Privacy Policy

Effective October 21, 2026

This Privacy Policy explains how Tropic Arts LLC ("Tropic Arts," "we," "us," or "our") collects, uses, and shares personal information when you create an account and use the Tropic Arts website-building platform (the "Service"), and when you visit our own website, contact us, or join our mailing list. It applies to you as a Tropic Arts account holder, and the privacy practices described in this Policy that are relevant to your activity also apply to you if you visit our website or contact us without holding an account. Provisions that by their nature concern only an account, plan, site, domain, or account security apply only to account holders.

It does not govern how the individual websites and stores our customers build with the Service handle their own visitors' data — those site owners are responsible for their own privacy practices, and we act as their processor. There is one exception we run ourselves, described below: an aggregate, cookieless count of visits to each site — our customers' sites, where we act as their processor, and our own website, where we are the controller.

Information We Collect

Information you provide. When you sign up and use the Service we collect the information you give us, including:

• Your name and email address, and the password you set
• Your confirmation that you are 18 or older and your acceptance of our Terms (with the date and version, and the IP address and browser you accepted them from)
• Your acceptance of our Data Processing Agreement, with, where you give them, the legal name and registered address of the business you accept it for, the date and version, and the IP address and browser you accepted it from
• Account and profile details, and the content, sites, and settings you create
• Billing details you provide for a paid plan (payment card data is handled by our payment processor, not stored by us)
• Messages you send us for support

Information collected automatically. When you use the Service we automatically collect certain technical information, such as your IP address, device and browser type, pages viewed, and actions taken, along with log and diagnostic data. We use cookies and similar technologies, such as your browser's local storage, to keep you signed in, remember your preferences, and secure the Service. If you allowed marketing cookies on our website before you signed up, we also keep a record of how you found us, as described in "How You Found Us" below.

Messages and Enquiries

You don't need an account to get in touch. When you contact us — by email, or through the sales enquiry and support request forms on our website — we collect what you send: your name and email address, the details the form asks for (such as your company or project name, your website address, and what your request is about), and your message.

We use the information you give us to reply to you and to deal with your request. The sales enquiry and support request forms are handled through our inbox, and each sends you an email confirming that we received your message. Your details and message are kept in our customer records and our inbox, together with our replies, so that whoever answers can see the conversation so far. The sales enquiry form also offers a separate box to join our mailing list for occasional news and updates from Tropic Arts, including new templates. Sending the form adds you to that list only if you affirmatively select that box. Every marketing email includes an unsubscribe mechanism. You can also join the list without sending an enquiry, as described in "Our Mailing List" below.

Our website also allows you to report a site to us. If you provide an email address, we keep the address, report, and our replies with the request in our inbox. This form does not currently send an acknowledgement email.

Our Mailing List

Our mailing list is how we send occasional news and updates from Tropic Arts, including new templates. You do not need an account to join it. On our website, there are two ways to do so: affirmatively select the mailing-list option on our sales enquiry form, or enter your email address in a mailing-list sign-up form. The sign-up form asks for your email address and nothing else, and we record when and how you joined and the version of the consent notice presented to you.

We send a confirmation email and add an address to the mailing list only after the person who controls the address confirms the subscription. Joining the list does not create an account, sets no cookie, and does not record how you found us.

Joining creates or updates a customer record for your email address. If we already have a record, for example from an enquiry, we may link the mailing-list status to that record so that our staff can see the conversation history. Linking does not by itself extend how long we keep those earlier records.

To prevent misuse, the sign-up form keeps a short-term tally of attempts from each IP address and for each email address. We use those tallies only to limit abuse. We do not save a sign-up attempt that is over the limit. These tallies are distinct from the website visitor counts described elsewhere in this Policy.

Everyone on the mailing list receives the same marketing messages, whichever way they joined. We keep mailing-list records with our cloud hosting provider, AWS, and we send list email through Amazon SES, which receives your email address and the message content needed to deliver the email.

Every marketing email contains a readily accessible unsubscribe mechanism. You may use the unsubscribe link in the email or email us at hello@tropic-arts.com. Unsubscribing stops future marketing emails from being sent to you, but it does not by itself delete every record we may hold about you.

We keep your mailing-list record while you are subscribed. After you unsubscribe, we retain only the information reasonably necessary to record that you withdrew consent, prevent an unwanted re-addition, and demonstrate compliance. We do not retain an inactive mailing-list record indefinitely merely because it once existed. When that information is no longer reasonably necessary for those purposes, we delete or irreversibly de-identify it.

