Privacy Policy

Last updated: 5 August 2026. This policy explains what personal data Illustrious collects, why, how long we keep it, and who else can see it. It covers the Illustrious dashboard at dashboard.illustrious.cloud, the Illustrious API, and websites we host on behalf of our customers.

Who we are

Illustrious Online ("Illustrious", "we") provides website hosting, enquiry handling and search-visibility tooling for small businesses. For privacy questions, contact nick@illustrious.online.

What we collect

Account data. When you create an account we store your name and email address. If you sign in with GitHub, Google or Discord, we receive your name, email address and a provider account identifier from them. We do not receive or store your password for those services. Organisation data. The name of your organisation, its members, and each member's role. Site content. The pages, text, images and settings you configure for a website we host for you. This is content you author, and it is published publicly by design. Enquiries. When someone submits a contact form on a website we host, we store the name, email address, phone number, selected service and message they provided, and make it available to the organisation that owns the site. Billing data. Subscription and payment processing is handled by Stripe. We store an identifier linking your organisation to its Stripe records. We do not store card numbers. Technical data. Server logs and error diagnostics, used to keep the service running and to investigate faults.

Google user data

If you choose to connect a Google account for search-visibility features, we request access to Google Search Console using the Search Console scope (https://www.googleapis.com/auth/webmasters), plus your email address and basic profile so we can label the connection. What we do with it. We read performance data for the Search Console property you select — search queries, pages, clicks, impressions, click-through rate, average position and dates — and store it so we can show you history beyond the sixteen months Google retains. We also read the list of properties your account can access, so you can choose one, and we submit your sitemap to Search Console when you publish your site. What we store, and how. Your Google refresh token is encrypted at rest using AES-256-GCM. It is never returned by any part of our interface, never written to logs — including error logs — and is used only to obtain short-lived access tokens for the purposes described above. Revoking access. Disconnecting the Google account in the dashboard revokes the token with Google and deletes our copy. You can also revoke access directly at myaccount.google.com/permissions. Limited Use. Illustrious's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties except as necessary to provide the features you asked for, and we do not allow humans to read it except with your explicit consent, where required for security or to comply with the law.

How we use your data

We use the data above to operate the service: to authenticate you, to publish and serve your website, to deliver enquiries to you, to produce the reporting you asked for, to bill you, and to keep the platform secure and working. We do not sell personal data, and we do not use it to build advertising profiles.

Who else processes your data

We rely on a small number of service providers, each handling data only to provide their part of the service: DigitalOcean — application hosting and databases (United States). Hetzner — compute for customer environments where used. Resend and Amazon SES — delivery of transactional email such as enquiry notifications. Stripe — subscription billing and payment processing. Sentry — error diagnostics. Google — Search Console data, where you have connected an account. We may also disclose data where we are legally required to.

How long we keep it

Account and organisation data is kept while your account is open. Enquiries and stored Search Console metrics are kept while the organisation that owns them exists, so that history remains available to you. When you close an account or disconnect a Google account, the associated credentials are revoked and deleted. Backups are retained for a limited period and then overwritten.

Security

Traffic to our services is encrypted in transit with TLS. Third-party credentials, such as Google refresh tokens, are encrypted at rest with a key held separately from the database. Access to production systems is restricted. No system is perfectly secure, and we will tell you promptly if a breach affects your data.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Depending on where you live you may have further rights, including the right to object to certain processing or to complain to a data protection authority. Email nick@illustrious.online and we will respond.

Children

Illustrious is a service for businesses and is not directed at children. We do not knowingly collect personal data from children.

Changes to this policy

If we change this policy we will update the date at the top of this page. Where a change materially affects how we handle your data, we will tell account holders directly.