Skip to main content

Privacy Policy

Last updated: August 2026 · Version: 2026-08-19

This policy explains how Facet Cloud collects, uses, and protects personal information. We are based in New Zealand and handle personal information in accordance with the New Zealand Privacy Act 2020. Where we serve people in other regions, we also honour the additional rights described below, including under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA/CPRA).

1. Who we are

"Facet Cloud" and "Facets.sh" are trading names, not separate legal entities. This service is operated by Jedidiah Esposito, a sole trader (New Zealand Business Number 9429053442918), registered address Suite 1336, Level 1, 6 Johnsonville Road, Johnsonville, Wellington 6037, New Zealand. Jedidiah Esposito, trading as Facet Cloud, is the data controller (or "business" under the CCPA/CPRA) responsible for the personal information processed through this service, and is the appointed Privacy Officer for Facet Cloud. As a sole trader there is no separate deputy privacy officer; the role inbox below is the alternate contact route. For any questions about this policy, or to exercise your rights, contact us at privacy@get-facet.com.

2. What Data We Collect

We collect the following information when you use Facet Cloud:

  • Account information: Email address, password (stored as a bcrypt hash)
  • Payment information: Billing details processed securely through Stripe. We do not store your credit card numbers.
  • Site content: The content you create and publish on your Facet site, including text, images, files, and any video you upload for hosting.
  • Usage analytics: Page views, referrer data, country-level location, and browser information for your analytics dashboard
  • Technical data: Server logs, IP addresses, and request data necessary for operating the Service

3. How We Use Your Data

We use the data we collect for the following purposes:

  • Service delivery: Provisioning, hosting, and maintaining your Facet site
  • Billing: Processing payments and managing your subscription
  • Abuse prevention: Detecting and preventing violations of our Terms of Service
  • Service improvement: Understanding usage patterns to improve Facet Cloud
  • Communication: Sending essential service notifications (account, billing, security)

4. Creators and their subscribers

Facet Cloud is a platform where creators ("customers") build their own branded sites, newsletters, courses, and paid memberships. When a creator's own audience, including their members, subscribers and customers, provides personal information to a creator's site:

  • The creator is the controller of that information and is responsible for their own privacy practices, lawful basis, and communications with their audience.
  • Facet Cloud acts as a processor, handling that information on the creator's behalf and only as needed to run the Service.

If you are a member or subscriber of a site hosted on Facet Cloud and have a privacy request, please contact that site's owner in the first instance. We will assist creators in responding to such requests.

5. Legal Basis for Processing

For individuals protected by the GDPR, we process personal data on the following legal bases:

  • Contract performance (Art. 6(1)(b)): Processing necessary to deliver the Service, including site hosting, account management, and billing.
  • Legitimate interests (Art. 6(1)(f)): Processing necessary for security, abuse prevention, and service improvement, where those interests are not overridden by your rights.
  • Consent (Art. 6(1)(a)): Where we rely on consent (e.g., optional marketing communications), you can withdraw it at any time by contacting us or using the unsubscribe link provided.

Under the New Zealand Privacy Act 2020, we collect and use personal information in line with the Information Privacy Principles: we collect only what we need for the purposes above, directly from you where practicable, and use and disclose it only for those purposes or as permitted by law.

6. Indirect Collection of Personal Information (IPP 3A)

Most of the personal information we collect comes directly from you. Where we collect personal information about a person from someone else instead (for example, a name mentioned in a support or abuse report, or usage data about a visitor to a creator's site that we process on the creator's behalf), the New Zealand Privacy Act 2020 (Information Privacy Principle 3A) requires us to take reasonable, practicable steps to make that person aware of the collection. We normally satisfy this through this policy itself; where the person is identifiable and reachable and it is practicable to do so (for example, as part of resolving a report that named them), we will also tell them directly what we hold and why. This does not apply where an exception in the Act applies (for example, where telling them would be likely to prejudice the purpose of the collection, such as an active abuse investigation).

7. Cookies

We use a small set of strictly necessary and preference cookies for signing in, processing payments, and remembering your language and currency. We do not use advertising cookies or cross-site tracking. For the full list and how to manage them, see our Cookie Policy.

