Privacy Policy & Platform Safeguards
VERSION 2.4 | REVISED: OCTOBER 2026 | APPLIES TO WEBFIT.AI PLATFORM & DIAGNOSTIC APIS
1. Scope & Data Controller Entity
WebFit Technologies Ltd ("WebFit.ai," "we," "us," or "our") provides Answer Engine Optimization (AEO), Retrieval-Augmented Generation (RAG) readiness metrics, and competitive AI visibility intelligence to B2B enterprise clients.
This Policy describes how WebFit.ai acts as both a Data Controller (for account administration and portal usage telemetry) and a Data Processor (for domain crawling and custom diagnostic dossier generation) under the UK General Data Protection Regulation (UK GDPR), EU GDPR (2016/679), and the California Consumer Privacy Act (CCPA).
2. Web Crawling & Public Surface Area Analysis
Our proprietary crawlers extract publicly accessible HTML, Schema.org metadata, JSON-LD blocks, OpenGraph protocols, and HTTP headers from domain targets submitted for audit.
Perimeter Assurance: WebFit.ai crawlers operate strictly on publicly indexable web surfaces. We do not attempt to bypass paywalls, execute credentials against authenticated areas, override robots.txt directives without authorization, or extract non-public databases.
3. AI Model Boundaries & Non-Training Pledge
Enterprise clients frequently interrogate competitive positioning or log strategic observations within our Audit Copilot and Dossier Synthesis Engine.
- Zero Model Training: Proprietary executive summaries, analyst notes, and audited claim telemetry sent through our platform or third-party LLM endpoints (e.g., OpenAI Enterprise, Google Vertex AI, Anthropic API) are explicitly opted out of public foundation model training datasets.
- Isolated Contexts: Strategic Notes logged in Pillar 9 (Audit Copilot) remain segregated within your organization’s encrypted tenant environment.
4. Information We Process
| Category | Data Points Processed | Legal Basis (GDPR) |
|---|---|---|
| Client Account Data | Name, corporate email, hashed credentials, billing records, organizational role. | Performance of Contract (Art. 6(1)(b)) |
| Domain Diagnostic Data | Target URLs, extracted claim statements, metadata headers, Schema structures. | Legitimate Interests (Art. 6(1)(f)) / Consent |
| Platform Telemetry | IP address, user agent, feature interaction logs, session tokens. | Legitimate Interests (Art. 6(1)(f)) / Security |
5. Data Retention & Purging Schedules
We do not maintain indefinite data stores for transient audit logs. We strictly enforce the following automated retention windows:
- Audit Dossiers & Telemetry Reports: Retained for 12 months from generation date or until account termination, after which reports are automatically archived or purged.
- Active Session & Terminal Logs: Live crawler streaming terminal logs are purged within 30 days of audit execution completion.
- Account Credentials & Billing Profiles: Retained for the duration of the commercial license agreement plus 6 statutory years for tax and auditing compliance.
6. Infrastructure Security & Sub-Processors
All WebFit.ai infrastructure is hosted in enterprise-grade data centers maintaining SOC 2 Type II and ISO 27001 certifications. Data is encrypted using AES-256 at rest and TLS 1.3 in transit.
We engage select third-party sub-processors to fulfill service delivery:
- Cloud Infrastructure: Amazon Web Services (AWS, EU/UK Regions) & Microsoft Azure.
- Billing & Licensing: Stripe Payments Europe Ltd.
- Enterprise LLM Inference: Google Cloud Vertex AI & OpenAI API (Enterprise tier with Zero Data Retention agreements).
7. Statutory Client Rights
Depending on your jurisdiction, you possess specific rights regarding your personal data:
- Right to Access & Portability: Request a machine-readable export of all account telemetry and generated audits.
- Right to Erasure ("Right to be Forgotten"): Request immediate purging of client user accounts and associated non-statutory logs.
- Right to Restrict Processing: Opt-out of specific competitive benchmarking or automated report distribution lists.
8. Legal Contact & Data Protection Officer
To exercise your data privacy rights, execute Data Processing Agreements (DPAs), or submit inquiries regarding our platform security architecture, please contact our Data Protection Team: