Privacy Policy

Effective date: 24 September 2026
Last updated: 24 September 2026

1. About this policy

Webmiqo is a platform for local businesses. You describe your business, we build a website you can edit through simple fields, and you publish it when it is ready. You can also keep your appointments and clients in the Webmiqo agenda.

This policy explains what personal data we handle, why we handle it, how long we keep it, and what you can ask us to do with it. It applies to webmiqo.com, to the Webmiqo application at app.webmiqo.com, and to the websites we host on your behalf.

We act in two distinct roles, and the difference matters:

• As a controller, for the personal data of the people who hold a Webmiqo account. We decide why and how that data is processed.
• As a processor, for the personal data you put into your own website and for the enquiries your visitors send you. You decide why and how that data is processed; we only act on your instructions. Section 5 covers this, and our Data Processing Agreement sets out the terms.

2. Who we are

Webmiqo

For any question about this policy or about your data, write to hello@webmiqo.com. We answer privacy requests from the same address.

3. What we collect as a controller

We do not store your card details. Payments run through Stripe, which receives them directly and acts as an independent controller for that data under its own terms.

We do not build advertising profiles, we do not track you across other websites, and we do not sell personal data.

What our product events are not

Product events carry fixed labels such as which step was reached and whether it succeeded, together with an identifier that lives only for the current browser session. They contain no business content, no customer names and no free text. We do not use session replay, heat maps or behavioural profiles.

4. Where the data lives

The Webmiqo application and the websites we publish run on infrastructure in the United Kingdom. Some of the providers we rely on process data elsewhere. Section 6 lists them, and section 7 explains the safeguards.

5. Personal data we handle on your behalf

When you use Webmiqo to run a website, some of the personal data flowing through it is not yours and not ours — it belongs to the people who visit your site. That includes:

• Enquiries from your contact form: the name, email address, phone number and message a visitor submits, together with a keyed fingerprint derived from their IP address that we use only to stop duplicate and automated submissions.
• People appearing in the media you upload, where your photographs show identifiable individuals.
• Personal data you choose to put into your website content, such as the names of your staff.
• Your agenda: the clients you record (a name, and optionally an email address, a phone number and notes), their appointments (date and time, service, status such as cancelled or no-show, and any notes), and a record of changes to each appointment (what changed, when, and by which account).

In your agenda you can correct a client's details at any time. Archiving a client hides them from your client list and keeps their appointments linked to them. Deleting a client removes them permanently: their name, contact details and notes are erased, and so are the notes on their appointments. The appointments stay in your agenda as times without a name. Do not record health information or other special category data in client or appointment notes.

• Appointment e-mails: if you switch them on, we send your clients e-mails about their appointments on your behalf — a confirmation, a change, a cancellation and a reminder 24 hours before. Each e-mail uses the client's name and e-mail address, the date, time and service of the appointment, your business name and the reply address you set; replies go to you, not to us. We keep a record of which message was due and whether it was sent, without its content and without the client's name or address.

For all of this you are the controller and we are your processor. We process it only to run the service for you. We do not use it for our own purposes, do not disclose it to anyone other than the sub-processors in section 6, and do not use it to train AI models.

You are responsible for telling your visitors how you handle their data and for having a lawful basis to do so. Our Data Processing Agreement forms part of your contract with us and sets out our obligations under Article 28 GDPR.

6. Sub-processors

We use a small number of providers to run the service. Each is bound by a written contract, may only act on our instructions, and is held to confidentiality and security obligations.

The categories are set out in full at Sub-processors, where you can also request the name and processing location of the provider in each one. We notify account holders before a new sub-processor starts handling customer data, so that you have the opportunity to object.

7. International transfers

Personal data may be transferred outside the country where you are established.

Transfers from the European Economic Area to the United Kingdom rely on the European Commission's adequacy decisions for the UK. Where a provider processes personal data outside the EEA and the UK without an adequacy decision, we rely on the European Commission's standard contractual clauses together with the additional measures required by the provider's contract. We are happy to describe the safeguards for any specific provider on request.

