Website Privacy Policy

For webappski.com and TypelessForm Marketing Website

Last Updated: October 7, 2026

Website Owner: Lizaveta Isayeuskaya, sole proprietorship (jednoosobowa działalność gospodarcza) ul. Leona Staniszewskiego 19a 81-603 Gdynia, Poland VAT ID (EU): PL5862379862 REGON: 521887646 Email: info@webappski.com

1. Introduction

This Privacy Policy explains how we collect, use, and protect your personal information when you visit our marketing websites at webappski.com, typelessform.com, or related subdomains (collectively, the "Website"), and when you use the TypelessForm portal, AEO Mission Control, and related services.

Scope: This Privacy Policy applies to our Websites (webappski.com, typelessform.com), the TypelessForm portal, AEO Mission Control (the personalised AEO action-plan service available at webappski.com/portal/aeo-mission-control), and the three things you can ask for on the Website without an account — the free AI-visibility check, a request for a full audit, and an application to the free-pilot programme (§2.8). It does NOT apply to:

• End users of TypelessForm widget on third-party websites (see "Privacy Policy for End Users")
• Business clients using TypelessForm services (see "Terms of Service" and "Data Processing Agreement")

2. Data We Collect

2.1 Information You Provide

When you interact with our Website, you may provide:

Forms (Process Form, Early Access Form, Pilot Form, Product Form):

• Name
• Email address
• Phone number
• Company name
• Website URL
• Project details
• Billing address
• Tax ID
• Message or inquiry

Forms are submitted via Formspree, a third-party form processing service (US-based). By submitting a form, you consent to your data being processed by Formspree in accordance with their privacy policy.

Legal basis: Art. 6(1)(a) GDPR (consent via checkbox on each form).

Retention: As long as needed to process the inquiry, then deleted.

Portal Account Registration (Google OAuth, or email + password):

• Firebase UID
• Email address
• Display name and profile photo URL — populated only for accounts created via Google sign-in
• Password — email + password accounts only, stored by Firebase Authentication as a salted hash; we never see or log it in plaintext

Account registration is handled through Firebase Authentication. You can create a portal account either by signing in with your Google account, or by registering directly with an email address and a password of your choosing — some client accounts were set up this way rather than through Google. For Google sign-in, we do not collect or store your Google account password.

Legal basis: Art. 6(1)(b) GDPR — performance of contract (providing portal access and services).

Retention: Until account deletion. Users can request account deletion at any time by contacting info@webappski.com.

Newsletter Subscription (not yet active):

• Email address
• Name (optional)

Support Inquiries:

• Name, email, account details
• Technical information about your issue
• Screenshots or attachments (if you provide them)

2.2 Automatically Collected Information

When you visit our Website, we automatically collect:

Technical Data:

• Timestamps of page visits
• IP addresses are stored ONLY in server access/error logs for 30 days for security and fraud prevention purposes
• Server logs (access logs for security purposes; retention see §5)
• Error logs (if technical issues occur)

Legal basis for technical logging: Legitimate interests (GDPR Art. 6(1)(f), Recital 49 — network and information security).

2.3 Website Analytics (Google Analytics 4)

With your consent (via our cookie consent banner), we use Google Analytics 4 (provided by Google LLC / Google Ireland Limited) to understand how visitors interact with our Website.

Data Collected by Google Analytics:

• Pages visited and navigation paths
• Session duration and bounce rate
• Referral source (how you found our Website — search engine, direct link, social media, etc.)
• Device type (desktop, mobile, tablet)
• Operating system and browser type/version
• Screen resolution
• Approximate geographic location (city-level, derived from IP address)
• Language preference

What Google Analytics Does NOT Collect (as configured by us):

• ❌ Your name, email, or any form data
• ❌ Precise geolocation (GPS coordinates)
• ❌ Cross-site tracking or advertising profiles

IP Anonymization: Google Analytics 4 does not log or store IP addresses. Google uses IP addresses transiently for geographic approximation and then discards them.

Google Signals: Google Signals is disabled in our configuration. We do not collect cross-device tracking data or demographic/interest data from Google accounts.

Data Sharing with Google: We have disabled data sharing for Google advertising products. Analytics data is NOT used for Google Ads personalization or remarketing.

