Privacy Policy
Last updated: 9 September 2026
FrameRewind is a backup and restore plugin for the Framer CMS, operated by MDB Next ("we"). This policy explains what we store, why, for how long, and how to get it removed. Questions: support@framerewind.com.
What we store
- Account and billing data. Your e-mail address, a Stripe customer identifier, your subscription status and plan. Card details are handled by Stripe and never reach our servers.
- Connected sites. The Framer project identifier, an optional display name and your Framer Server API key.
- CMS snapshots. The content of the CMS collections you choose to back up: fields, items, slugs and draft status, plus metadata such as timestamps and item counts. Images and files are stored as the URLs Framer returns, not as copies of the files themselves.
- Operational logs. Errors and job results needed to run the service. When you submit the license recovery form, the address you type and your IP address are stored only as SHA-256 hashes, never as the values themselves, and are used solely to rate limit that form. Starting a checkout records your IP address the same way, as a hash, for the same reason.
How your Framer API key is protected
You enter your Framer Server API key on framerewind.com, not in the plugin: it travels from your own browser straight to our servers, and the plugin never receives it. It is encrypted with AES-256-GCM before it is written to the database, using a key held only in the server environment, so it is never stored in readable form, never shown back to you in full, and never sent to third parties other than Framer itself when a backup or restore runs. Passwords are not stored at all: FrameRewind has no password login, it uses a license key.
How long we keep it
- Snapshots: retention follows your plan. Free 7 days, Pro 90 days, Agency 365 days. Expired snapshots are deleted automatically, content and metadata together.
- Connected sites and account data: for as long as your account exists.
- Rate limiting hashes: deleted one hour after the attempt.
- Billing records: retained by Stripe under their own policy, and by us where required for accounting obligations.
We send transactional e-mail only: your license key after checkout, and a re-send when you request it through the recovery page. These messages are delivered through Brevo (Sendinblue SAS), which processes your e-mail address on our behalf. We do not send marketing e-mail and do not add you to any mailing list.
Analytics
We use Vercel Web Analytics to see how many people visit this site and which pages they read. It counts page views and Core Web Vitals (load and responsiveness) without cookies and without a cross-site identifier: Vercel derives a temporary, salted, non-reversible hash from your IP address and browser to avoid counting the same visit twice within a day, then discards the IP address and hash. We only ever see aggregated numbers, never a record tied to you. This applies to framerewind.com; the plugin itself is not analysed this way.
Who else processes your data
- Supabase (database and file storage, EU region)
- Vercel (application hosting and web analytics)
- Stripe (payments and subscription management)
- Brevo (transactional e-mail)
- Framer (the source of your CMS content, accessed with your API key)
We do not sell your data and we do not use it to train models.
If you are backing up sites you run for clients, you are the controller of the content in them and we process it on your behalf. The terms for that are in the data processing agreement, which applies to every paid plan without anything to sign. It also names each subprocessor above and how we announce changes.
Your rights
You can request access to your data, correction, export or deletion at any time by e-mailing support@framerewind.com from the address on your subscription. We respond within 30 days. Deletion removes your snapshots, their stored content, your connected sites, the encrypted Framer API keys we hold, and your e-mail address from our records; your licence key stops working immediately. The only thing kept is the billing record we are legally required to retain: the Stripe customer reference and the subscription history, which contain no snapshot content, no API keys and no e-mail address. You can also delete individual snapshots yourself in the plugin, and disconnecting a site removes its stored API key.
Cancelling
Cancelling through the Stripe customer portal keeps your plan running until the end of the period you paid for. When it ends we e-mail you a link where you choose what happens: keep the account on the Free plan, or have everything deleted. If you choose deletion, you confirm it on that page first, and it cannot be undone. If you choose nothing within 30 days we fall back to the Free plan and delete nothing, after which Free retention applies and older snapshots age out on their own. You can also e-mail us to have everything removed sooner.
Changes
If this policy changes materially, we will update this page and note the date above. Contact for all privacy matters: support@framerewind.com.