Privacy Policy

1. Who we are

This service is operated by 3TS Group LLC, a California limited liability company, doing business as 99websites.co. For privacy questions we are the "business" and "controller" of the information described below, unless Section 2 says otherwise.

2. Two roles: our data and clients' data

This policy covers information we control: data about visitors to 99websites.co and about our clients.

Separately, when we build and host a website for a client, that site may have a contact form. Information that a member of the public submits through a client's form is collected on that client's behalf — the client is the controller of it, and we act as their service provider / processor. We pass those submissions to the client, keep a copy so the client can retrieve them, and do not use them for our own purposes. If you submitted a form on a small-business website we host and want your data handled, contact that business; we will support their instructions.

3. Information we collect

We do not intentionally collect sensitive categories of personal information (such as government IDs, health, precise geolocation, or biometric data) and ask that you not send them to us.

4. How we use information

• To design, build, deliver, host, support, and maintain your website;
• To take payment and manage your subscription, including sending renewal reminders and receipts;
• To communicate with you about your project and the service (transactional email — you can't opt out of these while you have an active project or subscription);
• To operate, secure, debug, and improve the service, including rate-limiting and fraud/abuse prevention;
• To respond to your requests, including privacy requests;
• To keep records and to meet tax, accounting, and legal obligations; and
• To display your finished site in our portfolio, unless you opt out (see Terms).

We use AI tools (Anthropic) to help produce your site. We send the business brief and materials you provide to that tool for that purpose. We do not send it your payment data.

We do not use your information for our own advertising, and we do not do behavioral or cross-context advertising at all.

5. Why we're allowed to use it

We process personal information to perform our contract with you, to pursue our legitimate interest in running and securing the service, to comply with law, and — where required — with your consent (for example, non-essential cookies).

6. Who we share it with

We share personal information only with service providers that help us run the business, each bound to process it on our instructions:

The current list is maintained at 99websites.co/subprocessors. We may also disclose information: to comply with law, a subpoena, or a lawful request; to enforce our terms; to protect the rights, safety, or property of anyone; or in connection with a merger, acquisition, or sale of assets (with notice to you).

7. We do not sell your data

We have not sold personal information, and we have not "shared" it for cross-context behavioral advertising, in the preceding 12 months, and we do not do so. We do not knowingly sell or share the personal information of anyone under 16.

8. Cookies & analytics

We use strictly necessary cookies and local-storage items at all times (session and portal tokens, rate-limiting, and your consent choice). We also use Google Analytics 4 and Microsoft Clarity for aggregate usage measurement and session-replay/heatmap analysis, and the Microsoft Advertising UET tag to measure the results of our own Microsoft ads. Analytics and Clarity run only after you accept via the cookie banner. UET runs in Consent Mode: it loads on every page (so Microsoft receives your IP address, page address and browser type) but sets no cookies and stores no identifiers unless you accept Marketing; "Reject optional" or a Global Privacy Control ("GPC") signal keeps cookies off. Google Analytics is configured with advertising features, Google Signals, and ad personalization disabled, and IP anonymization on; Microsoft Clarity masks text input by default. The UET tag is used only to attribute conversions to our own ads, not to sell or share your data with others. Our Cookie Policy lists every item and links to each provider's opt-out; change your choice any time from the "Cookie preferences" link in the footer.

9. How long we keep it

• Project and account records — for as long as your hosting subscription is active, then up to 24 months after it ends, then deleted or anonymized.
• Billing and tax records — up to 7 years, as required by law.
• Uploaded files — deleted within 60 days of a verified deletion request or of the subscription ending, whichever is first, except where we must keep a record.
• Backups — the automated database backup keeps daily copies for about 14 days and a monthly copy longer; deleted records age out of backups on that cycle.
• Security and rate-limit logs — typically 30–90 days.
• Privacy requests — kept as long as needed to show we handled the request, then deleted.

10. How we protect it

We use TLS/HTTPS everywhere, encryption at rest through our providers, access controls and least-privilege practices, rate-limiting and abuse prevention, signed webhooks, and routine backups. No method of transmission or storage is completely secure, so we can't guarantee absolute security. If a breach affects your personal information, we will notify you and any regulator as required by law.

11. Your choices & rights

Depending on where you live, you may have the right to: know what we hold and get a copy; correct it; delete it; and appeal a decision. To exercise any of these:

• Use the Data Request form, or
• Email privacy@99websites.co.

We will acknowledge your request within 10 business days and aim to complete verified requests within 45 days (we may extend once by another 45 days and will tell you why). We may need to verify your identity, and we won't charge a fee for a first request. We won't discriminate against you for exercising a right. An authorized agent may submit a request with proof of authorization.

12. U.S. state privacy rights

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with a consumer privacy law, you have additional rights and disclosures. Those are set out in our U.S. State Privacy Rights & CCPA Notice, including the categories of personal information we collect and disclose, our "we do not sell or share" statement, and how to appeal.

13. Children

The service is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact privacy@99websites.co and we will delete it.

14. Where data is processed

We and our providers are in the United States, and your information is processed there. The service is intended for U.S. clients and visitors and is not directed to the EU, the UK, or the EEA. If you contact us from outside the U.S., you consent to your information being processed in the U.S.

15. Changes

We may update this policy. We'll post the new version here with a new effective date and, for material changes, notify you by email or through your portal. Continued use after a change means you accept it.

16. Contact