60sec.site

GDPR overview

The site carries exactly one GDPR statement, in a feature bullet on the chatbot page: Bank-grade encryption, GDPR compliance, and data privacy controls keep your information secure. Nothing backs it up. No privacy policy is published — thirteen candidate paths were probed and all returned 404, and neither the sitemap, the footer nor the signup form links to one. There is no data protection officer, no Article 27 representative, no subprocessor list, no retention period, no mention of transfers outside the European Union and no dedicated data protection address; the only email exposed anywhere on the site is a generic one. The publisher is registered in the United Kingdom, so it falls under the UK GDPR rather than the EU regulation. In practice, the level of documented GDPR implementation is close to nil, whatever the marketing bullet claims.

Who owns the data?

60sec.site publishes no terms of service and no privacy policy: a probe of thirteen likely paths returned 404, and neither the sitemap, the footer nor the signup form links to any legal document. Ownership of the sites, of the copy the AI generates and of the subscriber lists gathered through capture forms is therefore governed by no publicly readable contract. Nothing states whether the publisher claims any right over user content, what it may do with that content, or with whom it may share it. Anyone with a commercial or regulatory stake should request these terms in writing before signing up.

Reuse rights

With no published terms, there is no published rule on reuse. Nothing on the site grants or restricts the right to reuse the pages, the AI-written copy or the blog articles produced on the platform, and nothing says whether they may be repurposed elsewhere. The one adjacent and verifiable fact is that every plan includes an Export subscribers feature, so the email addresses collected through a site's capture form can be exported and used by their owner for marketing or communication. Beyond that, the reuse question can only be settled by asking the publisher directly.

Hosting summary

The site says nothing about data hosting. No jurisdiction, no country, no region and no subprocessor is named anywhere, and there is no privacy policy or terms of service in which to look; a search for SOC 2, ISO 27001, HIPAA or CCPA came back empty as well. What can be observed is purely technical: the domain resolves to 188.114.97.0, an anycast node on Cloudflare's network (AS13335). That is a content delivery point of presence, not a storage location, and it says nothing about where user data actually sits. Cloudflare is also the domain registrar, in the United States. The changelog notes that generated sites are served from faster CDN servers with better caching, without naming a provider. Payments run through Stripe, and the publisher is a company registered in the United Kingdom. The most precise security claim on the whole site is a feature bullet on the chatbot page — bank-grade encryption, GDPR compliance and data privacy controls — which names no mechanism and is backed by no document.