If you ask us to provide a copy of, correct, or delete your mailing-list information, email hello@tropic-arts.com. We will handle the request in accordance with applicable law. Where permitted, we may retain a minimal suppression record, such as a protected representation of your email address, solely so that we do not add you back to the mailing list after you asked us not to. We also keep a limited record that we handled your privacy request, for as long as reasonably necessary to demonstrate compliance or defend legal claims.

Where our mailing-list systems record delivery, opens, clicks, or other message activity, we treat those records as personal information when they can reasonably be linked back to a person using information we hold. Those records are maintained separately from the ordinary contact record but are not treated as anonymous. We will make such information available or delete it when required by applicable law and when our systems can reasonably identify the relevant records.

At launch, Tropic Arts will not use invisible tracking images or tracked marketing links unless and until we have implemented the separate consent and disclosure controls required for those technologies. If such tracking is introduced later, this Policy and the collection flow will be updated before tracking begins, and existing subscribers will not be treated as having consented merely because they previously consented to receive marketing email.

We add you to the mailing list and send the list emails because you asked us to do so. Where applicable privacy law requires a legal basis, we rely on your consent for the marketing list. You may withdraw that consent at any time by unsubscribing; withdrawal does not affect processing that was lawful before you withdrew it. We may retain the minimum information needed to honor your request not to receive marketing and to demonstrate compliance on the basis of our legitimate interests, where permitted by law. If you are in the European Economic Area or the United Kingdom, you may also complain to your applicable data protection authority.

A sign-up attempt that is suppressed or rate-limited receives the same neutral confirmation message as a successful submission. We do not use the response to reveal whether an address was previously subscribed, suppressed, or subject to a rate limit.

Website Visitor Counts

Every site built on the Service keeps a private, aggregate count of its own page views, so its owner can see how many people visited and which pages they read. We designed and operate this counter, and the numbers are stored on our infrastructure.

It uses no cookies and shares nothing with any third party. We do not store visitors' IP addresses, browser user-agent strings, or any identifier alongside the counts. To avoid counting one person twice in a week, a visitor's IP address is combined with a secret that we replace every week and converted into an irreversible value; that value is deleted after eight days, and once the week's secret is replaced it cannot be recomputed. It is never stored next to the page counts.

Site owners can switch the counter off for any of their sites, which stops collection for that site immediately. Visitors who decline analytics in a site's cookie banner are not counted.

We count visits to our own website the same way. Tropic Arts's own marketing site runs the identical counter, on the same terms and with the same eight-day limit — no cookies, no third party, no IP address or user-agent stored. The difference is our role: for a customer's site we are that owner's processor, while for our own site we are the controller. If you would rather not be included, email us at hello@tropic-arts.com and we will exclude it. The counter itself never sets a cookie; the one marketing cookie our website can set, and only with your permission, is described next.

How You Found Us

We want to know which of our campaigns, and which other websites, lead people to sign up, so that we put our effort into the ones that work. When you arrive at our own website from another website, or from a link carrying campaign tags (the "utm" parameters added to links in ads, emails and posts), and only if you have allowed marketing cookies in our cookie banner, we set one first-party cookie named ta_first_touch.

It records the campaign source, medium and name from that link; the website you came from — its domain only, never the page; the page of our website you arrived on; and the time. It is set once, so a later visit does not replace it, and it expires after 30 days. It holds no advertising click identifier. No script on any web page can read it, including on the websites our customers build, and it is sent only to our own servers.

If you then create an account, we copy those details onto your account record and delete the cookie. We use them only to measure our own marketing — which sources lead to sign-ups and to paid plans. They are not sold or shared with anyone, and they are not used to build an advertising profile of you. If you never create an account, the cookie simply expires, and if you withdraw marketing consent in our cookie settings, we delete it.

Domain Registration

If you register a domain name through the Service, ICANN — the body that oversees domain names — requires a contact record for the person or business the name belongs to. The name, organization, street address, telephone number, and email address you give us for that purpose are the registrant record, and they are treated differently from the rest of your account information in three ways worth reading.

They leave us. We pass the registrant record to the registrar for that ending, to the registry operator that runs it, and to the data-escrow agent ICANN requires registrars to use. We apply WHOIS privacy to every domain we register, so the record is not published in the public WHOIS or RDDS directory; the registrar publishes its own privacy-service details in its place.

