Effective date: May 24, 2026
Last updated: May 24, 2026
This Privacy Policy describes how Hermes ("Hermes", "we", "us", or "our") collects, uses, discloses, and protects personal data when you visit our marketing site (designwithhermes.com), sign up for an Account, use the Hermes website-builder platform (the "Service"), or otherwise interact with us. It also explains your rights and how to exercise them.
This Policy is incorporated into our Terms of Service. Capitalized terms not defined here have the meaning given in the Terms.
Hermes operates the Service. For the purposes of GDPR, UK GDPR, and similar laws, Hermes is the controller of personal data we collect about visitors to our marketing site, prospective customers, Customers (as account holders), and our own employees and contractors.
Where you use the Service to operate websites or manage End Users (including your clients in white-label scenarios), you are the controller of personal data of those End Users, and we act as your processor. The processing of End User data on your behalf is governed by Section 13 (Customers as Controllers) and any Data Processing Addendum we make available.
You can contact us at hi@designwithhermes.com.
We collect the following categories of personal data:
We use personal data for the following purposes:
| Purpose | Examples | Legal basis (GDPR/UK GDPR) |
|---|---|---|
| Provide the Service | Create your Account, host your sites, deliver requested features, render AI Output | Performance of a contract |
| Billing and accounting | Process payments, issue invoices, calculate tax, prevent fraud | Performance of a contract; legal obligation; legitimate interest in fraud prevention |
| Service operations | Backups, monitoring, debugging, customer support | Performance of a contract; legitimate interest |
| Security | Detect and prevent attacks, abuse, account takeover | Legitimate interest; legal obligation |
| Product improvement | Usage analytics, feature performance, A/B testing on de-identified data | Legitimate interest |
| Communications | Service messages, security alerts, policy updates | Performance of a contract; legitimate interest |
| Marketing | Newsletters, product announcements, promotional offers | Consent; legitimate interest (existing customers, with opt-out) |
| Compliance | Tax reporting, responding to lawful requests, exercising legal claims | Legal obligation; legitimate interest |
Where we rely on legitimate interests, you may object as described in Section 9. Where we rely on consent (e.g., marketing emails, optional cookies), you may withdraw consent at any time without affecting prior processing.
The Service includes AI tools for content generation. Prompts you submit and outputs we return are processed in order to deliver the feature, log requests for security and abuse prevention, and improve quality. We do not use Customer Content to train third-party foundation models without your instruction. Some AI features depend on third-party model providers; we contractually require those providers not to use Customer Content to train their general models, where the provider supports such terms.
We and our partners use cookies, pixels, SDKs, and similar technologies. See our Cookie Policy for details and how to manage them.
We do not sell personal data. We share it only as described in this Policy:
A current list of significant sub-processors is available on request at hi@designwithhermes.com.
We are based in the United States, and our infrastructure and providers may be located in or accessed from countries other than yours. Where personal data is transferred from the European Economic Area, the United Kingdom, or Switzerland to a country that has not received an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (with the UK Addendum where applicable), supplementary measures where appropriate, or other lawful transfer mechanisms. You can request a copy of the transfer mechanism we rely on by contacting us.
Depending on where you live, you may have the following rights with respect to your personal data:
To exercise any of these rights, email hi@designwithhermes.com. We may need to verify your identity before responding. We will respond within the time required by applicable law (typically 30 days, extendable in complex cases).
If you are a California resident, you have the rights to know, delete, correct, and limit the use and disclosure of sensitive personal information, and to opt out of "sale" or "sharing" of personal information. We do not sell personal information and we do not share it for cross-context behavioral advertising. You may exercise rights by emailing hi@designwithhermes.com. We will not discriminate against you for exercising these rights.
Categories of personal information we have collected in the past 12 months align with Section 3 above. Categories of recipients are described in Section 7. We retain personal information for the periods described in Section 12.
Residents of Virginia, Colorado, Connecticut, Utah, Texas, and other states with comprehensive privacy laws may have rights similar to those described in Section 9. To exercise them, contact us at hi@designwithhermes.com. You may have a right to appeal a refusal of a request; the appeal contact is the same email.
We keep personal data for as long as needed for the purposes described in this Policy, or longer where required by law. Typical retention periods:
When you use the Service to manage personal data of End Users (your visitors, contacts, or clients), you are the controller and we are the processor. We will:
If you require a signed Data Processing Addendum (DPA), email hi@designwithhermes.com and we will provide one.
We implement administrative, technical, and physical safeguards to protect personal data, including encryption in transit (TLS) and at rest, hardened cloud infrastructure on AWS, role-based access controls, audit logging, secret management, periodic vulnerability scanning, and incident-response procedures. No system is perfectly secure; we cannot guarantee absolute security and you provide data at your own risk.
If we become aware of a personal data breach, we will notify affected Customers without undue delay and, where required, the relevant supervisory authority within the timelines mandated by law.
The Service is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
We honor opt-out preference signals (such as Global Privacy Control / GPC) where required by law. Browser "Do Not Track" signals are not consistently defined; we treat GPC as a CCPA opt-out signal for the browser session in which it is detected.
If you opt in (or where allowed by law for existing customers), we may send you product updates and offers. You can unsubscribe at any time using the link in our emails or by emailing hi@designwithhermes.com. We will continue to send transactional and security messages.
We may update this Policy from time to time. We will post the updated Policy with a new "Last updated" date and, for material changes, give reasonable notice (e.g., email or in-app notice) before they take effect.
If you have questions about this Policy, want to exercise rights, or wish to file a complaint, contact us at hi@designwithhermes.com.