Terms of use

What this is about

These terms apply between you and Software & Automatisierung Kirner, Erlachstrasse 3, 3012 Bern, Switzerland (“sharepa”, “we”), as soon as you create an account or publish a page. By requesting the sign-in code you accept them. If you are under 16, you need your parents’ consent.

The privacy policy describes which data we process. It is part of these terms. The Annex on data processing governs what we do with the data of the visitors to your pages.

What sharepa does

sharepa turns an AI artifact (HTML or React, for example from Claude, ChatGPT or Gemini) into a website:

• You paste the code or upload it, sharepa builds a page from it and delivers it under an address such as name.sharepa.page.
• You can publish new versions, set a page password, see visits and connect your own domain to a page.
• If your page has a form, sharepa receives the entries. You see them in the app and can download them. More under Forms.
• With the one-time plan you can also send new entries to a webhook and take bookings through your Google Calendar. More under Webhook and Bookings.
• Preview and choosing an address need no account. An account is created when you publish.

We keep developing sharepa. Features can be added, change or disappear. What matters we announce 30 days in advance by email.

Free tier

sharepa is free, forever, with these limits:

• 3 pages per account, each under its sharepa address (name.sharepa.page)
• 1 page under your own domain (a subdomain of your domain, such as www.mysite.com)
• at most 30 new versions per day (fair use; if you need more, write to us)
• visits of the last 7 days visible
• forms: at most 50 entries per page and day and 200 per account in 30 days
• sharepa branding in the bottom right corner of every page: a small logo with a link to sharepa
• pages up to 5 MB of code

More pages, more domains and no branding come with the one-time plan. It has its own terms, which we show you before you buy. The free tier stays.

Your account

• Your email address is your account. You sign in with a code that we send you by email. Keep your mailbox safe, because whoever can read it can sign in to sharepa.
• One account per person. Variants of the same address (plus sign, dots at Gmail) do not make a second account. We do not allow disposable addresses.
• You are responsible for everything that is published through your account.

Your content

What you publish belongs to you. You only give us the right to store your code, build a page from it, deliver it, back it up and copy it for operation. This right ends when you delete the page or the account, apart from backups, which we delete within 30 days.

You confirm that you hold the necessary rights to your content and that it breaks no law. The following in particular are not allowed:

• phishing, fraud, deception about your own identity or imitating other people’s brands and websites
• malware, cryptomining, hidden redirects and anything that harms visitors or their devices
• content that infringes the rights of others: copyright, trademarks, personality rights
• content that is unlawful under Swiss law or under the law of the country the page is aimed at, such as depictions of violence, hatred against groups, depictions of sexual abuse
• collecting personal data of others without a legal basis and without the information that data protection law requires
• spam, creating pages or accounts in bulk and anything that circumvents the limits of the free tier
• services that use sharepa as pure file storage or as a redirect for other offerings

Forms

A page can contain a form that sends its entries to sharepa, a contact form or a sign-up for instance. sharepa stores the entries, shows them to you in the app, lets you download them as a file and sends you an email when new ones arrive. The email only states the number, never the content.

This is a letterbox, not a database: entries only go in. Your page cannot read them back, and visitors cannot sign in.

You are responsible. The people who fill in your form give their data to you, not to sharepa. You are the controller of this data within the meaning of data protection law, sharepa is your processor (see the Annex). You warrant that

• you collect the data for a permitted reason and use it only for that,
• you inform these people who you are and what happens to their data, for instance with a note and a link to your privacy policy next to the form,
• you answer requests from these people (information, deletion) yourself. You have the tools for this in the app: view, download, delete.

Not allowed are forms that ask for passwords or other credentials, credit card or other payment data, health data or other sensitive personal data. sharepa rejects entries with such fields as far as it recognises them; the responsibility stays with you.

Retention. We delete entries automatically after 12 months. Download them beforehand if you need them for longer. If you delete an entry, a page or your account, the entries disappear from the app immediately and from the backups after 30 days at the latest.