Legal basis: Consent (GDPR Art. 6(1)(a)) — Analytics cookies are set ONLY after you click "Accept" on our cookie consent banner. If you decline or ignore the banner, no analytics data is collected.

Opt-out: You can withdraw consent at any time via the cookie settings link in our Website footer, or by installing the Google Analytics Opt-out Browser Add-on.

Retention: See Section 5 (Data Retention).

2.4 Subscription & Billing Data

If you subscribe to a paid plan, we collect and store:

• Subscription tier (Pilot, Starter, Professional, or Enterprise)
• Billing cycle dates
• Usage metrics (form-fill counts)
• Subscription status

All payment processing is handled by Stripe, Inc., which is PCI DSS Level 1 compliant. We do NOT store credit card numbers or payment card details. Stripe handles all card data directly. We receive only a confirmation of payment status and subscription identifiers from Stripe.

Legal basis: Art. 6(1)(b) GDPR — performance of contract.

Retention: Billing records are kept for 5 years per tax and accounting requirements.

2.5 API Key Management

Developer accounts may generate API keys for integration purposes:

• API keys are stored as cryptographic hashes (not in plaintext)
• The full API key is shown only once upon creation
• Keys can be regenerated at any time; the old key is immediately invalidated
• Per-key domain allowlists are stored for access control

Retention: Until account deletion or key regeneration.

2.6 Usage Tracking

We track the following data to provide and maintain our services:

• Monthly form-fill counts per account
• Lifetime usage totals
• Rate limit counters (to prevent abuse)
• Per-key domain allowlists (for access control)

Legal basis: Art. 6(1)(b) GDPR (contract — providing the subscribed service) and Art. 6(1)(f) GDPR (legitimate interest — abuse prevention and rate limiting).

2.7 AEO Mission Control — Project & Snapshot Data

When you register a project in AEO Mission Control and upload a tracker snapshot, we collect:

Project Registration:

• Project ID (slug you choose, e.g. acme-co)
• Brand name
• Domain
• Plan language preference (en/pl/de/ru)
• Owner (Firebase UID — links to your portal account)
• Registration timestamp

Tracker Snapshot Uploads:

When you paste the JSON metadata block from aeo-tracker HTML report, we store:

• Visibility scores aggregated across AI engines (no raw queries, no AI response content)
• Per-engine match counts and citation counts (numeric metrics only)
• Top competitor names mentioned by AI engines (public brand data)
• Top citation domain hosts (public domain names)
• Crawlability summary (robots.txt / llms.txt / sitemap presence flags)
• Authority signals (Wikipedia article presence, Reddit mention count)
• Topic clusters (derived from query text — query IDs, not the queries themselves)
• Snapshot timestamps and tracker version

What we do NOT collect from snapshots (privacy-stripped at the tracker level via allow-list construction):

• ❌ Full text of AI responses ("responseExcerpt")
• ❌ Raw query text (only query IDs like Q1, Q2)
• ❌ Full citation URLs from AI responses
• ❌ Your API spend / token usage / per-cell cost telemetry
• ❌ LLM-drafted outreach email templates
• ❌ Internal model debug data (extraction sources, unverified competitors)

Generated Plans:

After you upload a snapshot, we generate a personalised 30-day AEO plan (text content) and store it in your project. Plans contain mission descriptions, KPI labels, decision points, and risk indicators — no personal identifiers beyond your project's brand and domain.

Plan generation method:

Plans are prepared by Webappski's team, with the help of AI tools, from the underlying AEO-tracker run for your project — the same measurement run the metadata above is drawn from, which can carry more working detail (such as the AI engines' verbatim answers and citation text) than what AEO Mission Control itself stores. None of it includes your name, email address, or any other identifier tied to your account — those live only in our own Firebase project and are never included in what is sent to an AI tool. A person on our team reviews and edits every plan, applying our internal AEO methodology, before it is pasted into the portal as JSON.

Legal basis: Art. 6(1)(b) GDPR (contract — providing the subscribed AEO Mission Control service).

Retention: Until project deletion. See Section 5.