8. Third Parties

We share data with the following third-party subprocessors, solely for the purpose of operating Facet Cloud:

  • Stripe: Payment processing. Stripe handles all credit card data under their own privacy policy.
  • Hetzner: Server hosting. Your site data is stored on Hetzner infrastructure in Helsinki, Finland (EU).
  • Amazon Web Services (SES): Transactional and newsletter email delivery.
  • Bunny.net (BunnyWay d.o.o.): Video hosting and streaming. Video you upload is stored and delivered through Bunny's CDN; viewer playback requests are processed to deliver the stream.
  • Cloudflare: DNS management, CDN, and R2 object storage for the images and files you upload to your site. Cloudflare processes request data for DNS resolution and performance.

All fonts are self-hosted. No third-party font loading services (such as Google Fonts) are used.

We do not sell, rent, or share your personal data with any other third parties for marketing or advertising purposes.

Each subprocessor above is engaged under terms that reflect the GDPR Article 28(3) processor obligations (documented instructions only, confidentiality, security, sub-processor flow-down, assistance with rights requests and breach obligations, and deletion/return of data at contract end). We will update this list, and the timing of any update, before or at the time a material subprocessor change takes effect.

9. International Data Transfers

Your site data is primarily stored and processed within the European Union. Where transfers to other countries occur, we ensure appropriate safeguards are in place:

  • Hetzner: Helsinki, Finland (EU).
  • Bunny.net: Slovenia (EU), with global CDN edge delivery.
  • Cloudflare: May process request data and store uploaded media (R2) in the US for CDN, DNS, and storage services. Covered by the EU-US Data Privacy Framework.
  • Stripe: Payment processing in the US. Covered by the EU-US Data Privacy Framework.
  • Amazon Web Services (SES): Email delivery in the US. Covered by standard contractual clauses (SCCs).

10. Data Retention

  • Active accounts: Your data is retained for as long as your account is active.
  • Deleted accounts: When you delete your account or your account is terminated, all associated data (site content, uploaded media, configuration, analytics) will be permanently purged within 30 days.
  • Billing records: Payment records may be retained as required by applicable tax and accounting laws.

11. Children's Privacy

Facet Cloud is a business tool intended for use by adults. It is not directed at children, and we do not knowingly collect personal information from anyone under the age of 16. If you believe a child has provided us with personal information, contact privacy@get-facet.com and we will delete it. Creators who collect information from minors through their own sites are responsible for obtaining any required parental consent.

12. Your Rights

Depending on where you live, you have some or all of the following rights over your personal information:

  • Access: Request a copy of the personal data we hold about you.
  • Correction / rectification: Request correction of inaccurate or incomplete personal data.
  • Erasure: Request deletion of your account and all associated data. You can trigger a full account-and-data deletion from within the app at any time.
  • Restrict processing: Request that we limit how we process your data in certain circumstances (e.g., while we verify its accuracy).
  • Data portability: Request your data in a structured, commonly used, machine-readable format. We store your data in PocketBase and can provide a full export on request.
  • Object: Object to processing based on legitimate interests. We will stop processing unless we demonstrate compelling legitimate grounds.
  • Opt out of "sale" or "sharing" (CCPA/CPRA): We do not sell or share your personal information as those terms are defined under California law, so there is nothing to opt out of. You retain the right to know, delete, and correct.
  • Non-discrimination: We will not deny you service or charge you a different price for exercising any of these rights.

To exercise any of these rights, contact us at privacy@get-facet.com, or use the in-app export/delete tools if you have an account: those act immediately since you're already signed in. For a request made by email, we will respond within 20 working days (New Zealand Privacy Act 2020) or one calendar month (EU/UK GDPR), whichever applies to you; either deadline may be extended for a complex request, with notice to you explaining why. To prevent someone else acting on your account, we verify the identity of anyone making a request by email before taking any action that changes or discloses account data.

13. Data Breach Notification

If a breach of security leads to unauthorized access, disclosure, alteration, or loss of your personal information and is likely to cause you serious harm, we will notify the New Zealand Office of the Privacy Commissioner and you as soon as practicable. Where the breach affects individuals in the EU/UK, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by the GDPR.

14. Complaints

If you are not satisfied with how we have handled your information, you can complain to the New Zealand Office of the Privacy Commissioner. If you are in the EU/EEA, you may also lodge a complaint with your local data protection authority; a list is available on the European Data Protection Board website.

15. Contact

For questions about this Privacy Policy, please contact us at privacy@get-facet.com. See also our Terms of Service and Cookie Policy.