Your data, handled with care.

Comet is operated by Comet Website Builder Ltd, company number SC903672, registered at 39 Countesswells Crescent, Aberdeen, AB15 8LN.

For personal information that we collect for our own purposes, Comet Website Builder Ltd is the data controller.

Questions about privacy can be sent to [email protected].

1. Information we collect

Depending on how you use Comet, we may collect:

Account information. This may include:

• your name;
• email address;
• account details;
• login and authentication information;
• account preferences; and
• information about your subscription.

Billing information. Our payment provider processes payment details on our behalf. We may receive information such as:

• billing name and address;
• transaction identifiers;
• subscription status;
• payment status; and
• limited payment-method information.

We do not intend to store complete payment-card numbers ourselves.

Website and content information. When you build a website using Comet, we may process:

• text;
• images;
• videos;
• files;
• website settings;
• domain information; and
• other content you choose to upload.

Usage and technical information. We may collect information about how Comet is used, such as:

• IP address;
• browser and device information;
• pages and features used;
• timestamps;
• error and diagnostic information;
• security logs; and
• general usage information.

Communications. If you contact us, we may retain your message and related correspondence so that we can respond and provide support.

2. Why we use personal information

We use personal information where necessary to:

• create and manage Comet accounts;
• provide the website-building service;
• host and publish websites;
• process subscriptions and payments;
• authenticate users;
• provide customer support;
• send important service communications;
• prevent fraud, abuse and security incidents;
• maintain and improve Comet;
• understand how the service is used;
• comply with legal and accounting obligations; and
• send marketing communications where permitted.

Staff access to your websites. Comet staff may view your websites, including unpublished drafts, only where this is necessary to provide support you have asked for or to investigate suspected abuse, fraud or a breach of our policies. Each access is recorded together with its reason, and staff cannot change your content through it.

3. Our legal bases

Depending on the circumstances, we process personal information because:

• Contract — processing is necessary to provide the Comet service you have requested.
• Legitimate interests — processing is reasonably necessary to operate, secure, support and improve Comet, provided those interests are not overridden by your rights.
• Legal obligation — we need to retain or process certain information to comply with the law.
• Consent — where required, we will ask for your permission, for example for certain marketing communications or non-essential cookies.

You can withdraw consent where processing is based on consent.

4. Emails

We may send you service-related emails concerning matters such as:

• account verification;
• password resets;
• subscription status;
• payments;
• security;
• service changes; and
• important account information.

These are different from optional marketing communications. If you subscribe to marketing emails, you can unsubscribe using the link provided in those emails.

We currently use specialist email providers to help deliver communications.

5. Payments

Payments may be processed by Stripe or another payment provider identified during checkout. Payment providers process certain information under their own privacy terms and security arrangements.

6. Service providers

We use trusted service providers to operate Comet. These may include providers for:

• hosting and content delivery;
• cloud infrastructure and database storage;
• email delivery;
• payment processing;
• analytics;
• customer communications;
• security;
• print-on-demand or ecommerce integrations; and
• other infrastructure required to operate Comet.

Our providers may include services such as Cloudflare, Supabase, Stripe, Resend and Google Analytics, depending on the features being used. We only share information where reasonably necessary for the relevant service.

7. Websites created by Comet customers

Comet customers may create websites that collect personal information from their own visitors. In those circumstances, the owner of that website will generally decide why and how the visitor information is collected. The website owner may therefore be the data controller, while Comet may process certain information on their behalf. Website owners are responsible for providing appropriate privacy information to their own visitors and for complying with applicable privacy and data-protection requirements. Additional data-processing terms may apply where Comet acts as a processor.

When a shop uses Printful fulfilment, its checkout collects the buyer’s name, email and delivery address to calculate delivery and submit a paid order. Comet stores that delivery information in encrypted form while checkout and order processing are pending, and shares it with Printful to fulfil a paid order. It is removed from Comet’s quote storage after Printful accepts the order; abandoned quotes are removed after seven days.

Where a published website uses analytics, this works as follows. The website shows a short cookie banner asking visitors whether analytics can be used; nothing is measured until a visitor agrees, and if they decline, no analytics cookies are set and no visit data is sent anywhere. If a visitor agrees, Comet collects basic, non-identifying statistics about that visit — which pages were viewed, roughly where the visitor came from, and simple interactions such as button clicks — using Google Analytics, to help us and the website's owner understand how the website is being used. We do not send names, email addresses, phone numbers, or anything a visitor typed into a form, and advertising features are always switched off. A website owner can also connect their own, separate Google Analytics account to their site; when they do, that account receives the same kind of visit information under the owner's own control, and Comet does not read or store reports from a customer's own Google Analytics account.

8. International data transfers

Some of the service providers we use may process information outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, we will use an appropriate legal mechanism or work with providers that provide suitable safeguards.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the reason it was collected. Our intended retention periods include:

• Active account information — for as long as the account remains active;
• Deleted account data — generally deleted or anonymised within 30 days, except where retention is required;
• Financial and accounting records — retained for the period required by applicable tax and accounting law;
• Support correspondence — generally retained for [2 years] after the matter is resolved;
• Security and technical logs — generally retained for [12 months], unless longer retention is needed to investigate an incident;
• Marketing information — until you unsubscribe or we determine it is no longer appropriate to retain it.

Our database provider keeps daily backups of the service database for a short period before they are automatically overwritten. Uploaded files and published websites are not separately backed up, though our hosting providers may hold copies briefly in caches and logs. We periodically review these retention periods as Comet develops.

10. Security

We take reasonable technical and organisational measures designed to protect personal information. These measures may include:

• access controls;
• authentication;
• encryption where appropriate;
• restricted administrative access;
• logging and monitoring;
• secure cloud infrastructure; and
• limiting access to people and service providers who need it.

No online system can guarantee absolute security.

11. Cookies and analytics

Comet may use cookies or similar technologies to operate the service, remember settings, understand usage and improve performance. Strictly necessary technologies may be used where required to provide the service. Where consent is legally required for analytics, advertising or other non-essential technologies, we will request it before using them — see section 7 for how this works on websites published with Comet. See our Cookie Policy for more information.

12. Your rights

Depending on the law that applies to you, you may have rights relating to your personal information, including the right to:

• access information we hold about you;
• correct inaccurate information;
• request deletion;
• restrict certain processing;
• object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• complain to a data-protection authority.

In the UK, you can complain to the Information Commissioner's Office (ICO). You can exercise your rights by contacting [email protected]. We may need to verify your identity before completing certain requests.

13. Children's privacy

Comet is not intended to be purchased or operated by children. We do not knowingly seek to collect personal information from children for the purpose of creating paid Comet accounts.

14. Changes to this Privacy Policy

We may update this Privacy Policy as Comet develops, our providers change, or legal requirements change. Where a material change affects how we use personal information, we will take reasonable steps to bring it to users' attention.

15. Contact

Comet Website Builder Ltd
Registered office: 39 Countesswells Crescent, Aberdeen, AB15 8LN
Company number: SC903672
Email: [email protected]