Privacy

Managed Garden is a service of Square Post Labs Inc. If you have a question about anything on this page, email privacy@managedgarden.com.

• Your account. Your email address, and anything you choose to put in your account such as a business name. We use this to sign you in, to contact you about your service, and to bill you.
• Your website content. The pages, posts, images and settings you create. We store and publish these because that is the service.
• Visitor analytics on your site. If analytics are enabled for your site, we record page views and similar events so you can see what your site is doing. Each customer’s analytics are kept in a separate project.
• Operational records. Logs of publishes, deployments, errors and similar events. These are how we run the platform and how we work out what went wrong when something breaks.

• To run the service: publishing your site, keeping it online, backing it up and restoring it.
• To support you: answering questions and diagnosing faults, which sometimes means reading logs relating to your site.
• To bill you, and to contact you about your account.
• To operate and improve the service, using aggregated and de-identified information. This means facts about the platform as a whole, such as how long a typical publish takes or how large a typical site is. It does not involve singling out you or your visitors.

We do not sell your information, and we do not sell your visitors’ information.

We may want to write about work we are proud of. If we ever name you, quote you, or publish numbers about your business, we will ask you first and you can say no. Where we write about results without identifying anyone, we use aggregated information as described above.

We use a small number of established providers to run the service. Each one only receives what it needs:

• Cloudflare — serves your website, protects it, stores published copies of it, runs this console, and runs the AI model behind the website operator.
• Supabase — stores your account, sign-in details and site settings, and sends sign-in and password-reset emails.
• PostHog — records website analytics, where enabled.
• Stripe — processes payments. We do not store your card details.
• Resend — delivers other email we send, such as team invitations and contact-address confirmations, and contact-form messages from your website.

We do not currently offer a choice of where your data is stored or processed. Your account records are kept by Supabase in its Canadian region (ca-central-1). Your private editing site and its backups run on servers we operate. Your published site, file storage and the AI features run on Cloudflare's global network, and email and analytics are handled by the providers listed above, so some of your data may be processed outside Canada.

• Your account and site content: while your account is open, and for a short wind-down period after you close it so that an accidental cancellation can be undone.
• Backups: on a rolling schedule, so an older backup ages out over time.
• Operational logs: kept long enough to investigate problems and understand trends, not indefinitely.

When you delete a site, we keep its pages, images and settings for 30 days so you can restore it yourself from your dashboard. If you end that period early — by freeing the address, or by starting a new site at the same address — we keep a private copy until that same original date, so we can restore it if you ask us to. Ending the period early never extends it. That copy is not in your sites list and you cannot restore it yourself; it is restricted to our staff, every access to it is recorded, and it is destroyed on the date you were shown.

If you want your data deleted sooner than that, ask us and we will destroy every copy we hold, including the private one, and confirm when it is done.

Depending on where you live, you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Canadian customers have these rights under PIPEDA; customers in the UK and EU have them under UK and EU GDPR. Email privacy@managedgarden.com and we will respond.

If you run a website with us, your visitors’ information is yours, and we handle it on your instructions. If one of your visitors contacts us directly, we will point them to you.

Sites run isolated from one another. The credentials that can change your DNS or deploy your site are held separately from the software that runs your website, so a compromised website cannot reach them. We back your site up and can roll it back to a previous published version.

No system is perfect. If we ever have a breach affecting your information, we will tell you what happened, what it affected, and what we did about it.

If we change this page in a way that materially affects you, we will tell you by email rather than quietly editing the page.