Privacy
What we store, why we store it, and how long it stays.
Updated 8 October 2026.
Who is responsible
Solta is run by Concealed, Unipessoal Lda, Rua da Fonte, nº13, Toledo, 2530-781 Vimeiro LNH, Portugal, registration and tax number 514 292 695. For what this page describes, it is the controller under the GDPR. Write to legal@solta.now about anything here, including your rights. No data protection officer has been appointed; that address reaches the people who decide.
Why, and on what basis
- Your account, what you publish, comments, and sending you sign-in links and the emails a feature needs: to provide the service you asked for (Article 6(1)(b) GDPR).
- Checking uploads, rate limits, handling reports, and keeping Solta secure: our legitimate interest in a service that is safe to use (Article 6(1)(f)), and the duties the Digital Services Act puts on a host (Article 6(1)(c)).
- Payments: Stripe sells the plans, as merchant of record, and is responsible for the payment data it collects. We keep which plan you are on and the Stripe customer it is billed to.
- Counting visits to solta.now’s own pages: your consent, below.
Solta is for people aged 16 and over.
If you have an account
Your email address, because that is how you sign in — there is no password to store. Your display name and picture, if you set them. What you have published, and its history.
If you use Describe it to have Solta build a site, what you describe is sent to Anthropic, whose model builds the site, and so are the changes you then ask for in the site’s chat, with the site’s code. That is on Solta’s own Anthropic account, which does not use it to train models. We keep your description only until the site is made; the site itself is yours like anything you publish. We also keep how many of your free prompts you have used and what each one cost us, which is how we pay for them and keep them free. So that new accounts are not a way to get more, we also count the free prompts used from each network on each day, under a keyed hash of its IP address (for IPv6, of its first half) that cannot be turned back into the address. Those counts are deleted after 30 days.
If you publish without one
The file, and a one-time link that lets you claim it. It disappears after 24 hours unless claimed. We keep no account for you. If you said yes to counting on solta.now (below), we also keep that browser’s DataFast identifier with the site, so that claiming it can be counted as the end of that visit. It goes when the site is claimed or expires, or when that browser says no.
If you open somebody’s site
We count the visit — the site, the day, roughly where in the world, and roughly what kind of device. Not who you are. IP addresses are hashed with a rotating salt for rate limiting and abuse handling, and the hash is not reversible into an address. We also count which website a visitor came from (only its domain, like linkedin.com), so a site’s owner can see where its visitors come from.
What a site’s owner sees are daily totals, each counted one way at a time: by country (from the country Cloudflare reports for the connection), by kind of device (phone, tablet or computer), by browser family (like Chrome or Safari) and operating system family (like iOS or Windows), by the page opened, by the website you came from, and by the website that embedded the site, if one did — its domain only. The browser and system come from your browser’s user agent, reduced to a family name as the visit is counted, never a version. We store no IP address and no user agent for this, and no row about any one visit: only how many views and visitors each of those had on each day.
If a site asks for your email before it opens, or to save your data on Solta, its owner sees that email and when you opened the site; we keep it for them, as their processor, until they delete it or the site. If the site’s owner chose to verify addresses, we email yours a one-time code first and don’t add it to the owner’s list until the code is used; the owner then sees that the address was verified.
No advertising, and no tracking across sites. A site you publish, and every embed of it, is served from its own hostname and sets no cookie of ours at all — no analytics cookie, and no other — unless it calls an AI model or you connect your own AI there, below. DataFast, below, never runs there. The one thing that can reach it from a published site is the site’s address: when somebody who has said yes on solta.now arrives there by a link on a site served from its owner’s own domain, DataFast sees that domain as the page they came from, as it would any other website’s.
If you visit solta.now
Solta’s own pages — the home page, pricing, security, the changelog, the blog, the templates, these legal pages, and the docs, /new and the sign-in page while you are signed out — are counted with DataFast, and only if you say yes when we ask. It is how we learn what brings people to Solta. It never runs on a published site, on a customer’s domain, in an embed, in your library or in your settings.
If you accept, DataFast’s script sets four cookies on solta.now: datafast_visitor_id, a random identifier for this browser, and two counters of when it first saw you and how many visits you have made, each for a year; and datafast_session_id, for thirty minutes. With each page it sends DataFast the page’s address, the page you came from, your browser’s language and time zone, and the size of your screen and window, and it sends which of the main buttons you press (publishing, pricing, signing in, the docs), how far down the home page and the price list you read, and that the browser extension handed a file to /new — never the file. Your browser sends its user agent and your IP address with every request, and DataFast works out roughly where you are from the address.
To that identifier our servers add the moments only they can see. These, and no others:
- a sign-in link sent, or Google or GitHub asked for
- an account made
- a workspace made
- a site's embed code copied by somebody who may change the site
- a site published without an account
- a site published from an account
- a site published through a connection, such as Claude, ChatGPT or an API key
- a publish that failed
- a new version of a site saved
- a site claimed
- a claim link that no longer worked
- a version made live
- one of Solta's templates remixed
- somebody invited to a workspace
- an invitation to a workspace accepted
- people invited to open a site
- who can open a site changed
- a domain added
- a domain going live
- comments turned on or off
- approval before publishing turned on or off
- where a site may be embedded changed
- a webhook or Slack connected
- an AI provider's key added to a site
- a site's form answers downloaded
- an API key made
- an app such as Claude or ChatGPT connected
- asking to hear when a failed publish is fixed
- a checkout opened
- a checkout that could not open
- a plan paid for
- a plan ended
Each carries only details that identify nobody, such as the plan, the way it was published, or a count in a range like 2–5. When you sign in, claim a site or accept an invitation, we tell DataFast your account’s internal identifier, a random string, so that the browsers you use count as one person. We keep the DataFast identifier on your account, and on a site published without an account until it is claimed or expires. A moment with no browser in front of us — a site published through a connection or an API key, a payment Stripe confirms, a domain going live — is counted against the identifier kept on your account, which is there only after a yes. With none of this do we send an email address, a name, a site’s title or address, a hostname, or anything typed into a form.