The email address must work. The registrar sends a verification message to the address on the record. This is an ICANN requirement, not ours, and it comes from the registrar rather than from Tropic Arts. If it goes unanswered for fifteen days the registry suspends the domain and the website stops resolving. Use an address you can read today — not one at the domain you are registering, which has no mailbox yet.

We cannot delete it on request while the domain is live. ICANN requires the registrant record to stay accurate for the life of the registration, it has already been passed to the parties above, and our registrar offers no way to un-register a domain. So a deletion request cannot reach this particular record while you hold the name. What you can do instead is transfer the domain to another registrar, or turn off automatic renewal and let it expire — both end our part in it, and both are available to you at any time.

A domain renews automatically each year, and that continues even if you cancel your plan or close your site, because the name stays yours until you say otherwise. You can turn renewal off whenever you like, and we stop billing you for it.

Reading Your Current Website

When you start a new site, you can ask us to read the website your business uses now, so that the new site can start from what it says. Before we read anything, you confirm that the website is your business's and that you have the right to use its content.

What we read. We read only the public pages at the address you give us, which anyone can open without signing in. We first read the website's robots.txt file and follow it: we don't read a page or feed it asks crawlers to leave alone. From the pages we read, we take the text, the business's details (such as its name, contact details, locations, and opening hours), its posts and products, and the web addresses of its photos. We don't read the websites of health care practices for people, places of worship, political parties, or labor unions, or websites marked as being in a language other than English, and we skip any page marked as being in another language.

What we send to our AI provider. We send the text we read to our AI provider, currently Anthropic, PBC, which picks out your business's details for us. Before anything is sent, we leave out the website's privacy policy, terms, reviews pages, and forms, and the passages we find that mention someone's health, religion, politics, union membership, sex life or sexual orientation, racial or ethnic origin, genetic or biometric data, criminal record, or ID or payment details. On a veterinary practice's website we keep passages about health, since we can't tell an animal's health from a person's, but we still leave out topics that are only ever about people. Our checks work only in English.

What we keep, and for how long. We keep what we read so that you can review it and create your site from it. If you create a site from it, the content and photos you choose to keep are copied into that site, and a daily cleanup deletes the rest of what we read once 7 days have passed since you created the site. A record of the reading (the website's address, who asked for it, your confirmation, the versions of our Terms and Data Processing Agreement you accepted and when, and what you chose to keep) stays with the site for as long as the site exists. If you don't create a site from it, the daily cleanup deletes what we read, the website's address, and your email address from the reading once the reading is 7 days old, and deletes the rest (the website's domain, the account it was read for, your confirmation, the versions of our Terms and Data Processing Agreement you accepted and when, and what the reading cost) once it is 400 days old.

If you don't use a reading to create a site, you are the controller of any personal data in it, and we process that data on your behalf under our Data Processing Agreement, available at https://app.tropic-arts.com/dpa.

Removing Photo Backgrounds

When available, background removal will process the photo you choose using a model we host on AWS; the feature will not send that photo to Anthropic. The generated image will be saved in your site storage alongside the original. Review the result and confirm you have the rights needed before publishing.

How We Use Your Information

We use personal information to:

• Provide, operate, maintain, and improve the Service
• Create and secure your account, and send you administrative and transactional messages (such as your temporary password, security alerts, and billing receipts)
• Respond to your requests and provide support
• Process payments and manage your plan
• Understand which of our marketing campaigns and referring websites lead to sign-ups and paid plans, as described in "How You Found Us"
• Monitor for, prevent, and address fraud, abuse, and security issues
• Comply with legal obligations and enforce our Terms
• Send the occasional news and updates you asked to receive, including new templates, and manage your subscription and unsubscribe requests

How We Share Your Information

We do not sell your personal information. We share it only as needed to run the Service:

• Service providers who work on our behalf (for example, cloud hosting, email delivery, payment processing, our AI provider, currently Anthropic, PBC, when you use a feature that runs on artificial intelligence, and — if you register a domain — the domain registrar, registry, and escrow parties described above) under obligations of confidentiality
• Stock-photo library — When you search for stock photos, or our site builder searches for them, our servers send the cleaned search terms to Pixabay to retrieve results. Pixabay receives those terms under its own Terms and Privacy Policy and may use search terms and search-results interaction data to operate, analyze, and improve its service, including through machine learning, as described in its Privacy Policy. We remove or reject certain identifiers before sending search terms, but free-text screening is not infallible. Do not enter names or information about your customers or other people. Photos you choose are copied into your site's own storage, so your site's visitors never contact Pixabay.
• Legal and safety reasons — to comply with law, respond to lawful requests, or protect the rights, property, and safety of Tropic Arts, our users, and the public
• Business transfers — in connection with a merger, acquisition, or sale of assets, in which case we will notify you of any change
• With your direction or consent — for example, third-party services you choose to connect

For the mailing list, we use third-party service providers to host and deliver the information needed to operate the list. AWS provides our cloud hosting and storage infrastructure, and Amazon SES provides email delivery. These providers receive only the information needed to perform their services and are subject to the contractual and legal requirements applicable to their role.

