

Apart from the Google Analytics advertising features described in § 3.02, the Company embeds no advertising trackers, no social-media pixels and no other cross-site tracking on its marketing pages, and none on any Customer site by default. Where a Customer wishes to embed such trackers on their own site, that is the Customer's prerogative, and the Customer assumes responsibility for the consent flow under applicable law.

Choices

Visitors whose browser is set to a European time zone see an on-page notice describing the analytics above on their first visit. Analytics are on by default. One choice, labelled Turn off analytics in the notice, turns off Google Analytics and the first-visit cookies together (§ 3.02), and the studio's product analytics respect it too; the cookieless analytics and Microsoft Clarity are not affected. Every visitor can use the cookie preferences control in the footer of every page of the Company's website to make that choice, or to turn analytics back on, at any time, and the choice is remembered for twelve (12) months. Independently, every major browser allows cookies to be refused, deleted, or blocked; refusing strictly necessary cookies will impair the Services, while refusing analytics will not.

Permitted purposes

The Services are intended for the building, hosting, and tending of lawful business websites: promotional sites, commerce sites, journals, portfolio sites, booking-and-enquiry sites, and so on. The Customer may use the Services for any purpose consistent with applicable law and these articles.

Prohibited content

The Customer shall not use the Services to publish, transmit, or facilitate content that is:

• illegal under United Kingdom law, or under the laws of any jurisdiction the content is targeted at;
• infringing of any third party's intellectual property rights;
• defamatory, harassing, or threatening to any natural or legal person;
• deceptive or fraudulent in nature, including phishing, scam, or impostor sites;
• used to distribute malware, mine cryptocurrency without consent, or harm the systems of others.

Reporting abuse

Reports of abuse may be sent to abuse@themesmith.ai. The Company aims to acknowledge reports within one (1) working day and to action them within five (5) working days where the alleged content is confirmed to breach this Article.

Service availability

The Company endeavours to keep the Services available at all times outside scheduled maintenance windows, but does not guarantee uninterrupted availability.

Limitation

Save in respect of (a) death or personal injury caused by negligence, (b) fraud or fraudulent misrepresentation, or (c) any other liability that cannot be limited under applicable law, the Company's aggregate liability arising under or in connection with these articles shall not exceed the total fees paid by the Customer to the Company in the twelve (12) months preceding the event giving rise to the claim.

Indemnification

The Customer agrees to indemnify the Company against any third-party claim arising from the Customer's breach of these articles, including but not limited to claims arising from content the Customer publishes through the Services. The Company likewise indemnifies the Customer against third-party claims arising from the Company's gross negligence in the provision of the Services.

Governing law

These articles are governed by, and construed in accordance with, the laws of England and Wales.

Disputes

The parties shall first attempt to resolve any dispute arising under these articles by good-faith negotiation. Where negotiation fails to produce a resolution within thirty (30) days, the dispute shall be referred to the exclusive jurisdiction of the courts of England and Wales. Nothing in this section limits a party's right to seek injunctive relief in respect of urgent matters.