2.8 Free AI-Visibility Check, Audit Requests & Free-Pilot Applications

We offer three things on this Website that you can ask for without having an account: an instant free check of how AI answer engines describe a website, a request for a full audit, and an application to our free-pilot programme. Each collects different data and rests on a different legal basis, so each is described separately.

(a) The free AI-visibility check

What you give us: a domain, and optionally a brand name and a target market. No email address is required and none is asked for to run the check.

What we do with it: we put questions about that domain and brand to third-party AI answer engines and record how they answer. We store the run — the domain, the brand, the market and language it was run for, the resulting scores, the competitor names the engines mentioned, and the verbatim answers the engines gave — so that the same check asked again the same day replays the same result instead of being billed and run twice.

Recipients: the questions and the brand and domain they concern are sent to OpenAI Ireland Ltd (which processes in the United States under the 2021 Standard Contractual Clauses) and to Google's Gemini API, which we use on its paid tier. For paid use Google's API terms state that "Google doesn't use your prompts … or responses to improve our products" and that "Google logs prompts and responses for a limited period of time, solely for detecting and preventing violations of the Prohibited Use Policy". The run itself is stored in our own Firebase project in the EU (see §4.1).

Legal basis: legitimate interests — Art. 6(1)(f) GDPR. We rely on legitimate interests rather than consent because the field accepts any domain: you may check your own, and you may equally check a competitor's, and we cannot know which. Our interest is in operating a checking tool that a visitor has expressly asked to run; the data involved is a public website address and the public output of AI engines about it; and the processing is limited to producing and caching that one answer. Where the domain you enter identifies you — a sole trader trading under their own domain, for example — you may object at any time under Art. 21 GDPR and we will delete the run (see §6.6).

(b) Unlocking the full answers, and requesting a full audit

What you give us: an email address, and — where the form asks for them — a brand name, a domain, a target market and, optionally, a LinkedIn profile.

What we do with it: we use the email address to show you the verbatim engine answers behind the headline result, to send you the result of a check we ran for you, or to reply to your request for a full audit. We store the submission together with the score and recommendations it relates to, and we notify ourselves by email that it arrived.

Recipients: the submission is stored in our Firebase project in the EU, and the notification message to us is delivered by our email provider (see §4.1).

Legal basis: steps taken at your request before entering into a contract — Art. 6(1)(b) GDPR. You are asking us to send you something or to quote for work; that is what this basis covers. We do not describe this as consent, because a tick box is not what makes this processing lawful and we will not claim one where none was recorded.

(c) Free-pilot applications

What you give us on the free-pilot form at /free-aeo-pilot: your name, your email address, your domain, the market you work in in your own words, and the answers to two separate tick-boxes.

The two tick-boxes are deliberately separate, and only the first is required:

You can apply and be considered while refusing the second. Declining it has no effect on your application — it only means we would have to ask you again before writing about your case.

What we record: what you actually ticked. Each application stores the two answers as the two answers, not as a single line we wrote ourselves. A box the form never put to you is recorded as "not asked", which is not the same as "agreed".

Recipients: the application is stored in our Firebase project in the EU; the notification that it arrived is delivered to us by our email provider (see §4.1).

Legal basis: your consent — Art. 6(1)(a) GDPR — for the application itself, and a second, separate consent for public use of your case where you gave it (Art. 6(1)(a); Art. 7(2), which requires that a request for consent covering several matters be clearly distinguishable and separable).

Where our system cannot confirm the required consent tick was recorded (for example, an application submitted through a channel other than the form on this page), we do not reject the application; we record it instead under Art. 6(1)(b) — steps taken at your request — the same basis that already covers requests for a full audit (§2.8(b)).

(d) How long we keep any of this

The retention period for all three — the checks, the audit requests and the pilot applications — is stated in Section 5 (Data Retention). It is one period for all of them, so that there is a single rule rather than three that drift apart.

(e) Withdrawing consent, and your rights

Where our basis is consent — the free-pilot application and the separate case-study permission — you may withdraw it at any time by writing to info@webappski.com, and you do not have to give a reason. Withdrawal is as easy as giving it was. It does not affect the lawfulness of what we did before you withdrew (Art. 7(3) GDPR). Withdrawing the case-study permission alone leaves your application standing; withdrawing the processing consent means we stop considering it and delete it.

