The short version
- Outline Technologies LLC runs FreeTOS.org and decides how your data is used.
- We keep your email address, your website details and the pages we write for you in your account until you delete it.
- Your website details are sent to Google's Gemini API to write your pages. We never use them to train AI models.
- Payments go through Stripe. We never see your card number.
- We do not sell your personal information and we do not show ads.
- You can ask for a copy of your data, or for it to be deleted, at any time.
1. Who is responsible for your data
FreeTOS.org is run by Outline Technologies LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States (“we”, “us”). We are the controller of the personal data described in this policy. You can reach us about privacy at [email protected].
2. What we collect
Website details
Your business name, website address, country, the regions your customers are in, the activities you tick (for example payments, analytics or user accounts), the contact email you want printed on your pages and, if you give them, a refund window and a postal address. These describe your business, but they can include personal data, for example when a sole trader uses their own name.
Account details
Your email address, when your account was created, and the sign in sessions on your devices. We send a 6 digit code to sign in and store only a keyed hash of it, never the code itself.
The pages we write
The legal pages written for your website, any notes you add when you ask for a rewrite, and a private link for each page.
Payment details
When you subscribe to the Website Legal Package, Stripe sends us your email address, the amount, the currency, your country, a payment reference, and the status and renewal date of your plan. If you cancel, we keep the reason you choose, if you give one. Stripe handles your card details. We never see or store your full card number.
Messages
If you write to us through the contact form or by email, we keep your name, email address and message so we can reply.
Usage and device information
- Visit counts. We count page views without cookies. Each visit is counted with a salted hash of your IP address that changes every day and cannot be turned back into the address, plus the country your connection comes from.
- Security. Our servers use your IP address, briefly and in memory, to limit how many requests one address can make. Our web server keeps standard access logs (IP address, browser type, pages requested) for 14 days.
- Sign ups and purchases. When you sign up, start a checkout, buy the package or see a preview, we look up the approximate city, country and network provider of your IP address with IPinfo, and send a short notice to our team on Telegram with your email address if you have given it. We use this to spot fraud and to see where customers come from.
- Checkout. When you start a checkout we pass your email address, your approximate country, your IP address, your browser type and the page you arrived on to Stripe with the checkout.
- Analytics. We use Google Analytics to understand how people use the site. Where the law requires it, it only sets cookies after you accept them. See our Cookie Policy.
- Error reports. If a page fails to load properly, your browser may send us the error message and the page address so we can fix it.
3. How we use your data
- To write your legal pages, keep them in your account and let you download, share and rewrite them.
- To create your account, sign you in and keep your account secure.
- To take payments, issue refunds, handle disputes and keep tax and accounting records.
- To send the emails you need: sign in codes, receipts, notices that your pages are ready, and replies to your messages. We do not send marketing emails.
- To prevent fraud and abuse, enforce rate limits and keep FreeTOS running.
- To understand which pages help people and improve the service.
4. Legal bases (EEA, UK and Switzerland)
If the GDPR, the UK GDPR or the Swiss data protection law applies to you, we rely on these legal bases:
| Purpose | Legal basis |
|---|---|
| Writing, storing and delivering your pages, your account, payments and support | Performing our contract with you |
| Security, fraud prevention, rate limits, visit counts and internal notices about sign ups and sales | Our legitimate interests in running a safe and useful service |
| Google Analytics cookies where consent is required | Your consent, which you can withdraw at any time |
| Tax and accounting records | Legal obligation |
5. How AI is used
To write a page, we send the type of page and your website details to Google's Gemini API. Your account email address is not sent. Only the contact email you asked us to print on your pages is included. The text that comes back is cleaned and stored in your account.
We do not use your details or your pages to train AI models, and no decision with legal or similarly significant effects on you is made by automated means.
7. International transfers
We are based in the United States and the companies above work in the United States, the European Union and other countries. When data leaves the EEA, the UK or Switzerland, we rely on the safeguards those companies provide, such as the European Commission's Standard Contractual Clauses or the EU US Data Privacy Framework where a company takes part in it.
8. How long we keep it
| Data | How long |
|---|---|
| Your email address, website details and pages | Until you delete your account |
| Website details saved with a checkout that was not paid | 30 days |
| Sign in codes (stored as a keyed hash) | 2 days |
| Sign in sessions | 30 days, or until you sign out |
| Payment records | As long as tax and accounting law requires, usually up to 7 years |
| Messages you send us | 12 months |
| Visit counts, usage events and email delivery logs | 400 days |
| Error reports | 90 days |
| Web server access logs | 14 days |
| Documents made without an account before the Website Legal Package launched | 7 days after they were made |
9. Your rights
Everyone can ask us for a copy of their personal data, to correct it or to delete it, and can take a copy of their pages at any time from the dashboard.
In the EEA, the UK and Switzerland you also have the right to restrict or object to how we use your data, to data portability, to withdraw consent at any time, and to complain to your data protection authority.
In California and other US states with privacy laws you have the right to know what we collect and why, to delete it, to correct it, and to opt out of its sale or sharing. We do not sell or share personal information and we do not use sensitive personal information to infer anything about you. We will not treat you differently for using your rights, and you can use an authorized agent.
To use any of these rights, email [email protected] from the address on your account. We may ask you to confirm your identity. We reply within 30 days, or 45 days where a US state law allows it.
10. Children
FreeTOS is a tool for businesses and is not meant for children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
11. Security
All traffic uses encrypted connections. Sign in codes are stored only as keyed hashes, the database allows no public access and is used only by our servers, secrets are kept out of our code, and access to your data is limited to the people who run FreeTOS. No system is perfectly secure, so please tell us at [email protected] if you find a problem.
12. Changes to this policy
We may update this policy. The date at the top shows when it last changed. If a change affects how we use your data in a meaningful way, we will email account holders before it takes effect.
13. Contact
Outline Technologies LLC, 30 N Gould St, Ste R, Sheridan, WY 82801, United States. Email [email protected].
Email [email protected]. A person reads every message.
Outline Technologies LLC · 30 N Gould St, Ste R, Sheridan, WY 82801, United States