When you start a checkout, the Stripe payment session carries the same identifier. If Solta has connected its Stripe account to DataFast, DataFast reads each payment to Solta there — the amount and, as Stripe holds them, the payer’s email and name — and uses that identifier to tell which visit led to it.
We also count known crawlers on the same pages — search engines and the crawlers of AI assistants, which run no script — from our server. Only a request that names itself as a known crawler is sent, so this never sends a person’s visit. What is sent is the address asked for, the page it came from, its user agent, its IP address, and DataFast’s classification of it. A crawler is not asked, because it is not a person.
We remember your answer in a cookie of our own, solta_consent, for six months. It is strictly necessary — it is the answer — so it needs no consent of its own. The legal basis for everything else in this section is your consent (Article 6(1)(a) GDPR, and Article 5(3) of the ePrivacy Directive as Portugal’s Law 41/2004 applies it). Refusing is as easy as accepting, and you can change your answer at any time under “Cookies” at the foot of Solta’s pages. Saying no, the first time or later, deletes DataFast’s cookies from this browser, stops the script at once if it was running, and tells our servers, which then send nothing for this browser and forget the identifier kept on your account, if you are signed in here, and on any site this browser published without one. If you say no in a browser where you are not signed in, the identifier on your account stays until you are signed in on a browser that has said no, or you delete the account; until then, the moments with no browser in front of us are still counted against it.
If a site asks you for answers
A site can have a form, or send what you type to an AI model. Then the site’s owner decides what is collected and why, and is the controller of it; we keep it for them, as their processor, and do nothing else with it. Answers are kept for as long as the owner chose for that form — 30 days, a year, or until they delete them — and then deleted. What you type into an AI feature is sent to the model provider the owner chose, with the owner’s own key, and is not kept by us. Ask the site’s owner first about what they hold; if you cannot reach them, write to us.
Data a site saves on Solta is kept for that site’s owner and deleted with the site, or when you ask the owner.
Some sites let you bring your own AI instead, through OpenRouter. If you connect, OpenRouter creates a key on your OpenRouter account, with the spending limit you choose there, and hands it to us. We keep it encrypted, use it only for that one site’s calls, and delete it when you disconnect, when the site’s owner turns the feature off, or after 90 days unused. Your browser keeps a cookie on that site’s address, __Host-solta_ai, which names the connection and not the key, for up to 90 days. What you type there goes to OpenRouter, and through it to the model it routes to, under your own OpenRouter account and its terms; we do not keep it. You can revoke the key itself in your OpenRouter settings at any time.
When a site calls an AI model, whoever pays for it, the first call sets one cookie on the site’s address, __Host-solta_aiv: a random number, kept for a day, that only counts how many calls this browser makes in an hour, so the site’s owner can limit them. It names nobody, and nothing is kept against it.
If you comment
Your email address, so the owner knows who said it and you can be told about a reply. You do not need an account to comment, and you never will.
What you write, and the name shown with it, is emailed to the site's owner and to the others in the conversation, who are emailed in the same way when they reply to you; your address is never in those emails. Each one has a link to stop them. If the owner has connected Slack or a webhook of their own and asked to be told about comments, your comment and name go there too, never your address.
If you contact support
We get what you wrote, what it is about, your account, plan and browser, the page you wrote from, and the workspace and site if you named one, by email and in our team’s Slack, which never sees your email address. We reply to the address you signed in with. We keep your message, seen only by our staff, until 12 months after we resolve it, and then delete it; deleting your account deletes it sooner. A screenshot you send is kept for 30 days, seen only by our staff, and then deleted.
Who else sees it
The companies listed on sub-processors and nobody else. We do not sell anything to anyone. Files you publish are read by an automated moderation check before they are served; a small number reach a person for review, and only those. DataFast, on that list, measures Solta’s own pages on our behalf, and does not use what it counts for anybody else.
How long
Published work stays until you delete it. Visit counts are kept in aggregate and the per-visit rows are dropped after 30 days. The daily totals behind a site’s analytics contain no personal data and are kept for as long as the site is. When you delete your account, everything you published stops serving immediately and is purged within 30 days, with backups ageing out after that. A record of which comment emails went to which address is kept for 90 days, so their unsubscribe links keep working, and then deleted.
DataFast’s cookies last a year, the session one thirty minutes, and our answer cookie six months. The DataFast identifier we keep on your account goes when you say no while signed in, or when the account goes; the one on a site published without an account goes when the site is claimed or expires, or when the browser that published it says no. What has already been sent stays with DataFast: the visits and moments it counted, and which identifiers it was told are your account. Its terms set no period for that: they say it may be “retained longer to provide historical analytics”, and that we can ask for it to be deleted at any time. A Stripe payment session keeps the identifier it carried for as long as Stripe keeps the payment’s record.
Your rights
You can export everything you have published, at any time, without asking us. You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it — and deleting your account does the last one without a conversation. The DataFast identifier we keep on your account is in your account’s export, and we will ask DataFast to delete what it holds about your visits if you ask us to.
Data is stored in the European Union, with the exceptions named on the sub-processors page. DataFast is one: it is JustShipIt Pte. Ltd., a company under Singapore law, with most of its infrastructure outside the European Union, including in the United States, and it relies on its own sub-processors’ standard contractual clauses for what leaves the EU. If you are in the EU or UK you can complain to your supervisory authority — in Portugal, the CNPD — and we would rather you told us first.