Where our basis is legitimate interests — the free check — you have the right to object under Art. 21.

Where our basis is pre-contractual steps — an audit request — you may ask us to delete the request once we have answered it.

All of the rights in Section 6 apply to everything described here: access, rectification, erasure, restriction, portability, objection, and complaint to a supervisory authority. Ask at info@webappski.com.

Automated decision-making: none of these three does any. A check is a measurement, an audit request is a message, and a pilot application is read and decided by a person (Art. 22 GDPR).

3. How We Use Your Data

3.1 Purpose

We use your data for:

1. Provide Services:

• Respond to form inquiries
• Run a free AI-visibility check on a domain you enter, and cache its result for the day
• Send you the verbatim results of a check, where you asked us to
• Answer a request for a full audit and quote for the work
• Process account registrations
• Manage subscriptions and billing
• Provide customer support
• Generate and manage API keys

2. Marketing Communications:

• Send newsletters (if you subscribed)
• Send product updates and announcements
• Send promotional offers (with opt-out option)

3. Website Analytics (with your consent):

• Understand how visitors use our Website (pages visited, navigation patterns, session duration)
• Measure effectiveness of marketing campaigns and referral sources
• Identify popular content and areas for improvement
• Improve Website design and user experience
• Identify technical issues

4. Legal Compliance:

• Comply with tax and accounting requirements
• Respond to legal requests (court orders, subpoenas)
• Prevent fraud and abuse

5. Free-Pilot Programme:

• Consider applications and select participants
• Contact applicants about their application and about the programme
• Describe the work publicly as a case study — only where the applicant gave that separate permission, and only until it is withdrawn

3.2 Legal Basis (GDPR Article 6)

• Consent (Article 6(1)(a)): The Process, Early Access, Pilot and Product forms (via the checkbox on each), newsletter subscriptions, website analytics cookies (Google Analytics — only with your explicit consent via cookie banner), free-pilot applications (except the one case described in §2.8(c), where this basis does not apply), and — separately from the application itself — permission to describe your case publicly (§2.8(c))
• Contract, including steps taken at your request before entering into one (Article 6(1)(b)): Account management, subscription and billing, API key management, usage tracking, customer support, requests for a full audit, unlocking the verbatim results of a check you asked us to run (§2.8(b)), and a free-pilot application where the required consent tick cannot be confirmed (§2.8(c))
• Legitimate Interests (Article 6(1)(f)): Security logging (IP, timestamps), fraud prevention, abuse prevention (rate limiting, and the bot check that runs when you submit the free AI-visibility check, an audit request or a free-pilot application — §9.3), and running a free AI-visibility check on a domain a visitor enters (§2.8(a) — you may object at any time under Article 21; see §6.6)
• Legal Obligation (Article 6(1)(c)): Tax records, billing record retention, legal requests

4. Data Sharing & Third Parties

4.1 Service Providers (Sub-processors)

We share your data with the following trusted third-party service providers:

All service providers:

• Are bound by contracts requiring GDPR compliance
• Use data only as instructed by us — with one stated exception: the AI providers named above log the questions we send them for a limited period for their own abuse-monitoring purposes, which is their processing and not ours (§2.8(a))

4.2 Legal Disclosures

We may disclose your data if required by law:

• Court orders or subpoenas
• Law enforcement requests
• Protection of our rights or safety
• Fraud investigations

4.3 Business Transfers

If we are acquired or merge with another company:

• Your data may be transferred to the new owner
• You will be notified as soon as reasonably practicable (confidentiality requirements may delay notification)
• New owner must honor this Privacy Policy or obtain your consent for changes

4.4 No Sale of Data

We do NOT sell your personal data to third parties for marketing purposes.

5. Data Retention

After retention period, data is permanently deleted.

6. Your Rights (GDPR)

As a data subject in the European Union, you have the following rights:

6.1 Right to Access (Article 15)

You can request a copy of your personal data we hold.

How: Email info@webappski.com with subject "GDPR Access Request"

6.2 Right to Rectification (Article 16)

You can request correction of inaccurate data.

How: Email info@webappski.com or update your account settings

6.3 Right to Erasure (Article 17 - "Right to be Forgotten")

You can request deletion of your data, including your portal account and all associated data.

