Privacy notice

1. Who we are

ReWynder operates this website (rewynder.com) and the ReWynder platform. Questions about this notice go to hello@rewynder.com.

2. This website

This website loads nothing from third parties by default — fonts and scripts are served from rewynder.com itself, and the only exception is described in “the free website checks” below. It stores your cookie choice in your browser (and your language, once you pick one from the globe menu) and, only if you switch the Analytics category on, uses Google Analytics 4 to see how the site is used; everything about that, including how to change your choice, is in the cookie statement. Our hosting provider (Google Cloud, in the EU) records standard access logs — IP address, requested page, browser — for security and operation; they are kept for a short period and not used for anything else.

We also record how you reached this site: the parameters we put on our own campaign links, the click reference an advertising network such as Google or Microsoft adds to its own, the address of the site that linked here, the page you arrived on and the language it was in. Where it lives depends on what you do with it. All of it is kept in your own browser, under rw-attr, and clearing your browser storage clears it. The campaign half of it — the link parameters and the click reference, never the address of the page you came from — travels with you when you press “ReWynd it”, and is stored with your entry if you join the waiting list (see below) or with your session if you start a rebuild on the platform. We use it only to see which of our own pages and campaigns bring people here. It carries no name, no address, no IP address and no browser fingerprint, and no identifier we make up to recognise you again; the advertising network’s click reference is the one identifier in it, a token standing for a single click on a single advertisement, which is what lets us match that click to the campaign that paid for it. We build no profile from it and it is shared with nobody. The cookie statement lists it as rw-attr and tells you how to clear it.

The free website checks. Three pages of this site — the website check, the accessibility check and what a site is built with — send the address you type to the ReWynder platform, from your browser, and show you what comes back. This website stores none of it: the address and the report live in the page you are looking at and are gone when you close it. The platform keeps the report for a day, so a second look at the same address costs no second page load, and counts requests per network address so one script cannot use them all. Pressing the button runs Google reCAPTCHA v3 first (section 3.1 describes what Google receives). If you declare that the website is yours — which is what unlocks the security part of the report — that declaration is recorded by the platform with the words you agreed to, the address you named, the moment, your IP address and your browser, as evidence of a claim you made; it is not used to recognise you again. Declaring nothing is the ordinary case and costs you three quarters of the report rather than all of it.

If you join the waiting list, we store your email address, the website you named, which version of the terms of use you accepted and when, the time of the entry, the IP address and browser it came from — as evidence of the request — and the campaign half of the attribution described above, so we know which page or campaign produced the sign-up. That entry, attribution included, lives in this website’s own database in the EU for as long as the entry does, and our staff can read it in the internal dashboard. We use it only to send one confirmation and, later, news about the opening of the service through our e-mail provider (Postmark, ActiveCampaign LLC — see section 6); every such message carries an unsubscribe link, and an unsubscribe is honoured immediately. We delete your entry on request, and the whole list when the service has opened and the list has served its purpose.

If you leave your email address in a form on this site (for example to talk about a business account), we store the address, the optional website you entered, the page it came from, the time, and your IP address and browser as evidence of the request. We use it only to reply, keep it until the conversation is over or you ask us to delete it, and never pass it on.

3. The platform

3.1 Anonymous use

When you paste a website address without an account, the platform creates an anonymous session identified by a random code stored in your browser. Your designs are kept under that session for 30 days. The declaration you make about your relationship to the website is recorded together with the time, your IP address and browser, because we rely on it.

Drawing those designs costs us real money, so before we start the platform asks Google reCAPTCHA v3 whether there is a person on the page. It runs on the screens of that first, account-free flow, and on rewynder.com only on the three free checks and only from the moment you press the button there. Google receives your IP address, your browser and how you interacted with the page, and returns a score; we see the score and nothing more. There is no puzzle to solve and no cookie of ours involved. Google’s use of that data is described in its privacy policy and terms of service. Once you have an account the check is not used at all.

3.2 Your account

An account holds your email address and a password (stored by Google Cloud Identity Platform, never by us in readable form), optional two-factor settings, your projects and their history, your declarations and consents, and the payment references needed to charge maintenance. Card details are handled by Adyen; we never see or store a card number.

3.3 Your website and its content

To rebuild a website we read its pages, texts, images and structure, and — with your consent at that step — content-management data you connect, upload or export. A database can contain personal data of your customers or members; before any database is copied you choose whether such data is left out (the default), pseudonymised or included, and you accept data-processing terms. Raw captures are deleted at the latest seven days after the site model has been produced. Credentials you grant are revoked or destroyed immediately after use.

3.4 AI processing

Reading, designing and building use AI models from established providers, accessed directly through their business interfaces under our own agreements. We send them the content needed for the task and record which model and prompt version produced each result. We do not sell your data and we do not train models on it.

3.5 Your rebuilt site

A published site runs in a Google Cloud project of its own, with its own database. Its form submissions are relayed to your inbox and stored in the site’s admin. It reports its health to the platform every 30 minutes; we keep one report a day for 365 days. At handover — a PRO request, after a fully paid contract year — the project becomes yours and the platform removes itself.

4. Where data lives

The platform runs on Google Cloud in region europe-west4 (Netherlands, within the European Economic Area), with customer-managed encryption keys on storage and databases, and the platform transfers no data outside the EEA. Rebuilt sites are hosted in the region and on the provider you choose — anywhere in the world; the default is the same Dutch region. If you choose a region outside the EEA, your site and its content run there on your instruction.

5. Retention

• Anonymous designs: 30 days. Designs of a signed-in project: 90 days, for good once the project is paid.
• What we read from a website: 30 days, then deleted.
• With a project, two exceptions to that: one picture of the old home page and the result of its free check, kept as long as the project exists so the before-and-after picture and the rebuild report still work. Never a picture of a website whose rights were not declared.
• Raw connector captures and uploads: at most 7 days.
• Health reports of live sites: 365 days.
• Platform logs: 30 days. Audit logs of the cloud platform: one year.
• Your account, projects, declarations and invoices: as long as your account exists, and afterwards as long as the law requires.

6. Who else sees data

Google Cloud (hosting, identity, storage), Google reCAPTCHA (the human check described in section 3.1), Adyen (payments), Postmark (transactional email and the waiting-list messages) and the AI providers named above process data on our behalf under their respective agreements. We do not share your data with anyone else unless the law requires it.

7. Your rights

You can access, correct, export and delete the personal data we hold about you. Deleting your account deletes your projects; paid results you have taken over remain yours. Write to hello@rewynder.com; we confirm deletions promptly. You may also lodge a complaint with your data-protection authority.

8. Changes

We update this notice when the platform changes. The date at the top tells you which version you are reading. See also the terms of use and the trust page.