Privacy Policy
Last updated: 9 October 2026
This policy explains what personal data Ectobuilder collects, why, who we share it with and what your rights are. We keep it short and specific. If something is unclear, write to hello@ectobuilder.com.
1. Who we are
Ectobuilder is operated by Michał Włosik EFC, ul. Północna 16/5, 54-105 Wrocław, Poland, NIP 8942747708 ("we", "us"). We are the data controller for the personal data described here.
This policy covers the website at www.ectobuilder.com, the editor at editor.ectobuilder.com and the Ectobuilder MCP connector (together, "the Service").
2. What data we collect
| Data | Why | When |
|---|---|---|
| Email address, name and profile picture (if you sign in with Google), hashed password (if you sign up with email) | To create and secure your account | When you sign up or sign in |
| Your themes: pages, sections, text, images, colours and settings | To store, edit, build and deploy your themes | When you use the editor or the MCP connector |
| Images you upload | To use them in your themes | When you upload an image |
| Ghost site URL and Admin API key | To deploy themes and manage posts and pages on your Ghost site at your request | When you connect a Ghost site |
| Prompts you send to AI features | To generate or edit sections and themes | When you use AI generation |
| Plan, subscription status, billing period and AI usage counts | To provide the plan you pay for and enforce limits | When you subscribe or use AI features |
| Usage and device data: pages visited, referrer, browser, approximate location from IP | To understand how the website is used and improve it | When you visit the website, if analytics cookies are allowed |
| Messages you send us | To answer you | When you contact us |
We do not collect payment card details: payments are handled by Polar (see below). We do not sell your data or use it for advertising.
3. Google sign-in
If you sign in with Google, we receive your name, email address and profile picture from Google. We use them only to create and identify your account. We do not access your Gmail, Drive, Calendar or any other Google data, and we do not share Google user data with anyone except the processors listed below that host our database. You can remove Ectobuilder's access at any time in your Google Account under Security → Third-party apps.
4. How we use your data
- To provide the Service: store your themes, build theme files, deploy them and manage content on your Ghost site when you ask.
- To run AI features you request.
- To take payments and manage subscriptions.
- To send service emails, such as sign-up confirmation, password reset and important changes to the Service or these terms.
- To keep the Service secure and prevent abuse.
- To improve the Service using aggregated usage statistics.
We do not use your themes, prompts or content to train AI models.
5. Service providers we use
| Provider | Purpose | Data |
|---|---|---|
| Supabase | Database, authentication and file storage | Account data, themes, uploaded images, connected site settings |
| Vercel | Hosting the editor and API | Request data such as IP address and logs |
| PikaPods (Ghost) | Hosting www.ectobuilder.com and its newsletter | Website visits, newsletter sign-ups |
| Polar | Payments, invoices and taxes (merchant of record) | Email, billing details, subscription status |
| Anthropic | AI generation (Claude models) | Prompts and theme content sent with them |
| Google (Gemini API) | AI generation | Prompts and theme content sent with them |
| Google (Sign-in) | Optional sign-in | Name, email, profile picture |
| Google Analytics | Website statistics | Usage and device data, cookie identifiers |
| Unsplash | Free stock photo search | Search terms you enter |
When you connect your own Ghost site, we send your theme and content to that site. That site is run by you or your host, under your own privacy policy.
Some providers are based in the United States. Transfers outside the European Economic Area rely on the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
6. Cookies
The editor uses essential cookies and local storage to keep you signed in and remember editor settings. They are needed for the Service to work.
The website uses Google Analytics cookies to count visits. Ghost may set cookies for newsletter members who sign in. You can block or delete cookies in your browser settings.
7. Storage and security
Data is stored with Supabase in the European Union. Connections are encrypted with HTTPS. Passwords are hashed and never stored in plain text. Ghost Admin API keys are stored server-side and are never shown to AI assistants connected through MCP. Access to production data is limited to the operator.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data;
- have your data deleted;
- restrict or object to processing;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent.
To use any of these rights, email hello@ectobuilder.com from the address on your account. We reply within 30 days. You can also complain to the Polish data protection authority, the President of the Personal Data Protection Office (UODO), uodo.gov.pl.
9. Legal basis
- Contract (Art. 6(1)(b) GDPR): your account, themes, deployments, AI features and subscription.
- Legal obligation (Art. 6(1)(c)): keeping billing and tax records.
- Legitimate interests (Art. 6(1)(f)): security, abuse prevention and improving the Service.
- Consent (Art. 6(1)(a)): analytics cookies and newsletter emails, where required.
10. How long we keep data
- Your account and themes are kept for as long as your account exists, whether or not you have a paid plan. If you cancel a subscription, your account moves to the Free plan and your themes stay saved.
- When you delete your account, or ask us to, we delete your account, themes, uploaded images and connected site settings within 30 days. Copies in backups are overwritten within a further 30 days.
- Inactive accounts on the Free plan with no sign-in for 24 months may be deleted. We email you at least 30 days before.
- Billing records are kept by us and Polar for as long as tax law requires, currently five years from the end of the year of the payment.
- Server logs are kept for up to 30 days.
11. Children
The Service is not intended for anyone under 16. If you believe a child has created an account, contact us and we will delete it.
12. Changes
We may update this policy. We'll change the date at the top, and for significant changes we'll tell account holders by email before they take effect.
13. Contact
Michał Włosik EFC
ul. Północna 16/5, 54-105 Wrocław, Poland
NIP 8942747708
hello@ectobuilder.com