How: Email info@webappski.com with subject "GDPR Deletion Request"

Exceptions: We may retain data if legally required (e.g., billing records for 5 years per tax requirements)

6.4 Right to Restrict Processing (Article 18)

You can request we limit how we use your data.

How: Email info@webappski.com with subject "GDPR Restriction Request"

6.5 Right to Data Portability (Article 20)

You can receive your data in machine-readable format (JSON, CSV).

How: Email info@webappski.com with subject "GDPR Portability Request"

6.6 Right to Object (Article 21)

You can object to:

• Direct marketing (unsubscribe link in emails)
• Processing based on legitimate interests
• Automated decision-making (we do NOT use automated decisions)

6.7 Right to Withdraw Consent (Article 7(3))

For consent-based processing (the Process, Early Access, Pilot and Product forms, newsletter, analytics cookies, free-pilot applications — except the one case described in §2.8(c), where an application is recorded under Article 6(1)(b) instead because the required tick could not be confirmed):

• Analytics cookies: Click the "Cookie Settings" link in the Website footer to change your preferences at any time. You may also install the Google Analytics Opt-out Browser Add-on.
• Newsletter: Click unsubscribe link in any email
• Form data: Contact us to request deletion of your submitted form data
• Free-pilot application: Write to info@webappski.com. You can withdraw either consent on its own: withdrawing the permission to use your case publicly leaves your application standing, and withdrawing the consent to process the application means we stop considering it and delete it (§2.8(e)). If your application was instead recorded under Article 6(1)(b) (§2.8(c)), there is no consent to withdraw, but you may still ask us to delete it under Section 6.3 (Right to Erasure).

Withdrawal of consent does not affect the lawfulness of processing performed before the withdrawal.

6.8 Right to Lodge a Complaint

You can file a complaint with your data protection authority:

Poland: Urząd Ochrony Danych Osobowych (UODO) Website: https://uodo.gov.pl/ Email: kancelaria@uodo.gov.pl

Your Country: Find your authority at https://edpb.europa.eu/about-edpb/board/members_en

Response Time: We will respond to your requests within 30 days (may extend to 60 days for complex requests). We will inform you of any extension within the first 30 days, along with reasons for the delay.

7. International Data Transfers

Some of our sub-processors operate outside the European Union. We ensure that all international transfers are protected by appropriate safeguards:

• Google Cloud Platform / Firebase: Stored data is kept in the EU region (europe-central2). Server logs, which contain IP addresses, are kept for 30 days in Google Cloud Logging in the global location, with no EU-only guarantee. Google LLC complies with the EU-US Data Privacy Framework.
• Google Analytics 4: Analytics data may be processed in the EU and US. Google LLC complies with the EU-US Data Privacy Framework. IP addresses are NOT logged or stored by GA4. Analytics data is collected only with your consent (cookie banner). We have configured GA4 to disable Google Signals, disable data sharing for advertising, and set data retention to 14 months.
• Stripe: Payment data may be processed in the EU and US. Stripe, Inc. complies with the EU-US Data Privacy Framework and maintains PCI DSS Level 1 certification.
• Formspree: US-based service. Data transfer is based on Standard Contractual Clauses (SCCs).
• OpenAI Ireland Ltd (free AI-visibility check): the contracting entity is established in Ireland; the questions, brand and domain are processed in the United States by OpenAI's affiliates. The transfer is covered by the 2021 EU Standard Contractual Clauses incorporated in OpenAI's published data processing addendum (openai.com/policies/data-processing-addendum/, read 20 September 2026). We hold no arrangement that shortens that provider's own abuse-monitoring retention.
• Google Cloud Poland Sp. z o.o. (Gemini API, Paid Services — free AI-visibility check): the contracting entity is established in the European Union, so our engagement of it is not itself a transfer out of the EEA. Google's processor terms provide that a restricted European transfer is covered by a Data Transfer Solution — the EU-US Data Privacy Framework, under which Google has certified itself and certain wholly-owned US subsidiaries — and, where such a solution is not available, by the EU Standard Contractual Clauses (Google Data Processing Addendum for Products Where Google is a Data Processor, Appendix 3A §7.1 and §7.4, business.safety.google/processorterms/, read 22 September 2026). Google's paid-tier API terms also state that the data may be "stored transiently or cached in any country in which Google or its agents maintain facilities". On that tier Google states that prompts and responses are not used to improve Google's products, and that they are logged for a limited period solely to detect and prevent violations of its Prohibited Use Policy (§2.8(a)).
• Google Fonts: Font files are served from a global CDN. Google LLC complies with the EU-US Data Privacy Framework. Only IP addresses are transmitted with font requests; no personal data is stored by the service.
• Google reCAPTCHA Enterprise (Firebase App Check): a global Google service; data may be processed at any Google data-center location. Google LLC complies with the EU-US Data Privacy Framework, and Google's Cloud terms, including its Data Processing Addendum, govern the processing. Only the bot check (§9.3) goes to this service; the content of your form does not.
• Resend: Transactional email delivery service. Sending region is EU (eu-west-1, Ireland), but data passes through US infrastructure. Resend, Inc. is US-based; data transfer is based on Standard Contractual Clauses (SCCs). Email content is processed only for delivery; not retained beyond delivery logs (30 days).

