Privacy Policy

This policy explains what Jaybird Digital collects, why, and how you can control it.

What we collect

We collect the information you give us to set up and run your website: your name and email address when you create an account; your billing address when you pay for a plan; the registrant details a domain registration requires when you buy a domain; a phone number or mailing address only if you choose to add one to your account; your organization's details, the content and images you upload, and payment records through our payment processor. We no longer verify nonprofit status or ask for an Employer Identification Number (EIN); one you gave us earlier for that purpose is kept with your website's record. We use your contact details for account support, billing and service administration; they are not displayed on your website. We do not see or store your full payment method — the payment processor handles card and account details.

Email migration and account access

When you use the email migration feature, you may grant us access to a Google, Microsoft, or other email account so we can move your mailbox to the new one we set up for you. You approve exactly the permissions we request on the provider's own consent screen before anything happens, and you can withdraw them at any time.

We store connection credentials in encrypted form. We copy your mailbox only as far as necessary to complete the migration you requested, and we do not read, sell, or use your mail for any other purpose. For Google accounts, the section below describes this in full.

Google user data

This section applies to information we receive from your Google account when you move a Gmail or Google Workspace mailbox to the new mailbox we set up for you.

What we access, and why. We ask for read access to the mailbox you choose to move: its messages, its folder (label) structure, and the account's email address. We use it for one purpose, which is copying your mail into your new mailbox. We only read. We do not send, delete, or change anything in your Google account, and we do not use this access for any other feature.

What we keep. We keep an encrypted (AES-256-GCM) sign-in token for the duration of the migration, along with your folder names, message counts, and progress. Your messages pass through our transfer service straight to the new mailbox. We do not store them, and our logs record counts, not content.

No AI or machine-learning training. We do not use Google user data, raw or derived, to create, train, or improve any artificial intelligence or machine-learning model, whether ours or anyone else's, and we do not transfer it to anyone who does. We do not sell it, use it for advertising, or use it to build profiles or databases.

No language model is involved. We do not send anything from your Google account to an AI or language model: not message contents, subjects, senders, recipients, attachments, email addresses, credentials, or folder names. Each folder is matched to its place in the new mailbox (for example, "Sent Mail" to "Sent") by fixed rules in our own software, and a folder you created keeps the name you gave it.

Who can see it. Our staff do not read your mail. We can see a migration's status, folder names, and counts. We look at message content only with your specific permission to resolve a problem you raised, where necessary to investigate a security issue or abuse, or where the law requires it.

Who receives it. Only what the transfer needs: your new mailbox provider (MXroute), which receives your messages because you chose it as the destination; and the infrastructure providers that run the transfer and store the encrypted token for us (Amazon Web Services, Supabase, and Cloudflare). None of the AI services listed under AI services we use receives your Google user data. We make no other transfers except where the law requires it, to investigate security issues or abuse, or in a sale or merger of our business after you have agreed to it.

How long we keep it, and how to remove it. The sign-in token is kept only while a migration is in progress. When a migration finishes, is cancelled, or has sat unfinished or in error for 30 days, we ask Google to revoke the token and delete our copy; this runs hourly. You can also withdraw our access yourself at any time at myaccount.google.com/permissions. Folder names and counts stay with the migration record until you delete your data, which you can do on the data deletion page.

Limited Use. Jaybird Digital's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

AI services we use

We use third-party AI services to build and edit your website, run our assistant, translate and check your site, and review its quality. Those requests contain the content you give us for your website: your text, the images and files you upload, and what you ask for in chat. Below are the gateways we use and every company that has run an AI model for us through them. We do not run any AI model of our own, whether self-hosted or offline.

OpenRouter (openrouter.ai) is an AI model gateway, used on a paid pay-as-you-go account. Most of our requests use named OpenRouter presets, which are saved settings for which models may be used and which hosts may serve them. Our presets exclude any host that may train on prompts, and we have also switched off prompt training and input/output logging on our OpenRouter account. OpenRouter passes each request to a company that hosts the model. The models are made by Google (Gemini), Anthropic (Claude), OpenAI (GPT), Z.ai (GLM), and Moonshot AI (Kimi), and they change as better ones appear. Pictures we generate for you, such as a flyer image or a placeholder picture on a new website, are made by Meta (Muse Image) and Microsoft (MAI-Image) from the description you give.

Model hosts. Through OpenRouter, these companies have run models for us, and this is every host that has served any of our requests to date: Google Cloud (Vertex AI and AI Studio), Together AI, Modal, Microsoft Azure, Wafer, OpenAI, Sail Research, Crusoe, Decart, DigitalOcean, Friendli, Amazon Bedrock, Makora, Mistral, Alibaba, Parasail, Claude Platform on AWS, Phala, DeepInfra, Inceptron, Novita, StreamLake, Venice, Anthropic, and Meta. Which host serves a given request depends on price and availability, within the limits our presets set.

