How we handle your data when you use SailWP, sailwp.com, app.sailwp.com, or the SailWP plugin/theme. Plain summary first, full detail below.
SailWP is a WordPress theme + plugin + cloud dashboard that lets you build and edit your site by chatting with an AI. To do that, the things you type, paste, attach, or speak get sent through our server to Anthropic (the AI provider), and the response comes back.
We do not sell your data. Anthropic does not train models on your data. We retain only what we need to run the service and bill you.
You have full GDPR rights — access, correction, erasure, portability — exercisable by emailing [email protected].
SailWP is operated by 31 Ventures, a sole proprietorship registered in the Netherlands.
For privacy questions, data-subject requests, or breach notifications, email [email protected] with subject "Privacy". We respond within 30 days as required by GDPR Art. 12.
A holding + BV structure is in formation. Once registered, this section will be updated and the BV will assume controller status by way of contract assignment under Art. 6:159 BW (Dutch Civil Code).
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the SailWP service (login, AI calls, dashboard, plugin) | Performance of contract — Art. 6(1)(b) |
| Bill you, issue invoices, comply with tax law | Legal obligation + contract — Art. 6(1)(b),(c) |
| Send transactional emails (magic-link, billing, security alerts) | Performance of contract — Art. 6(1)(b) |
| Detect and prevent abuse, rate-limit excessive use | Legitimate interest (service integrity) — Art. 6(1)(f) |
| Improve and debug the service | Legitimate interest — Art. 6(1)(f) |
| Send product updates / newsletters | Consent — Art. 6(1)(a). You can opt out anytime. |
We use the following sub-processors. Each has a data-processing agreement in place that meets GDPR requirements. Where data is transferred outside the EEA, we rely on the EU Standard Contractual Clauses (SCCs) per Commission Implementing Decision 2021/914.
| Sub-processor | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| Anthropic, PBC | AI inference (Claude models) | USA | SCCs + Anthropic DPA |
| Stripe Payments Europe Ltd. | Payment processing, VAT calculation, invoicing | Ireland (EEA) + USA | SCCs + Stripe DPA |
| Resend, Inc. | Transactional email (magic-links, billing notices) | USA | SCCs + Resend DPA |
| mijn.host (Hostnet B.V.) | VPS hosting, where our database and servers run | Netherlands (EEA) | EEA — no transfer |
| Cloudflare, Inc. | DNS, edge proxy, DDoS protection | Global / USA HQ | SCCs + Cloudflare DPA |
| Google LLC (Nano Banana Pro) | AI image generation (when you generate images via chat) | USA | SCCs + Google Cloud DPA |
We will publish a 30-day notice on this page before adding or replacing a sub-processor that processes personal data. To object to a new sub-processor, email [email protected]; you may terminate your subscription with a refund of any unused prepaid period if we proceed against your objection.
Anthropic data handling: per Anthropic's Commercial Terms, your inputs and outputs are not used to train Anthropic's models. Anthropic may retain inputs for up to 30 days for trust & safety review, after which they are deleted, unless flagged for legal/safety reasons.
| Data category | Retention |
|---|---|
| Account email, license key, site URL | Until 30 days after you close the account or uninstall the plugin (whichever is later) |
| Page-version snapshots | Up to 90 days, or until manual deletion via dashboard |
| Per-call usage logs (no content) | 13 months (rolling, for billing reconciliation) |
| Server access logs | 30 days |
| Stripe billing records, invoices | 7 years (Dutch tax law obligation, art. 52 AWR) |
| Anthropic AI inputs (held by Anthropic) | ≤30 days at Anthropic |
| Backups (encrypted nightly snapshots) | 14 days rolling, then overwritten |
On account closure we will delete or irreversibly anonymise data within 30 days, except where retention is required by law (e.g. tax records).
You have the following rights and can exercise them by emailing [email protected] from the email tied to your account. We will respond within 30 days, free of charge, unless requests are manifestly excessive.
We do not engage in automated decision-making with legal effect (Art. 22). The AI helps you build a site; it does not decide anything legally binding about you.
We apply appropriate technical and organisational measures (Art. 32 GDPR), including:
If we discover a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the Autoriteit Persoonsgegevens within 72 hours and inform affected users without undue delay (Art. 33–34 GDPR).
SailWP uses only cookies and local storage that are strictly necessary to deliver the service (Art. 11.7a Dutch Telecommunications Act / ePrivacy). No consent banner is required because we do not set tracking, advertising, or third-party analytics cookies.
SailWP is a B2B/professional product. The service is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with personal data, email [email protected] and we will delete it.
If we materially change how we process data, we will notify active users by email at least 30 days before the change takes effect, and update the date at the bottom of this page. Continued use of the service after the effective date constitutes acceptance of the updated policy. If you do not accept the change, you may close your account before the effective date and request data deletion.
Last updated: 30 April 2026 · Version 1.0 · Operated by 31 Ventures (KvK 81019556) · Terms · DPA