Additional Safeguards:

• Encryption in transit (TLS 1.2+)
• Encryption at rest (AES-256)
• Access controls
• Data minimization
• Regular security audits

8. Security Measures

We implement industry-standard security measures:

Technical Measures:

• Encryption: HTTPS (TLS 1.2+) for all website traffic
• Secure hosting: Google Cloud Platform with DDoS protection
• Access control: Multi-factor authentication for admin accounts
• API key security: Keys stored as cryptographic hashes, not plaintext
• Regular updates: Security patches applied promptly

Organizational Measures:

• Staff training: GDPR awareness training for all staff
• Data minimization: Collect only necessary data
• Access limitation: Data accessible only to authorized personnel
• Incident response plan: 72-hour breach notification to authorities (GDPR Article 33)

Limitations: No security is 100% perfect. We cannot guarantee absolute security, but we use commercially reasonable efforts.

9. Cookies & Local Storage

9.1 What Are Cookies?

Cookies are small text files stored on your device by websites you visit. Local storage is a similar browser mechanism for storing data locally.

9.2 Cookie Consent

When you first visit our Website, a cookie consent banner is displayed. You may:

• Accept all cookies — strictly necessary + analytics cookies are set
• Accept only necessary cookies — only strictly necessary cookies are set; no analytics
• Change preferences later — click the "Cookie Settings" link in the Website footer at any time

No analytics cookies are set until you explicitly consent. If you dismiss or ignore the banner, only strictly necessary cookies are used.

Your consent preference is stored in a cookie (cookie_consent) so we do not ask you again on every visit. This preference cookie is itself strictly necessary (no consent required for it).

9.3 Strictly Necessary Cookies (No Consent Required)

These cookies are essential for the Website to function. They cannot be disabled.

Legal basis: Strictly necessary — GDPR Art. 6(1)(f) and ePrivacy Directive Art. 5(3) exemption. No consent required.

For _GRECAPTCHA, the necessity is the security of what you are doing: the bot check protects the form you are submitting from automated abuse (GDPR Art. 32; Recital 49). It runs when you submit, never in the background of a page.

9.4 Analytics Cookies (Consent Required)

These cookies are set only if you click "Accept" on the cookie consent banner. They help us understand how visitors use our Website.

What these cookies do:

• Count the number of visitors and sessions
• Track which pages are visited and in what order
• Measure session duration and bounce rate
• Determine referral sources (search engine, direct link, social media)
• Collect device/browser/OS information (anonymized)
• Approximate geographic location (city-level, from IP — IP itself is NOT stored by GA4)

What these cookies do NOT do:

• ❌ Track you across other websites
• ❌ Build advertising or marketing profiles
• ❌ Collect your name, email, or any personal identifiers
• ❌ Enable Google Ads remarketing or personalization (disabled in our configuration)

Legal basis: Consent (GDPR Art. 6(1)(a)) — set only after explicit user consent via cookie banner.

