Privacy Policy

Last updated September 30, 2026

• Who we are

  Hanwell Studio ("we", "us", "our") operates the Hanwell platform at hanwell.studio. We are a Canadian company subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and your rights in relation to it. By using the Service you consent to the practices described here.

• What we collect

  Account information: when you create an account we collect your email address. You may optionally provide a display name. We do not collect postal addresses, phone numbers, or government identification. Site content: the content you create and publish through Hanwell Sites — including section configurations, website copy, images, and media uploads — is stored on our infrastructure to provide the Service. Content you publish is publicly accessible. Standard uploads: if you use Hanwell Standard we receive the image you submit for review. This image is processed to generate your analysis and is not retained beyond that purpose. Payment information: we do not collect or store payment card details. All billing is handled directly by Polar; we receive only a confirmation of your subscription status. Usage data: we may collect anonymised, aggregated data about how the Service is used to understand performance and improve it. This data cannot identify you individually.

• How we use your data

  We use your information to: create and maintain your account; deliver and improve the features of Sites, Standard, and Gallery; send transactional emails such as account confirmations and subscription receipts; send product updates and announcements if you have opted in to email notifications (you may opt out at any time in your account settings); and comply with our legal obligations. We do not sell your data. We do not share it with advertisers or use it for any third-party marketing purpose.

• Published sites and public content

  When you publish a website through Hanwell Sites, the content of that site becomes publicly accessible at your *.hanwell.site subdomain or custom domain. Published site content is intentionally public — it is accessible to anyone with the URL, may be indexed by search engines, and may be cached or archived by third parties. You control what you publish. The confidentiality protections in this policy do not apply to content you have chosen to make public. We do not actively promote or share your site URL on your behalf.

• Third-party service providers

  We work with the following sub-processors to deliver the Service: Supabase (database storage, user authentication, and file storage — data may be hosted on AWS infrastructure in the United States); Vercel (web hosting and global content delivery); Polar (subscription and payment management — processes your billing information under their own privacy policy); Umami Analytics (privacy-first, self-hosted, cookie-free analytics that collects only anonymised, aggregated traffic data); and Sentry (error monitoring — may receive anonymised technical error data). Each provider is bound by their own privacy policies and, where required, a data processing agreement with us.

• Anthropic and Claude

  Hanwell Standard uses Claude, an AI model developed by Anthropic, PBC. When you submit an image for a design review, it is transmitted to Anthropic's API alongside a structured prompt. No account information or personally identifying details are included in that transmission — only the image itself. Anthropic's use of data received through their API is governed by Anthropic's own privacy policy and usage policies, available at anthropic.com. We recommend reviewing those policies if you use Standard.

• Cookies and local storage

  We do not use advertising cookies, tracking pixels, or any form of third-party behavioural tracking. We use browser local storage to maintain your authentication session and to preserve in-progress work in the site builder. No personal information is transmitted to third parties through these mechanisms. Our analytics (Umami) are entirely cookie-free.

• Data storage and security

  Your personal data is stored on infrastructure operated by Supabase, which uses AWS servers that may be located in the United States. We implement row-level security policies so that your data is accessible only to you and to authorised service-role operations. Passwords are hashed using industry-standard algorithms and are never stored in plain text. All data in transit is encrypted via HTTPS/TLS. While we take reasonable and appropriate technical and organisational measures to protect your data, no transmission over the internet is unconditionally secure and we cannot guarantee absolute security.

• Your rights under PIPEDA

  As a Canadian company subject to PIPEDA we respect your right to: know what personal information we hold about you; access your personal information and receive a copy; request corrections to inaccurate or incomplete information; withdraw consent to our collection and use of your information (subject to legal or contractual restrictions); and request deletion of your personal information. To exercise any of these rights, contact us at hello@hanwell.studio. We will respond within 30 days. If you are located in a jurisdiction with additional privacy rights — including California (CCPA), the European Economic Area (GDPR), or the United Kingdom — you may have further rights under applicable law. Please contact us and we will respond in accordance with applicable requirements. Canadian residents who believe their privacy rights have been violated may also file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

• Data retention

  We retain your personal information for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law (for example, financial records for tax purposes) or for legitimate purposes such as fraud prevention. Published site content that has been indexed or cached by third-party search engines may remain accessible via those systems independently of our own. Anonymised, aggregated usage data may be retained indefinitely.

• Children

  The Service is not directed at children under the age of 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with personal information without appropriate parental consent, please contact us at hello@hanwell.studio and we will delete that information promptly.

• Changes to this policy

  We may update this Privacy Policy from time to time. When we do, we will revise the date at the top of this page. For material changes we will notify registered users by email before the change takes effect. Continued use of the Service after an update constitutes acceptance of the revised policy.

• Contact

  For any privacy-related questions, requests, or concerns, contact Hanwell Studio at hello@hanwell.studio.