Privacy notice

Last updated 3 November 2026

This notice explains what personal data Pagebutler keeps, why, where, for how long, and what you can ask us to do with it. It is written for the UK GDPR and the Data Protection Act 2018 and, for people in the European Economic Area, the EU GDPR.

Pagebutler is invite-only for now. This notice describes the service as the people we've invited use it today, and we'll update it before that changes.

Who we are

Pagebutler is made by Luminous Design LTD, a company registered in Scotland with company number SC486975. Our registered office is 13-15 Morningside Drive, Edinburgh, EH10 5LZ.

Luminous Design LTD is the controller of the personal data this notice describes: we decide why and how it's used.

To ask about this notice or to use your rights, write to hello@pagebutler.ai. We haven't appointed a data protection officer, because a company of our size and kind doesn't need one.

What this notice covers

• this website, pagebutler.ai;
• the Pagebutler service: signing in, your workspaces and sites, the agents and devices you connect, the site keys you create, and the emails we send you.

Websites hosted on Pagebutler, at addresses ending in butler.page, belong to the people who publish them. For those websites' visitors, the site's owner decides what the site collects, and we store and serve it on their behalf. See the site's own privacy notice, or ask its owner.

Your coding agent, such as Claude Code, Codex or a Claude chat, is run by its own provider, and what you share with it is covered by that provider's terms. This notice covers what reaches Pagebutler.

What we collect

Your account

Your name, your email address and whether it's confirmed, and a link to your profile picture. They come from Google if you sign in with Google, or from you if you sign in with an email link. Google also gives us an account number, so we recognise you next time.

Signing in

While you're signed in, a cookie in your browser holds a random value that matches a session we keep, with the time it ends. We don't store your IP address or details of your browser with it.

When you ask for a sign-in link, we keep your email address and a one-time code until you use it or it expires, 15 minutes later.

To stop abuse, we count sign-in requests per IP address, requests for sign-in links per email address, and, per account, wrong sign-in codes and attempts to open previews the account can't open. We keep each count for at most an hour, without storing the IP address or email address itself.

Invitations

We keep the list of email addresses we've invited to Pagebutler. When a member invites you to a workspace, we keep your email address, who invited you and the role they offered until you join or decline, the member withdraws the invitation, or it expires 7 days after it was sent, and we delete them within an hour of that. The invitation email shows you the name and email address of the member who invited you, and the workspace's name.

To stop abuse, we count the invitation emails each workspace sends and each member sends, and keep each count for a day, without the addresses they went to.

Your workspaces and sites

• Your workspaces, their members, and each member's role. Every member of a workspace can see the other members' names, email addresses and roles.
• For each site: its name, the files your agent or the pb command uploads, each version, and a record of every deploy, publish and rollback: who made it, when, and the message given.
• The images your agent or the pb command adds to a site's image library, by uploading them or by importing them from a link or from a file attached in ChatGPT, each with who added it, when, and the name of its file or the name your agent gave it, without any folder, so that you can tell them apart. To import an image, we fetch it once, from our servers, from the address given: the site that holds it sees a request from Pagebutler, not from you. We don't keep that address. Before storing an image, we remove the details a photo file can carry, such as where and when it was taken and with which camera. We don't keep the file as it was sent or fetched, only a fingerprint of it, so that the same file isn't stored twice.
• When your agent or the pb command uploads a site's files: a permission for that upload, with who asked for it, through which app, and when. It works for an hour.
• The content saved to each site, with the history of every change to it: what was written, who wrote it, who published it, and when. When a deploy or a publish combines new code with the site's content, we keep a report of what it kept, moved or held back. The report quotes the words it compared and records who wrote them. We also keep each decision made about those words, and who made it.
• When a publish of new code replaces or removes words someone published: a note for that person saying which of their words changed and in which publish, so that we can tell them later. Nobody can see these notes in Pagebutler yet.
• The share links you create: who created each one, when it expires, and whether it was revoked.
• When you sign in to open a preview of a site: a record of which preview you opened and when. It keeps the preview open for you for 12 hours, and lets us close it sooner if you sign out or leave the workspace.
• The answer to each change you ask for, for about a day, so that a request sent twice is carried out only once.

Agents, devices and site keys

When you connect an agent, or sign in with the pb command, we keep a record of the connection: which app or device it is, what you allowed it to do, when you connected it, and when it was last used. When you disconnect an app, we delete that record, and for 11 minutes keep a note of which app you disconnected and when, so that nothing it was given before can be used again. This doesn't delete your account's record of connecting and disconnecting it, described below.

When you create a site key, which lets a tool such as a deploy job work on one site, we keep its name, its first characters, its site, what it may do, who created it and when, when it expires, when it was last used (to the minute), and whether it was revoked. We keep a fingerprint of the key, never the key itself. To limit how often a key can be used, we count its requests, and keep each count for a minute.

Records of who did what

For each workspace, we keep a record of the changes made in it and on its sites, called its audit log: what was changed, who changed it, with which app or site key, and when. It holds none of the sites' words: it records an edit by its page and how many fields changed, an image added to a site's image library by whether it was uploaded or imported from a link or from a file attached in ChatGPT, never the link, and each person by an internal number, not by their name or email address. The workspace's owners and admins can read it, and it shows them each person's current name.

For your account, we keep a record of when you sign up, sign in and sign out, and whether you signed up or in with Google or an email link; of each app or device you connect, and what you allowed it to do; and of each one you disconnect. Nobody can read it in Pagebutler: we keep it to look into misuse of an account. Neither record keeps your IP address or details of your browser.

Emails we send

We send sign-in links, workspace invitations and, when something important changes, a notice about your account. We send no newsletters and no marketing, and we don't track whether you open our emails or click their links.

Amazon Web Services sends them for us from Frankfurt, and we don't ask Amazon to keep a copy of the message. If a message bounces or is reported as spam, we keep a scrambled form of the address (a keyed hash) so that we stop sending to it. Amazon also keeps the address on its own list of addresses not to send to, until we remove it.

We keep a record of each email we send (which kind, when, and whether it arrived) for 30 days, without the message or your address.

Error reports and logs

Our servers write a line about each request and each background task: when, which part of the service, its result, and how long each step took. A request's lines carry a number for it, which the records of who did what keep too, so that we can follow a problem through. These lines don't say who made the request: they hold no name, email address, IP address or details of your browser. When something goes wrong, our servers also record the error. Before anything is written down or sent to Sentry, our error-reporting service, we remove email addresses and tokens from it, and we never send your IP address to Sentry. If a background task fails for good, we keep its details so we can put it right.

Mail you send us

If you write to hello@pagebutler.ai, Cloudflare forwards your message to the mailbox we answer from, which is on Google Workspace, and keeps a record of the forwarding. We keep the conversation for as long as we need it to help you.

Visits to this website

This website keeps no record of your visit. It uses no analytics, sets no cookies and loads nothing from other websites. Cloudflare, which delivers it, handles your IP address and your request to send you the page and to protect the site from attacks. If this changes, we'll update this notice first.

What we don't collect

• Payment details: nothing is for sale yet.
• Special categories of data, such as health, religion or political views.
• Anything for advertising or tracking.

We don't sell your data or share it for advertising, and we don't send it to AI models or use it to train them.

Why we use it

We need a lawful basis for each use. The articles named here are the same in the UK GDPR and the EU GDPR.

• To provide Pagebutler to you: your account, signing in, your workspaces and sites, the agents you connect, the site keys you create, and the emails about your account. This is necessary for our contract with you (Article 6(1)(b)).
• To send invitations and keep the list of invited addresses: so that the people our members invite can join. This is our legitimate interest, and the inviting member's (Article 6(1)(f)).
• To keep Pagebutler secure and working: limiting sign-in requests and requests made with site keys, error reports and logs, not emailing addresses that bounce, and backups. This is our legitimate interest in running a safe and reliable service (Article 6(1)(f)).
• To keep a record of who did what: each workspace's audit log, so that its owners and admins can see who changed what, and each account's record of signing in and connecting apps, so that we can look into misuse. This is our legitimate interest, and the workspace owners', in a service whose changes can be accounted for and whose accounts stay safe (Article 6(1)(f)).
• To answer mail you send us: our legitimate interest in replying to you (Article 6(1)(f)).
• Where the law requires us to keep or share data: our legal obligation (Article 6(1)(c)).

