Privacy Policy

Covebuilder is operated by SRH Pte Ltd, a company registered in Singapore (UEN 201201879K) (“we”, “us”). This policy explains how we handle personal data under Singapore's Personal Data Protection Act 2012 (“PDPA”), and we apply the same practices to customers everywhere.

It covers the personal data of people who use Covebuilder (“owners”) and people who visit covebuilder.com. Websites built with Covebuilder belong to their owners. When a visitor sends an enquiry, booking, order or message through an owner's website, the owner decides what is done with it and we process it only on the owner's behalf (as a data intermediary). Please read that owner's own privacy notice, and ask the owner for access to or correction of that data.

Our data protection contact is hello@covebuilder.com. It is only for requests about your personal data (access, correction, deletion, withdrawing consent) and privacy complaints. We do not answer other messages there: please use the FAQ or ask Cove in your dashboard.

• Account data: your email address and name, sign-in details from Google if you sign in with Google, your country and time zone, and your chosen business name and description.
• Business content: what you create or upload, such as website text, pictures, logos, posts, products, prices, opening hours, quotes, invoices and customer records.
• Conversations with Cove, our AI assistant, and the plans and tasks you approve.
• Messages sent to your business email address, which we receive, show in your dashboard and forward to the addresses you choose.
• Billing data: your subscription status, payments, credit usage and purchase history. Your card details are handled by our payment provider and are not stored by us.
• Keys and tokens you give us to connect your own payment provider (such as Airwallex, Stripe or HitPay). These are stored encrypted and used only to create payment links and receive payment confirmations for you.
• Information visitors give your website (names, contact details, messages, bookings, orders), which we hold for you.
• Technical data: IP address, browser and device type, approximate location (country) and logs of what the Service did, used for security and to fix problems.
• A short, masked note of features you asked Cove for that we do not offer yet, used only to decide what to build.
• A free-allowance record: to stop free allowances (such as the number of free starter sites) being handed out again after an account is deleted, we keep a one-way scrambled code of your email address together with counters of the free allowances used. The code cannot be turned back into your email address and is used only for this purpose.

• To provide the Service: build and host your website, run your business email, make what you ask for, take payment for your plan, and give you support.
• To keep the Service safe: prevent abuse and fraud, secure accounts, fix faults, and meet our legal duties, including keeping accounting records.
• To contact you about your account: sign-in and billing messages, security notices and changes to the Service or these policies.
• To tell you about new features, if you agreed. You can stop these emails at any time with the unsubscribe link.
• To improve Covebuilder, using usage information and the masked feature-request notes above.

We collect, use and disclose personal data with your consent, including consent that is deemed because you gave us the data to do something you asked for, or where it is needed to carry out our contract with you, or where the PDPA otherwise allows it (for example to protect against fraud or to meet a legal requirement). You can withdraw your consent at any time (see section 8), but some features cannot work without the data they need.

We do not sell your personal data and we do not use it to show advertising.

Cove and the creative tools use AI model providers. When you ask for something, we send the provider only what is needed to do it, such as your business description, your instructions and, for pictures and videos, your description of what you want. We do not send your payment keys or card details. AI output can be inaccurate, so please check it before you use it.

My materials: photos, clips, voice recordings and face photos you add are kept in a private store that only your account can open, shown to you through short-lived links. Face photos and voice recordings are added only after you confirm they are yours or you have the person's written permission, and we record that confirmation. When you ask Cove to make something from them, the file or a short clip of it is sent to our picture and video suppliers for that job only. You can delete any item, or a whole person, at any time and the files are deleted. We do not use them for other customers.

We use suppliers who process data for us, only for the purpose of providing the Service:

• Supabase: database and sign-in.
• Vercel: hosting and serverless functions.
• Cloudflare: DNS, content delivery and email routing.
• Resend: sending emails from the Service.
• Our payment providers: payments for your plan, top-ups and domains.
• AI and image providers (currently including DeepSeek and Recraft): the AI features described above.
• Our domain registrar partner: when you buy or connect a domain.
• Google: if you choose to sign in with Google.