8. AI features

Paid plans include AI-assisted writing. When you use it:

• We send our AI provider only the business information needed to answer that specific request — for example your business name, what you do, and the section you are writing. We do not send enquiries from your contact form, your agenda or client records, your billing data or your account credentials; for the assistant, see below.
• Generated text is a draft. It can be wrong. You review, edit and approve everything before it appears on your website, and you remain responsible for the accuracy of what you publish. Our publication checks are designed to stop unverified claims from going live, but they are not a substitute for your own review.
• Text produced by our AI features is marked so that it can be recognised as machine-generated, in line with the transparency requirements of the EU AI Act.
• Where you interact with an AI assistant inside Webmiqo, we tell you so.
• The assistant. When you ask the assistant a question, we send only the question you typed and a calendar of dates to our AI provider, so that it can tell which of your own records to look up. The records themselves — your agenda, clients, enquiries, services and plan — are looked up by Webmiqo and are never sent to the AI provider, and the answer is built by Webmiqo from those records. If you type a client's name in your question, that name is part of what is sent. We keep a record of each question — which lookup it used, whether it worked and what it cost — for 30 days, without the question or the answer.
• Changes you confirm. You can also ask the assistant to move, cancel or book an appointment, or to block time. It shows you exactly what will change, and nothing changes until you press Confirm. The change is then made in your agenda by Webmiqo, with the same checks as when you change it yourself, and is recorded in the appointment's history as made by the assistant. If you have switched on appointment e-mails, your client receives the same e-mail as when you make the change yourself. The AI provider receives only your question, as described above.
• Messages you send. You can ask the assistant to send a message to one of your clients, or to someone who sent you an enquiry. Our AI provider receives only your request, to word the message; the greeting, any appointment details and your business name are added by Webmiqo from your own data. You see the whole message and can change it, and it is sent only when you press Send — from "<your business> via Webmiqo", with replies going to the reply address you set. Webmiqo does not keep a copy of the message, only the same 30-day record of what the assistant did.
• Speaking a question. If you use the microphone button instead of typing, your browser records only while the button is on, and stops after a short silence or 20 seconds. That recording is sent once to our AI provider to turn it into text; Webmiqo does not store it and does not use it to recognise who is speaking. The text appears in the question box for you to check, and nothing is asked until you press Ask. We keep the same 30-day record for each recording — whether it worked and what it cost — without the recording or the text.
• Paid plans include a monthly allowance of AI text tokens. We count the tokens actually used so that we can show you your usage and enforce the allowance.

We may change AI provider. When we do, we notify account holders first.

9. How long we keep things

We keep personal data for as long as we need it for the purpose it was collected for, and then delete it or make it irreversible.

• Account and website data: for as long as your workspace exists. If your subscription ends, your content is retained so that you can come back, while access to it is closed until the subscription is active again.
• On deletion: when you delete your account we remove your workspace, its websites, drafts and media. Some records must survive deletion, in particular invoices and payment records we are legally required to keep, and minimal records showing that the deletion happened.
• Enquiries from your contact form: retained under your instructions as controller, and deleted with your workspace.
• Your agenda: retained under your instructions as controller. A client you delete is erased straight away; an archived client is kept until you delete them. The whole agenda is deleted with your workspace.
• Records of appointment e-mails: kept for at most 90 days after the message was handled, then deleted. Our e-mail provider keeps its own sending records (recipient, subject and delivery status) under its own retention.
• Product events and security signals: kept only as long as they are useful for diagnosis and abuse prevention, then discarded.
• Backups: deleted data disappears from backups as those backups age out of their rotation.
• Financial records: kept for the period required by applicable tax and accounting law.

10. Your rights

Wherever the GDPR or the UK GDPR applies to you, you can ask us to:

• confirm what personal data we hold about you, and give you a copy;
• correct data that is wrong or incomplete;
• delete your data;
• restrict how we use it, or object to our use of it where we rely on legitimate interests;
• give you the data you provided in a portable form;
• withdraw consent, where we asked for it, without affecting what we did before you withdrew it.

Write to hello@webmiqo.com. We will respond within one month. If your request is complex we may extend that period and will tell you why. We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else.

If you think we have got something wrong, please tell us first — we would rather fix it. You also have the right to complain to your data protection supervisory authority.

If you are asking about data held inside a website we host for one of our customers, that customer is the controller. Contact them directly; we will pass your request on and support them in answering it.

11. Security

We protect data with access controls scoped per workspace, encryption in transit, encrypted handling of sensitive tokens, isolated storage for private media, and rate limiting on public endpoints. Access to production systems is restricted and audited.

No system is perfectly secure. If a breach affects your personal data and is likely to present a risk to you, we will notify the relevant supervisory authority and, where required, you.

12. Cookies and similar technologies

We use only what is necessary to make the service work, plus a limited measurement of product flow. The Cookie Policy lists exactly what is stored, where, and why.

13. Children

Webmiqo is a business tool. It is not directed at children and we do not knowingly collect their data.

14. Changes to this policy

We update this policy when the service changes. The effective date at the top always reflects the current version. If a change materially affects your rights, we will tell you before it takes effect.

15. Contact

hello@webmiqo.com
Webmiqo