Limits. Once the limit of your plan is reached, the form accepts no more entries until the next day and shows visitors a note. You get an email about it. Forms without sign-in cannot be protected against false or automatically generated entries; sharepa filters what it recognises, but does not promise genuine or verified entries.

Webhook

With the one-time plan you can add a webhook address to a page, from n8n, Make or Zapier for instance. Every new entry on that page is then also sent to this address, with a signature that tells your service it comes from sharepa. If delivery fails, we retry several times over about 35 hours. If an entry still does not arrive, we tell you by email; it stays in the app.

You choose the service behind the address yourself. It works for you, not for sharepa. You are responsible for what it does with the data and where it stores it, and you conclude a data processing agreement with it yourself where data protection law requires one. Name it as a recipient in your privacy policy.

If a webhook keeps failing over a longer period, we pause it and tell you by email. If your page or account is blocked, we stop forwarding.

Bookings

With the one-time plan, visitors to your pages can book appointments with you. The feature is in beta and enabled on request. The following applies:

• You connect your own Google account. sharepa only sees when you are busy, adds booked appointments to your calendar and deletes them again when they are cancelled. sharepa does not read or change your other appointments.
• Your contract with Google applies to the appointment in your calendar. Google receives the details of the person booking, because the appointment with these details is in your calendar, and sends them an invitation.
• We store the details of the person booking as an entry, as described under Forms, with the same rules and periods. From us they get a confirmation with a cancellation link and a reminder before the appointment, with your email address as the reply address.
• You are the controller of these details. You inform the people who book with you in your privacy policy, including that Google receives the details.
• Whether an appointment takes place is between you and the person booking. For appointments that are missing, duplicated or entered incorrectly because of a disruption at Google or at sharepa, our liability follows the rules under Liability.

If you disconnect Google in the app or delete your account, we revoke access at Google and delete the access keys immediately.

Review and blocking

We do not review pages in advance, with one exception: when publishing, we compare the links on your page with Google Safe Browsing. If the page contains a known phishing or malware link, it does not go live but goes into review. You see this in the app and get an email, usually within a day.

If a page breaks these terms or the law, or if it is reported to us, we may block it. In the case of serious or repeated breaches we may block your account. We tell you the reason by email. If you think this is a mistake, write to konrad@getsharepa.ch. Blocked content stays stored until the page or the account is deleted, so that questions remain possible.

We do not look at pages with a password, not even during a review. Exception: a report about breaking the law or an order by an authority. Then we tell you by email when and why we looked at the page.

Availability

We operate sharepa with care, but give no guarantee of a particular availability. Maintenance, disruptions at our service providers or attacks can interrupt the service. We announce larger maintenance when we can. sharepa is no substitute for your own backup: keep the code of your artifacts.

Liability

sharepa is a free service. We are liable only for damage that we cause intentionally or through gross negligence, and for damage to life, body and health. For other damage, in particular lost profit, data loss or consequential damage, we are not liable, as far as the law allows. For content that you or other users publish, we are not liable.

If you break these terms and third-party claims or costs arise for us as a result, you indemnify us against them. This applies in particular to claims by people whose data you collected through a form, and by authorities because of this data.

Term and termination

• You: at any time, by deleting your account in the app under “Account”. This deletes all pages and connected addresses. It cannot be undone.
• We: immediately in the case of breaches of these terms, otherwise with a notice period of 30 days by email, for instance if we discontinue sharepa. In that case you have 30 days to copy your code out of the app.

Changes to these terms

We may change these terms, for instance when new features or paid plans are added. We announce changes 30 days in advance by email. If you keep using sharepa afterwards, the new terms apply. If you do not agree, you can delete your account beforehand.

Law and place of jurisdiction

Swiss law applies. The place of jurisdiction is Bern. If you are a consumer, the mandatory rights at your place of residence remain, including the place of jurisdiction there.

Should a provision of these terms be invalid, the remaining ones continue to apply.

Annex: Data processing

This annex governs the processing on behalf of a controller under Art. 9 FADP and Art. 28 GDPR. It applies automatically together with the terms of use, you do not have to sign anything.

