Privacy policy
Last updated: October 2026
1. What this policy covers
This policy describes how Lily Site processes personal data when you use the service: creating an account, building websites with AI, managing domains and billing, and contacting support. Lily Site acts as the data controller for account and platform data, and as a processor for the content you create for your own customers where applicable.
2. Data we process
Account data: your name, email address and sign-in credentials. Content data: the business information you enter, the websites and app projects you create, and the files you upload. Usage data: AI requests (model, token counts, credit usage), project and deployment history, and support conversations. Billing data: subscription status, payment history and credit transactions — card details are handled by our payment provider and never stored by Lily Site.
3. Why we process it
We process account and content data to provide the service you signed up for (performance of a contract). We process usage data to operate, secure and improve the platform (legitimate interest). We process billing data to fulfil legal accounting obligations and to manage your subscription.
4. AI processing
When you use AI features, the text of your brief and your website files are sent to the AI provider configured for the platform (currently OpenAI) to generate the content you requested. AI providers process this data under their own data processing terms. We do not use your content to train our own models.
5. Subprocessors
Lily Site relies on infrastructure providers to operate: Supabase (database, authentication and file storage), OpenAI (AI generation), Stripe (payments), and — where enabled — hosting, domain and email providers. A current list of active subprocessors will be maintained here before the public launch.
6. Data retention
We keep your account and content data while your account is active. Support conversations and billing records are kept as long as required for support and legal accounting purposes. You can request deletion of your account and data at any time through support.
7. Your rights
Under the GDPR you have the right to access, correct, export and delete your personal data, to restrict or object to processing, and to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi). To exercise any of these rights, sign in and open a support ticket.
8. Security
Access to customer data is restricted by row-level security in the database, server-side permission checks and encrypted transport. Administrative actions are recorded in an append-only audit log.
9. Contact
For privacy questions and data requests, sign in and open a support ticket, or use the contact page. A direct privacy contact address will be published before the public launch.
See also our terms of service and cookie policy.