Cloudflare AI Gateway, on a paid Cloudflare Workers plan, sits in front of OpenRouter and reports usage and cost. If OpenRouter cannot be reached, a request can instead go to a backup route in our Cloudflare account, which uses Anthropic's Claude models.

Cloudflare Workers AI, on the same paid plan, runs open models on Cloudflare's own infrastructure, currently NVIDIA's Nemotron. We use it only as a last resort when the other routes cannot be reached.

Your Google user data and these services. No AI step receives anything derived from your Google account. Email migration does not use AI: your folders are matched by fixed rules in our own software, as described under Google user data. None of the AI services on this list receives your Google user data, and we do not use Google user data to train any AI or machine-learning model or send it to any service that does.

How we use information

We use your information to provide the service: to verify eligibility, generate and host your website, process payments, run the edits you request, and respond to support questions. We do not sell personal information.

Retention and deletion

We keep account and payment records for as long as needed to run the service and meet legal obligations. Mailbox sign-ins are revoked and discarded when a migration finishes, is cancelled, or is left unfinished for 30 days, as described under Google user data. You can ask us to delete your website and account data through your Jaybird Digital account.

Measuring our own ads

When you come to jaybirddigital.com from one of our ads on Google or on Meta (Facebook and Instagram), we keep the ad's click identifier in a cookie for up to 90 days. If you then create an account, or pay for a plan or an add-on, we tell the company whose ad you clicked that the click led to that sign-up or purchase, with its time, its amount and what was bought, so we can measure and improve our ads. Meta also requires the IP address and browser details from when you signed up, and we send it a scrambled form of your Jaybird account number that cannot be turned back into it. We never send your name, email address or website content. We do not use your data to show you ads elsewhere, and we do not let anyone else use it to.

Forms on the websites we host

The contact, sign-up and checkout forms on the websites we build and host for our customers are protected from automated spam by Google reCAPTCHA. When a visitor uses one of those forms, reCAPTCHA collects information about the visitor's device and browser and how the page is used, and sends it to Google, which uses it to tell people from automated programs. Google's Privacy Policy and Terms of Service apply to that check, and each form says so. A website whose owner uses their own reCAPTCHA key, or chose Cloudflare Turnstile instead, sends the same kind of information to that service. Each website's own privacy page names the check its forms use.

Websites started by an AI tool

An AI tool can start a website here for the person it is helping, without an account (see Have your AI tool start a website). For each one we keep the files the tool saves, the name and description it gives the website, the name the tool sends with its requests, and when it saved. We do not ask the tool for anything about the person it is helping, and pages there cannot ask visitors for passwords or card numbers. The internet address a request comes from is used only to limit how often it can call, and is not kept with the website. The pages are written by the AI tool, so anything they load from other services is the website's own, the same as on any page a person writes. A draft and everything in it is deleted 7 days after it starts unless the person keeps it by signing in, and the AI tool that started it can delete it at any time. Every draft shows a link to report it.

Sharing

We share information only with the services necessary to operate this platform — hosting, payment processing, the AI services listed under AI services we use, the form check on the websites we host (see Forms on the websites we host), and the mail provider you authorize during a migration — and only to the extent each requires. We do not sell your data or let others use it for advertising.

When our staff open your account

To help you, to look into something you reported, or to keep the service running, a member of our staff can open your account and your website's workspace the way you see them. Every time this happens it is recorded with who did it and when, and the record is shown to you in your account menu under Support access. Staff use this access only to support and run your service: they do not read your email (see above), and they do not change your published website without your approval, apart from the routine upgrades that keep every website secure and current and never touch your content.

Security

We use encrypted connections and restrict access to your data on a need-to-know basis. No online service is immune to every risk, but we take reasonable steps to protect what you trust us with.

Contact

Questions or requests about your data can be sent through your Jaybird Digital account. To delete your account and data, including anything received when you signed in with Facebook, Google, or GitHub, use the data deletion page. It works without signing in.

Effective November 2, 2026. Version 1.9 describes the websites an AI tool can start without an account, what is kept for them and when they are deleted. Version 1.8 says that creating an account needs only your name and email address: the billing address is collected when you pay, and registrant details when you buy a domain. Version 1.7 says that the forms on the websites we host are protected by Google reCAPTCHA. Version 1.6 describes when our staff can open your account and that you can see each time it happens. Version 1.5 adds Meta to how we measure our own ads. Version 1.4 adds how we measure our own ads on Google. Version 1.3 removes the one AI step that used Google folder names: email migration no longer uses AI. It also records that we no longer verify nonprofit status or ask for an EIN, and names the makers of the picture models we use. Version 1.2 added the list of AI services and model hosts we use. Version 1.1 added the Google user data section and updated how mailbox sign-ins are retained.