Privacy Policy

1. Who we are

Web Copilot AI Studio (the “Service”) is operated by My Copilot AI LLC, 117 S Lexington St, Ste 100, Harrisonville, MO 64701-2444, USA. In this policy, “we” and “us” mean My Copilot AI LLC, and “you” means the person using the Service. We are the controller of the personal data described here.

You can reach us about anything in this policy at support@contact.copilotai.live.

2. What we collect

Account information. Your email address, an optional display name, and a hash of your password. We store a one-way hash, not the password itself. If you sign in with a third-party provider instead, we store the account identifier that provider gives us and, if it supplies them, your name and avatar URL.

Workspace and project data. The websites you build: project names, pages, sections, written content, theme settings, and the image URLs in your asset library.

Prompts and copilot conversations. What you type into the generator and the copilot, the assistant’s replies, and a record of which operations each reply performed. These are stored with the project so the conversation and its history survive a reload.

Revisions. A snapshot of a project’s content is written before each AI change, so a change can be rolled back.

Deployment records. When you publish, we store the deployment’s status, the resulting URL, its file count and size, and any error the host returned.

Hosting connection. If you connect a Vercel account, we store an encrypted access credential, the name of the account it belongs to, and the last four characters of the credential. See section 6.

Technical logs. Our hosting provider records ordinary server logs - IP address, request path, timestamp, user agent - and we log application errors so we can fix them. Error logs can incidentally contain identifiers such as a project id.

3. What we do not collect

• We do not use advertising or analytics trackers, and we do not embed third-party tracking scripts in the Service.
• We do not collect payment card details. The Service is free at the time of writing; if that changes, payments will be handled by a payment processor and this policy will be updated before it does.
• We do not buy personal data about you from data brokers, and we do not sell or rent your personal data to anyone.
• We do not ask for, and do not want, your passwords or API keys for other services beyond the hosting connection you choose to make.

4. Your website content

The websites you build are yours. We use their content to operate the Service - to store it, render it, let you edit it, and publish it where you tell us to. We do not publish it anywhere you have not asked us to, and we do not use it to advertise to you.

We do not use your content or your prompts to train our own models, and we ask our AI provider to do the same (see section 5).

Anything you publish becomes a public website at the address your host assigns. Do not put information in a generated site that you do not want the world to read.

5. AI processing

Generating and editing a site means sending text to a large language model. When you use the generator or the copilot we send our AI provider your prompt, the relevant part of your site’s content, and instructions describing the tools it may call. We do not send your email address, your account identifiers, or your hosting credential.

We reach models through CometAPI, a gateway that routes requests to underlying model providers such as Anthropic and OpenAI. The Service can also be configured to call Anthropic or OpenAI directly. Whichever route is in use, that provider processes the request on our behalf and is bound by its own terms and privacy commitments.

6. Your hosting connection

To publish a site into your own hosting account, we need a credential for that account. When you connect one:

• It is encrypted with AES-256-GCM before it is written to our database, under a key held in our server environment and not in the database.
• It is never returned to a browser and never displayed. The deploy dialog shows the account name and the last four characters only, so you can tell which credential is stored.
• It is used for one purpose: creating and reading the deployments you ask for, in the account or team you chose during the connection.
• Disconnecting deletes it. Sites you already published remain live, because they are in your account rather than ours.

We cannot read the credential back out on your behalf, so please do not send us one by email. If a connection stops working, disconnect and connect again.

7. Cookies

We set only cookies the Service needs to function:

• A session cookie that keeps you signed in. It is httpOnly, so page scripts cannot read it.
• Two short-lived cookies during a hosting connection, which carry the return address and a random value used to verify the response came from a request you started. Both are deleted as soon as the connection finishes, and expire on their own within ten minutes.

Your browser may also store small amounts of interface state - such as which editor panel you had open - on your own device. That never reaches us.

There are no advertising, profiling or cross-site tracking cookies, which is why the Service has no cookie consent banner to click through.

8. Who else processes data

We use a small number of service providers to run the Service. They process data on our instructions and for no other purpose:

We may also disclose information where the law requires it, to enforce our terms, or to protect the rights and safety of our users. If we are ever part of a merger or acquisition, your data may transfer with the business; we will say so before it does.

9. How long we keep it

• Account, project and conversation data: for as long as your account exists.
• Deleted projects: removed from our database when you delete them, together with their pages, sections, assets, revisions and conversation history.
• Deployment records: kept with the project, as its publishing history.
• Server and error logs: retained for a short period for debugging and security, then discarded.

When you close your account we delete your account record and the projects belonging to your workspace. We may retain a minimal record that an account existed where we need it to meet a legal obligation.

10. Your rights

Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to receive a copy in a portable form, to object to or restrict certain processing, and to withdraw consent where we relied on it.

To exercise any of these, email support@contact.copilotai.live from the address on your account. We will not charge you for a request or treat you differently for making one. If you are in the EU or UK and are unhappy with our response, you may complain to your data protection authority.

We do not sell personal information or share it for cross-context behavioural advertising, so there is nothing for a “do not sell” request to switch off.

11. Security

Passwords are stored as bcrypt hashes. Hosting credentials are encrypted with AES-256-GCM. Traffic to the Service and to every provider listed above is encrypted in transit. Access to a workspace’s data requires an authenticated session belonging to that workspace, checked on every request rather than in the interface alone.

Published websites are static HTML and CSS with no server code, which removes whole categories of risk from what you put online.

No service is immune. If we become aware of a breach affecting your personal data, we will notify you and any regulator we are required to notify, without undue delay.

12. Children

The Service is not directed to children under 13, and we do not knowingly collect their personal data. If you believe a child has given us information, write to us and we will delete it.

13. International transfers

We are based in the United States and our providers process data there. If you use the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection law may differ from your own.

14. Changes

We may update this policy as the Service changes. The effective date at the top always reflects the current version. If a change materially affects how we handle your data, we will tell account holders by email before it takes effect.

15. Contact

Questions, requests and complaints about privacy: