2026Website Starter Kit
getdesign.md
...

Privacy Policy

Last updated: July 13, 2026

1. Overview

getdesign.md ("the Service") is operated by the VoltAgent team ("we", "us", "our"). This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, and your rights.

2. Data Controller

For the purposes of the EU/UK General Data Protection Regulation (GDPR) and similar laws, the data controller for getdesign.md is the VoltAgent team. You can reach the controller for privacy questions or data-subject requests at necati@voltagent.dev.

3. Data We Collect

3.1 Browsing the Directory (Free)

If you consent to analytics, Google Analytics collects usage data such as page views, approximate location (country level), browser type, and device type. PostHog records selected product events and may associate those events with your account ID and email after you sign in. Optional analytics is disabled until you opt in, and you can withdraw consent at any time.

3.2 Authentication (Optional)

If you choose to sign in to save designs, we collect your email address and, depending on the login method, your GitHub or Google profile information through Supabase authentication. This data is used solely to maintain your saved designs across sessions.

3.3 Onboarding and survey responses

If you answer onboarding or survey questions, we collect your selected answers and any free-text response you provide. Raw responses may be associated with your account so we can remember your preferences, personalize the Service, improve our products, and create aggregated or anonymized research, reports, benchmarks, and marketing insights. We do not publish individual responses in a way that identifies you without your permission.

3.4 Purchasing a paid product

When you purchase a website-directory DESIGN.md, submit a private DESIGN.md request, or buy the Website Starter Kit, we collect:

  • Email address, to deliver the generated files or the Website Starter Kit download link.
  • Website URL, either the directory entry you selected or the URL you submitted for a private request.
  • Current build stack, the option you select in the "How are you building your website/app right now?" dropdown. Used only to tailor the delivered DESIGN.md and kit to your workflow.
  • Additional details, any extra context you provide (optional).
  • Purchase metadata, the product tier you chose and the Stripe checkout session reference, used to verify payment and fulfil your order.
  • Acceptance record, a timestamp confirming that you accepted the Terms and this Privacy Policy at checkout.

4. Legal Bases for Processing (GDPR)

  • Performance of a contract, to process your purchase and deliver the product you ordered.
  • Legitimate interests, to secure the Service, prevent fraud and abuse, and improve our products using aggregated or anonymized research.
  • Consent, for optional Google Analytics and PostHog cookies or browser storage.
  • Legal obligation, to keep tax, accounting, and consumer-law records.

5. Payment Processing

All payments are processed by Stripe. We do not store your credit card number, CVV, or any sensitive payment information on our servers. Stripe handles all payment data in compliance with PCI DSS standards. Please refer to Stripe's privacy policy for details on how they handle your payment information.

6. How We Use Your Data

  • To deliver the DESIGN.md files or Website Starter Kit download link you purchased to your email address.
  • To tailor the delivered DESIGN.md and kit to the build stack you selected.
  • To communicate with you about your order if needed (e.g. clarification, delivery status).
  • To meet legal, tax, and accounting obligations.
  • To understand and improve the Service through optional usage and product analytics when you consent.
  • To analyze onboarding and survey responses in aggregated or anonymized form for product research, public reports, benchmarks, and marketing insights.
  • To maintain your saved designs if you have an account.

7. Sub-processors and Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. We rely on the following sub-processors to operate the Service:

We may add or change sub-processors over time. Material changes will be reflected on this page.

8. International Data Transfers

Some of our sub-processors are located outside your country of residence (for example, in the United States). Where required, transfers of personal data rely on appropriate safeguards, including the EU Standard Contractual Clauses and equivalent mechanisms under UK law. By using the Service, you understand that your personal data may be processed in those jurisdictions.

9. Data Retention

  • Order and email records: retained for up to 24 months after delivery for customer support and abuse prevention.
  • Tax and accounting records: retained for the period required by applicable law (typically up to 10 years).
  • Account data: retained while your account is active. If you delete your account or request deletion, we remove your data within 30 days, except records we are legally required to keep.
  • Onboarding and survey responses: retained while your account is active, or until you request deletion, except limited records we need for security, legal, or abuse-prevention reasons.
  • Analytics data: Google Analytics and PostHog retain identifiers and event data according to our account settings and their applicable retention controls. Browser cookies may persist for the durations listed in our Cookie Policy unless you withdraw consent or delete them sooner.
  • Aggregated or anonymized statistics: may be retained indefinitely when they no longer identify you.

10. Cookies

The Service uses necessary cookies for consent preferences, authentication, security, and paid access. Google Analytics and PostHog cookies or browser storage are activated only after you opt in. We do not use advertising cookies. You can change your choice at any time through "Cookie settings" in the footer or review the details in our Cookie Policy.

11. Your Rights

Depending on where you live, you may have the right to:

  • Access the personal data we hold about you.
  • Request correction or deletion of your personal data.
  • Object to or restrict certain processing.
  • Withdraw consent for data processing at any time (without affecting past processing).
  • Receive a copy of your data in a portable, machine-readable format.
  • Lodge a complaint with your local data-protection supervisory authority.

To exercise any of these rights, contact us at necati@voltagent.dev. We respond to verified requests within 30 days.

12. Children's Privacy

The Service is not intended for, and we do not knowingly collect personal data from, children under the age of 16. If you believe a child has provided us personal data, contact us and we will delete it promptly.

13. Security

We use industry-standard administrative, technical, and physical safeguards to protect personal data against loss, misuse, and unauthorised access. No internet-based service is 100% secure, and we cannot guarantee absolute security.

14. Contact

For privacy-related questions or data-subject requests, please email necati@voltagent.dev.