For your records: Data processing agreement as PDF

Roles

For the data of the visitors to your pages you are the controller. sharepa is your processor and processes this data only on your instructions and in accordance with this annex.

Subject matter and duration

The subject matter is the delivery of your pages, the password protection, the counting of visits, the storage of your content, the receiving, storing and providing of form entries, the taking of bookings including a confirmation and a reminder to the person booking, and the passing on of entries and bookings to Google and to your webhook where you have set this up. The processing lasts as long as your page exists and ends when the page or the account is deleted. We delete form entries after 12 months at the latest.

Type of data and data subjects

The data subjects are the visitors to your pages, the people who fill in your forms and the people who book an appointment with you. Processed are: the IP address (transient, through Cloudflare for delivery; not stored), country, device type, referring website, campaign word from the address and bot detection including the network number (for the counting, without an identifier; the network number is not stored), an access cookie in the case of password protection (without personal data), all content that you put into your page, and the form entries: the fields your form asks for, the time and the name of the form. For a booking these are the name, email address, phone number (only if phone is chosen as the location) and the answers to your page’s questions; for the booking itself we keep the appointment type, page, time, location, status and the identifier of the appointment at Google, without personal data. With an entry we store neither IP address nor country nor device. Sensitive personal data, credentials and payment data are excluded (see Forms).

Instructions

You give your instructions through the app or a connected AI app: publish, new version, set or remove a password, connect or disconnect a domain, delete, view, download and delete form entries, connect or disconnect Google Calendar, create appointment types and assign them to pages, cancel appointments, set up, change, test or remove a webhook. Which fields your form asks for, you determine with the code you publish. We need no further instructions. If we consider an instruction unlawful, we tell you.

Passing on data on your instruction

If you have connected Google, we enter every booking with the details of the person booking into your Google Calendar. If you have set up a webhook, we send every new entry to its address. Google and the service behind your webhook are not sub-processors of sharepa: you choose them yourself, and your own contract with them applies. We pass the data on to them because you set it up that way, and only until you disconnect or remove the webhook.

Confidentiality and security

Only the owner of sharepa has access to the data, and only as far as it is necessary for operation, support and abuse review. Technical and organisational measures:

• encrypted transmission (HTTPS) for all pages, the app and the interfaces
• page passwords stored encrypted, sign-in only by email code, sessions as a hash
• storage and backups exclusively in data centres in the EU
• nightly backups, deleted after 30 days
• limiting of requests per IP address against abuse
• no storage of visitors’ IP addresses
• form entries: visible only through your account, no content in emails, every download is logged (account, page, time, number), accepted only from the page itself and with upper limits for size and number
• access keys for Google and the address and signing key of webhooks additionally encrypted with AES-256-GCM; the key for this exists only in the runtime environment, never in the database or the code
• access to Google with two permissions only: see free or busy, create and delete its own appointments
• every booking only after a check by Cloudflare Turnstile that a human is booking

Sub-processors

We use Cloudflare, Inc. (USA, data location EU, Data Privacy Framework, standard contractual clauses) for hosting, storage, delivery, counting, email and bot checks (Turnstile). Further sub-processors or a change we announce 30 days in advance by email. If you do not agree, you can delete your page or your account.

Support

If a visitor to your page approaches you with a data protection matter, we support you as far as we can contribute anything. Apart from form entries we store no visitor data. For entries you have the tools yourself in the app: view, download as a file (information, handover) and delete. If a data subject approaches us, we refer them to you. If we discover a breach of data security that affects your pages, we inform you within 72 hours by email.

Deletion and evidence

If you delete a page, it is immediately no longer reachable and is deleted for good after 30 days, together with its form entries. If you delete your account, that applies to all pages. Individual entries that you delete are gone immediately and stay in the backups for 30 days at most. If you disconnect Google, we revoke access and delete the access keys immediately. The delivery status of your webhook (time, attempts, result) we delete after 30 days. Booking details without personal data stay for the statistics until you delete the page or the account. On request we confirm the deletion to you and give information about the measures in place, so that you can demonstrate compliance with your obligations.