Privacy Policy

1. Who we are

Book My Website is operated by Altic LLC, a Delaware limited liability company (United States). For anything in this policy, including requests to see or delete your data, the contact address is support@alticllc.com.

2. What we collect

We collect the following, and nothing else:

• Your Google account identifier, email address, display name and profile picture, received when you sign in with Google.
• The websites you build: page content, images you upload, template and style choices, and the settings you enter such as a site title, description or business address.
• If you connect your own Google account for publishing: the identifier of the Firebase project and Hosting site you select, the email address of the connected account, the permissions you granted, and an encrypted token that lets us publish on your behalf.
• Ordinary server logs generated when your browser requests a page, including IP address, timestamp and user agent. These are produced by our hosting provider and used to keep the service running and secure.

We do not collect payment details. We do not buy or sell personal data, and we do not use your content to train machine-learning models.

3. Google account permissions we request

Book My Website asks for the following Google permissions. Each one is listed exactly as Google names it, with what we do with it. You are asked to approve the publishing permissions separately, at the point you first publish — signing in does not grant them.

• openidIdentifies your account so we can sign you in and keep your projects separate from everyone else’s.
• emailShows which Google account you are signed in as, and lets us contact you about your account.
• profileDisplays your name and profile picture in the builder so you can tell which account you are using.
• https://www.googleapis.com/auth/cloud-platformCreates a Google Cloud project on your behalf when you do not already have one, and uploads your site to Firebase Hosting when you publish. This is a broad permission; we use it only for the project you select on the publish screen.
• https://www.googleapis.com/auth/firebaseLists your existing Firebase projects so you can choose where to publish, adds Firebase to a new project, and creates the Hosting site your website is served from.

We do not request access to Gmail, Drive, Calendar, Contacts, Photos or any other Google service. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can withdraw these permissions at any time from your Google account’s security settings, or by disconnecting the account in the builder. Publishing stops working until you reconnect; the sites you have already published are unaffected, because they live in your hosting account rather than ours.

4. How we store and protect it

• Your account and your projects are stored in Google Firestore. Access rules restrict every document to the account that owns it.
• The token that allows us to publish on your behalf is encrypted with AES-256-GCM before it is written down, and the encryption key is held only in our server environment, never in the database and never in your browser. A copy of the database on its own does not reveal it.
• Short-lived access tokens are never stored. They are requested when a publish begins and discarded when it finishes.
• If you use the builder without signing in, your projects stay in your own browser’s local storage and are never sent to us.

No service can promise perfect security, but we do not keep anything we do not need, and the one genuinely sensitive item we do keep is encrypted at rest.

5. Who else sees it

We share data only with the providers that run the service, and only so they can run it:

• Google (Firebase Authentication, Firestore and Firebase Hosting) — sign-in, storage of your account and projects, and publishing.
• Vercel — hosting of the builder application itself and its server logs.

We do not sell or rent personal data to anyone, and we do not share it for advertising. We will disclose data if the law requires it, and we will tell you when we are permitted to.

6. How long we keep it

We keep your account and your projects for as long as your account exists, because deleting them is the same thing as deleting your work. When you delete a project it is removed from our database. When you ask us to delete your account we remove the account record, its projects and the stored publishing token.

Websites you have already published stay online in your own hosting account after deletion, because they are under your control, not ours.

7. Your rights

Write to support@alticllc.com and you can ask us to:

• send you a copy of the data we hold about you
• correct anything that is wrong
• delete your account and its contents
• stop processing your data, where we have no overriding reason to continue

We answer within 30 days. You can also export any project from the builder yourself at any time, without asking us, and disconnect your Google account without deleting anything.

8. Cookies

We use cookies and browser storage only to keep you signed in and to remember which project you had open. There are no advertising or tracking cookies, and no third-party analytics on the builder.

9. Children

Book My Website is a tool for businesses and is not directed at children under 13. We do not knowingly collect their data; if we learn that we have, we delete it.

10. Changes to this policy

If we change how we handle your data we will update this page and change the date at the top. If the change is significant we will tell signed-in users by email rather than leaving it for you to notice.