Squarespace Privacy Policy

This document is Squarespace's privacy policy governing the collection, use, storage, and sharing of personal information from users of Squarespace's website-building platform, e-commerce tools, and related services, with a stated legal basis rooted in contractual necessity, legitimate interests, consent, and legal obligation depending on the processing activity. The policy states that Squarespace collects identifiers such as name, email, and payment information; behavioral data including browsing and usage patterns; device and location data; and content uploaded by users, and the terms authorize sharing this data with service providers, business partners, advertising networks, and in the context of corporate transactions such as mergers or acquisitions. The policy's dual-role structure, in which Squarespace acts as both a data controller for its own users and a data processor for website visitors whose data is handled on behalf of Squarespace customers, is operationally distinct and creates layered compliance obligations that may not be immediately apparent to end users. The policy engages GDPR for EU/EEA users, CCPA and CPRA for California residents, and UK data protection law, with Squarespace identifying Ireland as its EU establishment and offering region-specific rights including access, deletion, portability, and objection; compliance exposure is heightened for EU and California users given the dual-controller/processor structure and the breadth of third-party data sharing described. Squarespace's use of standard contractual clauses for international data transfers and its reliance on opt-out rather than opt-in consent for certain marketing and analytics activities may require evaluation under applicable regulatory guidance, particularly for EU users.