Opt-out options:

1. Click "Cookie Settings" in the Website footer and withdraw consent
2. Install the Google Analytics Opt-out Browser Add-on
3. Block third-party cookies in your browser settings
4. Use browser's "Do Not Track" signal (we respect DNT — see §12.4)

9.5 What We Do NOT Use

• NO marketing cookies
• NO advertising cookies (Facebook Pixel, Google Ads remarketing, etc.)
• NO cross-site tracking cookies
• NO social media tracking pixels
• NO fingerprinting or similar tracking technologies for analytics, advertising or profiling. One check is different and is described in §9.3: when you submit the free AI-visibility check, an audit request or a free-pilot application, Google's reCAPTCHA Enterprise evaluates signals from your browser to tell a person from a bot. We use its result only to accept or refuse that submission; we receive no signals from it, only whether the check passed, and we use nothing from it to identify, profile or track you

9.6 Cookie Management

Via Our Website: Click the "Cookie Settings" link in the Website footer to change your cookie preferences at any time.

Via Browser Settings: You can block cookies and clear local storage via browser settings:

• Chrome: Settings > Privacy > Cookies
• Firefox: Settings > Privacy > Cookies
• Safari: Preferences > Privacy > Cookies

Note: Blocking strictly necessary cookies may break Website functionality (e.g., cannot log in to the portal). Blocking analytics cookies will NOT affect Website functionality.

10. Demo Widget Notice

Our Website includes a live demonstration of the TypelessForm voice-powered form widget. Any voice input provided during the demo is processed according to our separate Privacy Policy for End Users, which covers how voice data is handled, processed, and retained. The demo widget does not store or retain any voice recordings beyond the active session.

11. Children's Privacy

Age Restriction: Our Website is NOT intended for children under 16 years old (or lower age set by your country's law, but no lower than 13 years).

• We do NOT knowingly collect data from children under the applicable age limit
• If you are under the applicable age limit, DO NOT use our Website or provide personal data
• Parents: If you believe your child provided data, contact us immediately at info@webappski.com for deletion

12. Marketing Communications

12.1 Newsletter

Currently not active. Newsletter functionality will be implemented in the future. When available:

• We will send product updates, blog posts, and promotional offers
• You will be able to unsubscribe anytime (link in every email)
• Email open/click tracking will require your explicit opt-in consent during subscription

12.2 Transactional Emails

If you have an account:

• We send transactional emails (account creation, subscription confirmations, billing notifications)
• You CANNOT opt-out of transactional emails (necessary for service)

12.3 Promotional Emails

If you are an existing customer:

• We may send promotional emails about our Services (legitimate interest)
• You can opt-out anytime

12.4 Do Not Track

We respect "Do Not Track" (DNT) browser signals:

• If DNT is enabled, we treat it as if you declined analytics cookies — Google Analytics will NOT be loaded, regardless of cookie consent banner state
• Note: DNT is not a legally binding standard in the EU, but we honor it as a courtesy and as a best practice

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Notification:

We do not have an email channel to registered users, so we do not send an email when this Policy changes. What we do instead: every change bumps the version number and the "Last Updated" date at the top of this page, and the version note at the end of this document summarises what changed — the same place §2.8, §6.7 and every other cross-referenced section point back to.

Effective Date: Changes effective immediately upon posting.

Your Consent: Continued use of the Website after a change is posted is acceptance of it. Where a change introduces a new processing purpose that itself needs a new lawful basis, we will seek your explicit consent for that purpose before relying on it, as required by law — separately from, and regardless of, whether you kept using the Website.

14. Contact Information

For Privacy Inquiries: Email: info@webappski.com Subject: "Privacy Inquiry - Website"

For GDPR Requests: Email: info@webappski.com Subject: "GDPR Request - [Type: Access/Deletion/etc.]"

Postal Address: Lizaveta Isayeuskaya, sole proprietorship (jednoosobowa działalność gospodarcza) ul. Leona Staniszewskiego 19a 81-603 Gdynia, Poland

Data Protection Authority (Poland): Urząd Ochrony Danych Osobowych (UODO) Website: https://uodo.gov.pl/ Email: kancelaria@uodo.gov.pl

15. California Privacy Rights (CCPA)

Applicability: This section applies only if we meet CCPA thresholds (25,000+ California residents/year or 50%+ revenue from data sales). As of the Last Updated date, we are not subject to CCPA requirements but provide this information for transparency.