If you link your own Airwallex, Stripe or HitPay account, your customers' payments go through that provider under its own terms and privacy policy.

We may also disclose data where the law requires it, to a court or authority, to enforce our terms, or to protect people or our systems. If our business is sold or reorganised, personal data may transfer to the new owner under the same protections.

Some of our suppliers store or process data outside Singapore, including in the United States and other countries. Before we transfer personal data abroad we take steps to make sure it receives a standard of protection comparable to the PDPA, for example through the supplier's contractual commitments and security controls.

• Your account, website and business content: while your account is active. A paused website is kept for 60 days, after which we may delete it. You can ask us to delete it earlier.
• Tools made for your customers and the data they collect (for example stamp card sign-ups): while your plan is active. If the plan ends the tool is paused after a warning, kept for 60 days after the pause, and then may be deleted together with its data; we email you before that. You can download your tool's files and data at any time, and deleting your account deletes them too.
• Messages in your business inbox: kept while your account is active so you can look back, and deleted with your account. You can ask us to delete them sooner.
• Your business email address after a subscription ends: kept working for 30 days, then released.
• Conversations with Cove, credit-usage records and the masked feature-request notes: normally up to 180 days, then deleted.
• The free-allowance record (a one-way scrambled code of your email address and counters): kept for 12 months after you delete your account, then deleted.
• Billing and accounting records: at least 5 years, because the law requires us to keep them. We show you 12 months of billing history in your account.
• Records under a legal hold: kept for longer when we reasonably believe it is necessary because of an actual or possible legal claim, dispute or investigation, a legal or regulatory requirement, or to protect our rights and systems, and a deletion request may be declined or delayed for those records while that applies.

When we no longer need personal data for a legal or business purpose, we delete it or remove anything that identifies you.

You can ask us for a copy of the personal data we hold about you and how it has been used or disclosed in the past year, ask us to correct it, ask us to delete it, or withdraw your consent to our collecting, using or disclosing it. Email hello@covebuilder.com from the address on your account, saying clearly that it is a data request. We may need to confirm who you are first. We aim to reply within 30 days, and we will tell you if we need longer or cannot do what you ask and why. We may charge a reasonable fee for an access request, and we will tell you the amount first.

You can also change your email address and country in your dashboard Settings. If you are unhappy with how we handle your data, you may complain to the Personal Data Protection Commission (PDPC) in Singapore, or to the data protection authority in your own country.

We protect personal data with encrypted connections (HTTPS), encrypted storage for sensitive keys and tokens, access controls on our database, separation between customers' data, and logs of important actions. No system is completely secure.

If a data breach is likely to cause you significant harm or is of a significant scale, we will notify the PDPC and the people affected as the PDPA requires, including within 3 calendar days of assessing that the breach is notifiable.

We use cookies and similar storage that are needed to keep you signed in and to remember your dashboard settings. We do not use advertising or third-party tracking cookies.

Covebuilder is for people aged 18 and over, and we do not knowingly collect data from children. If you think a child has given us data, email us and we will delete it.

We may update this policy. We will tell you about material changes by email or in the dashboard before they take effect, and the date at the top will change.

For people in the EU, the UK and Switzerland, we process personal data on these legal bases: to provide the Service you asked for (contract), to keep it secure, prevent abuse and keep accounting records (our legitimate interests and legal obligations), and your consent where we ask for it (for example for marketing emails), which you can withdraw at any time.

You have the right to access, correct, delete, restrict or object to our use of your personal data and to receive a copy you can move elsewhere. Email hello@covebuilder.com from the address on your account. You may also complain to your data protection authority.

We are based in Singapore. Data is processed in Singapore and by suppliers in other countries, including the United States. Where the law requires safeguards for transfers out of your region, we use suitable ones such as standard contractual clauses. When people use a website made with Covebuilder, the owner of that website is responsible for that website's visitors' data and we process it for them (see our Terms, sections 12 and 12A).

Requests and complaints about personal data only: hello@covebuilder.com. For anything else, see the FAQ or ask Cove in your dashboard.