Privacy Policy
Effective from 2026-11-01. This Privacy Policy explains how MekoWeb collects, uses, and protects your personal data.
1. Data Controller & Operator
- Operator: MekoWeb Studio
- Registration / Tax status: Independent Operator
- Address: Mekong Region, Southeast Asia
- Email: hotro@mekoweb.com
2. Data We Collect
- From your Google account when you sign in: full name, email address, profile picture URL, and Google account identifier. We never receive or store your Google password.
- Website content you provide: business name, tagline, about text, services, phone number, email, address, logos, images, and custom domain. This information is published on your public website as intended by you.
- Transaction & account records: order codes, selected plans, credit balance, Pro expiration timestamp, and last sign-in timestamp. When you send a payment via PayPal, VietQR bank transfer, or MoMo, we review the transfer note, amount, and payer details provided by the payment channel to reconcile your order.
- Prompts submitted to AI features: the business name, industry brief, and instructions you enter when using AI copywriting or image generation are sent to the configured AI provider (Section 5) to generate content.
- Visitor data on your website: when visitors submit the contact form on your website, we store their name, phone number, and message so you can view them in your dashboard. You are the controller of those leads and must comply with applicable privacy laws when contacting them. Pageviews are aggregated by hostname without storing personal identities of visitors.
- Technical logs: session cookies, IP address, user-agent, and timestamps in system logs used for security, rate limiting, and abuse prevention.
3. How We Use Your Data
- Authenticate sign-ins and maintain your session;
- Render, cache, and serve your websites on the edge;
- Connect custom domains and provision SSL certificates;
- Verify orders, reconcile payments, and grant Pro plans and credits;
- Generate website copy and visuals when you invoke AI tools;
- Communicate with you regarding your account, service updates, or incidents;
- Detect and prevent fraud, spam, and violations of our Terms of Service.
We do not sell personal data and do not use your data for third-party advertising.
4. Legal Basis for Processing
We process your data based on your consent when signing in and creating websites, and as necessary to perform the Service you request. You may withdraw your consent at any time (Section 7), after which we will no longer be able to provide the Service to you.
5. Third-Party Subprocessors & Cross-Border Transfers
We rely on the following infrastructure and AI providers to operate the Service, whose servers may be located outside your country of residence:
- Cloudflare, Inc.: edge compute (Workers), database (D1), key-value cache (KV), object storage (R2), Analytics Engine, and SSL for SaaS custom hostnames;
- Google LLC: Google OAuth 2.0 sign-in authentication;
- PayPal, VietQR & MoMo: payment channels when you purchase Pro plans or credits, governed by each payment provider’s own privacy policy;
- AI Providers (only when you actively use AI generation features, depending on system configuration at the time of use): Anthropic, Google (Gemini), MiniMax, DeepSeek, or Microsoft (Azure OpenAI). Only the business name and brief you enter are transmitted—never your account email or visitor leads.
Except for the providers above, we only disclose data to competent public authorities when required by law.
6. Data Retention
- Sign-in sessions expire after 30 days and are purged automatically.
- Website content is stored until you delete the website. When deleted, content and media assets are removed from active storage; cached edge copies expire within minutes.
- Account records are kept until you request account deletion or the account is closed under Section 7 of the Terms of Service: accounts without an active Pro plan that do not sign in for 1 year (365 days) are closed along with all websites, visitor leads, and remaining credits.
- Websites using a Pro Template whose Pro plan has been expired for more than 1 year (365 days) without renewal are permanently deleted along with their content, images, and visitor leads.
- Order records are deleted when the associated account is deleted.
- Encrypted system database backups may retain deleted records for up to 6 months before automatic pruning; we do not use these backups for any other purpose.
7. Your Rights
You have the right to access, correct, export, or request deletion of your personal data, withdraw consent, or object to processing in accordance with applicable law. Most website content and media can be edited or deleted directly in the studio dashboard. For account-level requests, please email hotro@mekoweb.com.
8. Cookies
We only use strictly necessary cookies for authentication (sid for your active session, and oauth_state for CSRF protection during Google OAuth sign-in). We do not use advertising or cross-site tracking cookies.
9. Security
All connections are encrypted via HTTPS. Session tokens are stored only as cryptographic SHA-256 hashes. Access to production infrastructure is restricted to the Service operator.
10. Children
The Service is designed for businesses and adults, and is not directed at children under 16 years of age.
11. Changes to This Policy
When this Privacy Policy is updated, the effective date at the top of the page will be revised. Material changes will be notified via email or in the studio dashboard.