Your privacy
What we keep about you, why, for how long, who helps us, and how to see, download or delete it. In plain words.
Who we are
HATTECH Limited, Christchurch, New Zealand, runs My Front Page (myfrontpage.website) and My Storefront (mystorefront.website). This policy covers what we hold about you when you ask us for a website or a shop, try one, pay for one, or send a message through a site we host.
What we keep, and why
Your account: your email address (it is how you sign in), your name if you give it, and when you signed in. Your site: the answers, words, photos and logo you give us, and what you change in your admin. Billing: your plan, payments and receipts, and the card's brand, last four digits and expiry (never the card number: Stripe holds that). Help: the requests and messages you send us, and our replies.
We use these only to make, host and look after your site or shop, bill for it, help you, and keep it safe. We don't sell your details, and we don't use them for anyone else's marketing.
Answers you haven't sent yet
While you fill in a wizard, your answers are kept in your own browser on that device, so a reload loses nothing; Clear my answers removes them. If you tap Email me a link, we keep your email address and those answers (never your photos) for 30 days, so the link can bring them back on another device, then delete them. To see where people get stuck, each wizard also counts how many people reach each step, with no names, answers or addresses.
Messages sent through your site
When someone fills in the contact form on a site we host, their name, email, phone (if given) and message are kept in that site's admin and emailed to the business it belongs to, so they can reply. We hold them for the business and use them for nothing else. Messages that look like spam are kept aside and not emailed. Sites we host don't use advertising or tracking cookies.
When you visit our sites
To see which of our pages help people, our own two sites (myfrontpage.website and mystorefront.website) note each page you open: when, which page, the site or search that sent you, your rough whereabouts (town, region and country) and internet provider as your connection shows them, your device, system, browser, language and screen size, and how long the page was open. A random number kept in your browser tells us whether you have been before. We don't keep your IP address, name or email with it, we don't share it or use it for advertising, and we delete it after 90 days. If your browser asks sites not to track you (Global Privacy Control or Do Not Track), nothing is noted. The sites we host for businesses don't do this.
Who helps us
Cloudflare hosts the sites and stores their words, photos and backups. Stripe takes payments. Resend sends our emails. Cloudflare Workers AI drafts a new site's words from what you tell the wizard, and checks help requests before they reach us. GitHub holds the code and words of a site once it is paid for. These services may store information outside New Zealand; each protects it under its own privacy terms, and we give them only what they need.
How long we keep it
A free mock-up that isn't taken up is deleted 30 days after it ends, with a week's warning. A site whose subscription ends is kept 30 days in case you come back, then deleted. Backups of a site's words are kept for 30 days, and so are deleted photos, so a mistake can be undone. Payment records are kept for seven years, as tax law requires, by Stripe.
Your rights
You can see, download, correct or delete what we hold about you. In your account, Download everything gives you a site's words, photos, enquiries and receipts in one file, and Delete my account deletes your account and everything in it once nothing is being paid for. For anything else, reply to any of our emails. If you are not happy with how we have handled your information, you can complain to the Privacy Commissioner (privacy.org.nz).
Keeping it safe
Everything is sent over secure connections. Signing in uses a one-time link to your email, with no password to steal; our own admin also needs a code from an authenticator app. Our security and compliance page has the detail. If something ever went wrong that could cause you serious harm, we would tell you and the Privacy Commissioner as soon as we could, as the law requires.
Changes
If we change this policy in a way that matters, we email you first.
Last updated 17 October 2026.