Legal terms for the Hatchwell service
These are the four documents that govern a Hatchwell workspace. They are written as template terms for a landing page kit and a lawyer has to review them before any real launch. Last reviewed 4 September 2026.
Terms of service
Every Hatchwell plan runs month to month and either side can end it from the billing screen without a phone call. The 14 day trial takes no card, and when it ends the page keeps serving on a hatchwell.page subdomain until you add a card or export.
You keep ownership of the copy, images and code you upload. Hatchwell holds a licence to store and serve that material for as long as you keep the workspace open, and for 90 days afterwards so that an export stays available.
Hatchwell may suspend a workspace that publishes material which breaks a store review guideline, infringes a third-party right, or drives automated traffic through the install-tracking endpoints. Notice goes out by email before a suspension unless the matter is a live security incident.
Privacy policy
Hatchwell collects the account details you enter, the pages you build, and the install and session events that pages you publish send back. Install and session events are stored in eu-west-1, encrypted at rest with AES-256 and in transit with TLS 1.3.
Only members you invite to the workspace can read your event data, with role-based access on every plan. Hatchwell is not an ad network. Event data is never sold or shared, and no third-party tracker is injected into a page you publish.
You can request an export or a deletion of everything held for your workspace by writing to privacy@hatchwell.com. An export arrives within 7 days and a deletion completes within 30 days, subject to the invoice records that tax law requires be kept.
Data processing terms
For install and session events, the workspace owner is the controller and Hatchwell is the processor. Hatchwell processes that data only on documented instructions from the controller, which are the settings chosen inside the workspace.
Everyone at Hatchwell with production access is under a written confidentiality duty. Access is granted by role, reviewed each quarter, and logged. Production access requires hardware key authentication.
Hatchwell notifies the controller of a personal data breach without undue delay and within 72 hours of becoming aware of it. Transfers outside the EEA rely on the Standard Contractual Clauses, and the subprocessor list below records where each one sits.
Subprocessors
Amazon Web Services, Ireland, hosts the application and the event store in eu-west-1.
Cloudflare, United States, serves published pages and terminates TLS at the edge.
Stripe, United States and Ireland, processes card payments and stores billing records.
Postmark, United States, delivers transactional email such as invites and password resets.
A controller who objects to a new subprocessor has 30 days from the change notice to raise it, and may end the plan without penalty if the objection cannot be resolved.