Cookies

We use strictly necessary cookies to sign you in and keep the Service secure, and preference cookies to remember choices you make in it, such as the site you last selected. We use no analytics cookies, and no cookies from advertising networks. On our own website, and only with your permission, we also set the one marketing cookie described in "How You Found Us". Our Cookie Policy, at tropic-arts.com/cookie-policy, lists each cookie by name, with what it does and how long it lasts. You can control cookies through your browser settings; disabling some cookies may affect how the Service works.

Data Retention

We keep personal information for as long as your account is active and as needed to provide the Service, then for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. Messages and enquiries you send us are kept with our record of that conversation for as long as we need them to deal with your request and to keep an accurate record of our correspondence. How you found us is kept only as part of your account record, with no separate copy, so it is removed whenever that record is deleted.

Your mailing-list subscription record and other mailing-list information are not part of any account. We keep an active subscription record while you are subscribed. After you unsubscribe, we retain only what is reasonably necessary to record the withdrawal, prevent unwanted re-addition, and demonstrate compliance, and we delete or irreversibly de-identify that information when those purposes no longer require it. If you ask us to delete your information, information that must be retained by law or that we reasonably need to defend legal claims may remain for the applicable period.

Our application, firewall, and backup-job logs are kept for 400 days, and our load balancer logs for 365 days. These logs can include your IP address, your browser, your email address, the names of your sites and domains, and the addresses of the pages you request. Our record of attempts to sign in to the Service, including the email address entered, the IP address and browser used, and whether the attempt succeeded, is kept for 400 days. Records of who downloaded a private file, with their IP address, are kept for 400 days. Our security record of the actions our staff and systems take in our cloud infrastructure is kept for six years. Private-file download records made before we began keeping them separately remain in that security record for its six years.

Information deleted from our live systems may remain in encrypted backups until those backups expire. Our database's automated backups are kept for 30 days, nightly backup copies for up to six weeks, and monthly backup copies for 13 months. Monthly copies leave out our log of the searches people run in site search boxes and the readings of websites described above, but a search someone saves, such as a saved property search, stays in them. Copies of the database we take by hand are deleted within 30 days, unless we must keep one longer for a legal hold or to investigate a security incident. Files uploaded to the Service are stored in two locations in the United States, and each keeps earlier and deleted versions of a file for 90 days.

Your Rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, and to withdraw consent. You can exercise many of these from your account settings, or by contacting us at hello@tropic-arts.com. We will respond as required by applicable law, and we won't discriminate against you for exercising these rights.

Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, including hashing account passwords and encrypting data in transit. No method of transmission or storage is completely secure, so we can't guarantee absolute security; please keep your password confidential and notify us of any suspected unauthorized access.

Children's Privacy

The Service and the mailing list are intended for adults. We do not knowingly collect personal information from children under 13 through the mailing list where applicable law requires parental consent. If we learn that we have collected personal information from a child in circumstances in which we were required to obtain parental consent, we will take the steps required by applicable law, which may include deleting the information. This does not limit any rights a child or parent may have under applicable privacy law.

International Data Transfers

We are based in the United States and may process and store information in the United States and other countries. Where we transfer personal information across borders, we take steps to ensure it is protected consistent with this Policy and applicable law.

Third-Party Services

The Service may link to or integrate with third-party products and services that we don't control. Their handling of your information is governed by their own privacy policies, and we are not responsible for their practices.

Changes to This Policy

We may update this Policy from time to time. When we make material changes, we will update the effective date and version above and, where appropriate, notify you. Your continued use of the Service after the changes take effect means you accept the updated Policy.

Contact Us

If you have questions about this Policy or your personal information, contact us:

Tropic Arts LLC
255 S Orange Avenue
Suite 104 #1639
Orlando, FL 32801
United States
Email: hello@tropic-arts.com
Web: tropic-arts.com