We don't rely on your consent for any of this, and we make no decisions about you by automated means. You need an email address to have an account: without one, we can't sign you in.

Data from Google sign-in

If you sign in with Google, Google shares your name, email address, profile picture and Google account number with us. We ask Google for nothing else: only the openid, email and profile permissions.

• We use them only to create your account, sign you in, show your name and picture in Pagebutler, and send you emails about your account.
• We store them in our database in Frankfurt, Germany, for as long as you have an account.
• We don't keep the tokens Google gives us once you're signed in, and we don't use any other Google service with your account.
• We share them with nobody except the providers that run Pagebutler for us, listed below. We don't sell them, use them for advertising, or use them to train AI models. Nobody at Pagebutler reads them unless you ask us for help, or security or the law requires it.
• Pagebutler's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

To remove Pagebutler's access, open your Google Account's third-party connections and remove Pagebutler. To delete what we hold, see Your rights.

Who processes it for us

These companies process personal data for us, under their data processing terms:

• Cloudflare: delivers this website and the websites hosted on Pagebutler, stores hosted sites' files in its EU data centres, and forwards mail sent to hello@pagebutler.ai.
• DigitalOcean: runs Pagebutler's service and its database in Frankfurt, Germany.
• Amazon Web Services: sends our emails from Frankfurt, Germany.
• Sentry (Functional Software, Inc.): keeps our error reports and logs in Frankfurt, Germany.
• Google (Google Workspace): hosts the mailbox that hello@pagebutler.ai forwards to.

Google provides Sign in with Google. For your Google account itself, Google is responsible, under its own privacy policy.

Where it's stored

We store your data in the EU: our database, error reports and logs in Frankfurt, Germany, and hosted sites' files in Cloudflare's EU data centres. The UK recognises the EU as protecting personal data adequately, and the EU recognises the UK in the same way.

Some processing happens elsewhere:

• Cloudflare delivers pages from the data centre nearest each visitor, anywhere in the world. It also keeps, in all its data centres, a small table of which version of each site to serve, and which of a site's preview links and sign-ins were ended early, until at most ten minutes after the last of them would have run out: site names, versions and random numbers, nothing that names you. The sites' files are stored in its EU data centres, and each data centre that delivers a site keeps copies of what it delivered for up to 30 days.
• Cloudflare receives mail sent to hello@pagebutler.ai in its data centres anywhere in the world, and keeps a record of each message it forwards, with the sender's address and the subject, for about a month.
• Mail you send us is kept in our Google Workspace mailbox, which Google may store outside the UK and the EU.
• Cloudflare, DigitalOcean, Amazon Web Services, Sentry and Google are US companies, and their staff may reach data from outside the UK and the EU, for example for support or security.

Where personal data leaves the UK or the EU, we rely on the EU-US Data Privacy Framework and its UK Extension for providers certified under them, and otherwise on the EU's standard contractual clauses and the UK's International Data Transfer Addendum. Write to us for a copy.

