Privacy Policy

GOOBLR is the data controller responsible for your personal data ("we", "our", or "us"). We respect your privacy and are committed to protecting it in accordance with UK data protection law (UK GDPR and the Data Protection Act 2018). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services. For details on the cookies we use, see our Cookie Policy.

• Account Data: When you register, we collect your name, email address, and authentication credentials (including OAuth IDs from Google, GitHub, or Discord).
• Contact Data: When you fill out our contact forms, we collect your name, email, phone number, company name, and the contents of your message.
• Project & Order Data: When you use our package builder or request a quote, we collect project briefs, reference URLs, budget information, and technical requirements.
• Technical Data: We automatically collect device and usage information such as IP address, browser characteristics, operating system, language preferences, and referring URLs. We also use cookies and similar technologies; see our Cookie Policy for full details.
• AI Design Data: When you use the AI Web Designer tool in your dashboard, we collect the natural language prompts you enter, the HTML layouts generated in response, and the multi-turn conversation history for that session. This data is stored to maintain context and to allow you to return to previous designs.
• Message Attachments: Files uploaded as attachments within project conversations are stored along with their filename, file type, size, and storage URL. These are collected solely to facilitate communication between you and the GOOBLR team on your project.
• Two-Factor Authentication (2FA) Data: If you enable two-factor authentication on your account, we store a cryptographic TOTP secret key and a set of one-time backup codes. These are stored solely for authentication verification and are not used for any other purpose.
• Marketing Preferences: Whether you have opted in to receive marketing emails, the date of your consent or withdrawal, and a unique unsubscribe token used to manage your preferences without logging in.

• To facilitate account creation and login.
• To provide, operate, and maintain our services.
• To process your transactions and send confirmations and invoices.
• To respond to your enquiries and provide support.
• To protect our services via fraud monitoring and bot prevention (Cloudflare Turnstile).
• To operate the AI Web Designer tool: your prompts and session history are transmitted to a third-party AI service provider to generate layout outputs and stored to maintain conversation context across sessions.
• To send you marketing communications including blog posts, guides, insights, and company news where you have given your explicit consent.

Where you have given your explicit consent, we may send you marketing emails to let you know about new blog posts, guides, insights, and company updates.

• Consent is opt-in only. You can subscribe at registration or at any time via your dashboard settings. We never pre-tick consent checkboxes.
• Every marketing email contains a one-click unsubscribe link. You do not need to log in to unsubscribe.
• You may withdraw consent at any time via the unsubscribe link in any email or through your account settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Transactional emails are not marketing. Invoices, order updates, payment confirmations, security alerts, and email verification messages are sent under contractual or legitimate interest grounds and are not affected by your marketing preference.
• Consent records (opt-in/opt-out status and timestamp) are retained for the duration of your account to demonstrate compliance with UK GDPR Article 7.

We only keep your personal data for as long as necessary for the purposes set out in this notice, unless a longer period is required by law.

We share data with third-party providers only where necessary to deliver our services.

Under UK GDPR you have the following rights in relation to your personal data. To exercise any of these rights, contact us at privacy@gooblr.com. We will respond within one calendar month.

• Access: Request a copy of the personal data we hold about you.
• Rectification: Ask us to correct inaccurate or incomplete data.
• Erasure ("Right to be Forgotten"): Request deletion of your data where there is no longer a legal basis to retain it.
• Restriction of Processing: Ask us to pause processing your data while a dispute is resolved.
• Data Portability: Where processing is based on consent or contract and carried out automatically, receive your data in a structured, machine-readable format.
• Objection: Object to processing based on legitimate interests, or to direct marketing at any time.
• Automated Decision-Making: Not be subject to decisions made solely by automated processing that produce significant legal or similarly significant effects on you.

We use administrative, technical, and physical security measures to help protect your personal data. While we have taken reasonable steps to secure the information you provide, no security measures are perfect or impenetrable.