Privacy Policy

1. Data Controller

The data controller responsible for webblitz.ai is:

2. How webblitz.ai Works — Outside-In

webblitz.ai measures your brand's visibility in AI answers from the outside: we analyze publicly available AI responses and publicly available web pages. No feature requires access to your internal systems — we do not connect to your CRM, your shop backend, or your web analytics. Optional connections (currently Slack and Google Search Console) are granted by you, individually, per workspace, read-only, and can be disconnected at any time. Connecting Search Console lets us read your own performance data for your own pages; nothing about it is required to use webblitz.ai.

3. What Data We Process

• Account data: Email address, display name, and optional profile picture, provided during registration via Firebase Authentication. If you invite collaborators, we process the email addresses you invite.
• Public web content: Publicly available content from URLs you submit for analysis (page text, meta data, headings). We do not access private or authenticated pages.
• AI answer data: Responses from AI platforms to tracking prompts we run about your brand, including full answer texts, citations, sentiment, and competitor mentions. Public AI answers and web pages can contain names of people who are publicly mentioned there (e.g. founders or authors); we use this data solely for visibility measurement and do not enrich it. If you are one of these individuals, see our dedicated notice for individuals in analyzed content.
• Content you provide: Chat messages to the agent (web, email replies, connected Slack), uploaded documents and images and the text extracted from them, brand assets, customer cases, and author profiles.
• Generated content: Article drafts, briefs, and recommendations created for your workspace.
• Usage and technical data: Feature usage counts for plan limits, email delivery logs, and IP addresses used solely as rate-limiting keys (deleted after 48 hours).
• Billing references: Customer and subscription identifiers from our payment provider. We never receive or store card or bank details.

4. Legal Basis (GDPR Art. 6)

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the webblitz.ai service.
• Legitimate interest (Art. 6(1)(f)): Security measures, abuse prevention, and error tracking.
• Consent (Art. 6(1)(a)): Product analytics (PostHog — loads only after you accept the cookie banner) and optional email reports. You can withdraw consent at any time.

5. Recipients of Data

We use the following processors and recipients (last reviewed 2026-08-20). Where providers process data outside the EU, transfers are safeguarded by EU Standard Contractual Clauses and, where certified, the EU-US Data Privacy Framework.

Subprocessors

Opt-in channels (connected by you)

Independent controllers

Recipients without personal data

6. Cookies & Analytics

• We use strictly necessary cookies for login sessions and language preference.
• We use one optional product-analytics tool, PostHog, hosted in the EU. It loads only after you accept the cookie banner; declining keeps the site fully functional. After acceptance, PostHog receives usage events and, for logged-in users, email and name.
• We do not use advertising or ad-tracking scripts.
• We do not sell, rent, or share your data with advertisers.
• We do not use your data to train AI models.

7. Data Storage & Security

Application and database run in the Google Cloud region europe-west1 (Belgium): PostgreSQL on Cloud SQL with encryption at rest and TLS in transit, plus a non-public file store served only through access-checked application routes. Database backups are retained for 7 days — deleted data leaves backups after at most 7 days.

Credentials for channels you connect (e.g. Slack) are additionally encrypted at the application layer with AES-256-GCM and cryptographically bound to your workspace. Error tracking runs without session replays. Note: AI processing via the Gemini API uses Google's global API endpoints without a region commitment — see section 5 for the applicable processor terms.

8. Data Retention

• AI answer full texts and source snippets: 12 months, then deleted automatically.
• Chats and agent memories: 24 months or until account deletion, whichever comes first.
• Search Console performance history (only if you connect it): 12 months, the same window as the AI answers it is read against.
• IP addresses (rate limiting): 48 hours.
• Application logs and email delivery log: 90 days.
• Uploads: Deleted with your workspace.
• Guest sessions: Deleted after 48 hours (7 days if you saved your email to keep your report), including all analysis data.

Deleting a website from your dashboard permanently removes all associated data, including uploaded files. Deleting your account removes all your workspaces, your files, and your login identity. One narrow exception, kept under legitimate interest (Art. 6(1)(f), abuse prevention): a record that a domain has already used its free trial — the domain is stored as a hash, not in plaintext.

9. Your Rights (GDPR)

Under the GDPR, you have the right to:

• Access your personal data (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data (Art. 17)
• Restrict processing (Art. 18)
• Data portability (Art. 20)
• Object to processing (Art. 21)
• Lodge a complaint with a supervisory authority

You can exercise erasure and portability yourself: Settings → Profile lets you export your data as JSON and delete your account, including all workspaces, files, and your login identity. For everything else, contact hello@webblitz.ai.

10. Changes to This Policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. For significant changes, we will notify you via email.