Privacy

Managed Garden is a service of Square Post Labs Inc. If you have a question about anything on this page, email privacy@managedgarden.com.

• Your account. Your email address, and anything you choose to put in your account such as a business name. We use this to sign you in, to contact you about your service, and to bill you.
• Your website content. The pages, posts, images and settings you create. We store and publish these because that is the service.
• Visitor analytics on your site. If analytics are enabled for your site, we record page views and similar events so you can see what your site is doing. Each customer's analytics are kept in a separate project.
• Operational records. Logs of publishes, deployments, errors and similar events. These are how we run the platform and how we work out what went wrong when something breaks.

• To run the service: publishing your site, keeping it online, backing it up and restoring it.
• To support you: answering questions and diagnosing faults, which sometimes means reading logs relating to your site.
• To bill you, and to contact you about your account.
• To operate and improve the service, using aggregated and de-identified information. This means facts about the platform as a whole, such as how long a typical publish takes or how large a typical site is. It does not involve singling out you or your visitors.

We do not sell your information, and we do not sell your visitors’ information.

We may want to write about work we are proud of. If we ever name you, quote you, or publish numbers about your business, we will ask you first and you can say no. Where we write about results without identifying anyone, we use aggregated information as described above.

We use a small number of established providers to run the service. Each one only receives what it needs:

• Cloudflare — serves your website, protects it, and stores published copies of it.
• Supabase — stores your account and sign-in details.
• PostHog — records website analytics, where enabled.
• Stripe — processes payments. We do not store your card details.
• Resend — delivers email we send you, such as sign-in and account messages.

Your site, its database and its backups run in the region you choose. See data residency for what each region covers. Some providers above operate globally distributed networks; where that is the case, the content served is a published copy of your site rather than your account records.

• Your account and site content: while your account is open, and for a short wind-down period after you close it so that an accidental cancellation can be undone.
• Backups: on a rolling schedule, so an older backup ages out over time.
• Operational logs: kept long enough to investigate problems and understand trends, not indefinitely.

If you want your data deleted sooner, ask us and we will tell you exactly what we can remove and when.

Depending on where you live, you can ask us for a copy of the personal information we hold about you, ask us to correct it, or ask us to delete it. Canadian customers have these rights under PIPEDA; customers in the UK and EU have them under UK and EU GDPR. Email privacy@managedgarden.com and we will respond.

If you run a website with us, your visitors’ information is yours, and we handle it on your instructions. If one of your visitors contacts us directly, we will point them to you.

Sites run isolated from one another. The credentials that can change your DNS or deploy your site are held separately from the software that runs your website, so a compromised website cannot reach them. We back your site up and can roll it back to a previous published version.

No system is perfect. If we ever have a breach affecting your information, we will tell you what happened, what it affected, and what we did about it.

If we change this page in a way that materially affects you, we will tell you by email rather than quietly editing the page.