How long we keep it

• Your account: for as long as you have one.
• Sessions: until you sign out, or seven days after you last used Pagebutler.
• Sign-in links: your email address and the one-time code, until used, and at most 15 minutes.
• Codes for signing in the pb command, on another device or from your agent's link: until used, and at most 15 minutes.
• Counts of sign-in requests: at most an hour.
• Invitations: until you join or decline, or the invitation is withdrawn, and at most 7 days. Counts of invitations sent: a day.
• Records of signing in to open a preview: 12 hours, and we delete them within a day after that.
• Site keys: until the key is revoked or expires, then 30 days more; at once if the person who created it leaves the workspace or is removed from it, or their account is deleted. Counts of a key's requests: a minute.
• Connections of agents and devices: until you disconnect them. An app you haven't used for 30 days has to sign in again, and once nobody has used an app for 30 days, we delete its record and everyone's connection to it. The pb command's connection stays until you disconnect it.
• Notes of apps you disconnected: 11 minutes, longer only while something the app was given before still exists, and we delete them within a minute after that.
• Your sites: for as long as the site exists, with its history of versions, content changes, deploys, publishes and rollbacks, their reports and decisions, the notes of replaced words, and its uploaded images, which nobody can delete in Pagebutler yet. When a site is deleted, it goes offline at once, and its files and records are removed seven days later, so that a mistake can be undone; the workspace's audit log keeps its entries about the site for their year. Its address stays reserved for 30 days, so nobody else can take it.
• Audit logs: each entry for a year, even once the person, site, app or site key it names is gone, and we delete it within a day after that.
• Your account's record of signing in and connecting apps: each entry for 90 days, even once your account is deleted, and we delete it within a day after that.
• Answers to change requests: about a day.
• Upload permissions: an hour, then 7 days more, and we delete them within an hour after that.
• Error reports, logs and timings: up to 90 days.
• Details of background tasks that failed: 30 days.
• Backups of our database: deleted data can remain in them for up to 30 days.
• Addresses we've stopped emailing: as a keyed hash, until you ask us to remove yours. Amazon keeps the address on its own list until we remove it there.
• Records of the emails we send: 30 days, without the message or your address.
• Mail you send us: for as long as we need it to help you. Cloudflare's record of the forwarding: about a month.
• Visits to this website: nothing is kept.

Your rights

You can ask us to:

• give you a copy of your personal data;
• correct it;
• delete it;
• restrict how we use it;
• stop using it where we rely on our legitimate interests;
• give you the data you gave us in a format a computer can read, or send it to another provider.

Write to hello@pagebutler.ai, from the email address on your account if you have one, so we know it's you. It's free. We answer within one month; if a request is complex, we may take up to two months more, and we'll tell you why.

While Pagebutler is invite-only, we delete accounts by hand when asked. We delete your sign-in data and sessions, and in the history of the sites you worked on, which their other members keep, we replace your name and email address with a placeholder. Two records stay for their time: your account's record of signing in and connecting apps, for its 90 days, so that misuse can still be looked into; and workspaces' audit logs, whose entries name you only by an internal number.

Complaints

If you're unhappy with how we've handled your data, tell us first: write to hello@pagebutler.ai with "Complaint" in the subject, or by post to our registered office. We'll confirm we've received it within 30 days, look into it, and tell you what we found and what we've done.

You can also complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. If you live or work in the European Economic Area, you can complain to the data protection authority in your country; the European Data Protection Board lists them.

Cookies

This website, pagebutler.ai, sets no cookies.

Pagebutler uses cookies only where they're strictly necessary for something you asked for, which the law allows without asking you first:

• when you sign in: cookies that keep you signed in and protect the sign-in from forgery;
• when you open a share link to a preview of a site hosted on Pagebutler: one cookie on that preview's address, named __Host-pb_viewer, which lets you keep viewing the preview until the link expires, at most seven days later;
• when you sign in to open a preview of a site in one of your workspaces: for up to 15 minutes, a cookie on that preview's address named __Host-pb_handoff, which holds a one-time secret and the address of the page you were on, so that signing in brings you back to that page in the same browser; then the same __Host-pb_viewer cookie, which lets you keep viewing that preview for up to 12 hours.

On auth.pagebutler.ai and api.pagebutler.ai, our hosting provider's network may also set a cookie named __cf_bm, for up to 30 minutes, to tell people from bots.

We use no analytics or advertising cookies.

Changes to this notice

We'll update this notice before Pagebutler changes how it uses personal data. The date at the top shows the last update. If a change affects how we use your account's data, we'll email you about it first.