If you are a California resident (US), you may have additional rights under CCPA:

15.1 Right to Know

You can request disclosure of:

• Categories of personal information collected
• Sources of personal information
• Business purpose for collection
• Third parties with whom we share data

15.2 Right to Delete

You can request deletion of your personal information (same as GDPR Right to Erasure).

15.3 Right to Opt-Out of Sale or Sharing (CPRA)

We do NOT sell or share your personal information for cross-context behavioral advertising or other purposes. No opt-out required.

15.4 Non-Discrimination

We will NOT discriminate against you for exercising CCPA rights (same prices, same service quality).

To Exercise CCPA Rights: Email: info@webappski.com Subject: "CCPA Request - [Type]"

Response Time: 45 days (may extend to 90 days for complex requests)

APPENDIX: Data Processing Record (GDPR Article 30)

Controller: Lizaveta Isayeuskaya, sole proprietorship (jednoosobowa działalność gospodarcza) Contact: info@webappski.com DPO: Not appointed (Article 37 GDPR does not require DPO for our current scale of operations. We will appoint a DPO if our processing activities meet the criteria under Article 37(1)(b) or (c).)

Categories of Data Subjects:

• Website visitors
• Visitors who run a free AI-visibility check, and the owners of the domains entered into it
• People who request a full audit
• Applicants to the free-pilot programme
• Newsletter subscribers
• Portal account holders
• Subscribers (paid plans)
• AEO Mission Control project owners (founder-only beta — limited to ≤20 customers)
• Support inquiries

Categories of Personal Data:

• Identification data: Name, email, Firebase UID, display name, profile photo URL
• Commercial data: Company name, billing address, tax ID, subscription tier, billing cycle dates
• Technical data: Browser, device, page views, IP (server logs only)
• Analytics data (with consent): Pages visited, session duration, referral source, device/browser type, approximate location (city-level) — via Google Analytics 4; IP addresses NOT stored by GA4
• Usage data: Form-fill counts, rate limit counters, API key hashes
• Free AI-visibility check data: domain entered, brand name, target market and language, the questions put to AI engines, the engines' verbatim answers, the competitor names they mentioned, and the resulting scores
• Audit-request and pilot-application data: name, email address, domain, brand, market in the applicant's own words, optional LinkedIn profile, and the two consent answers recorded as given
• AEO Mission Control project data: brand name, domain, language, snapshot metadata (privacy-stripped — see §2.7 for full inclusion/exclusion list), generated plan content

Categories of Recipients (Sub-processors):

• Google Cloud Platform / Firebase (hosting, authentication, database, Cloud Functions — EU region; server logs — global location)
• Google LLC / Google Ireland Ltd — Google Analytics 4 (website analytics, with consent — EU/US)
• Google LLC / Google Ireland Ltd — Firebase App Check with Google reCAPTCHA Enterprise (bot check when a form is submitted — global service)
• Stripe, Inc. (payment processing — EU/US)
• Formspree (form processing — US)
• OpenAI Ireland Ltd (AI answer-engine queries for the free visibility check — brand name, domain and the questions asked about them; processing in the US)
• Google Cloud Poland Sp. z o.o. (Gemini API, Paid Services — AI answer-engine queries for the free visibility check; same data)
• Google Fonts (web font delivery — global CDN)
• Resend, Inc. (transactional email delivery — sending region eu-west-1 Ireland, US infrastructure)

Transfers to Third Countries:

• Stripe: EU/US — EU-US Data Privacy Framework
• Google Analytics 4: EU/US — EU-US Data Privacy Framework; IP addresses NOT stored; data collected only with consent
• Formspree: US — Standard Contractual Clauses (SCCs)
• OpenAI Ireland Ltd: contracting entity in Ireland; processing in the US — 2021 Standard Contractual Clauses (openai.com/policies/data-processing-addendum/, read 20 September 2026)
• Google Cloud Poland Sp. z o.o. (Gemini API): contracting entity in the EU; data may be cached transiently in any country where Google operates — EU-US Data Privacy Framework certification, with the 2021 Standard Contractual Clauses where the Framework is not available (business.safety.google/processorterms/, Appendix 3A §7.1 and §7.4, read 22 September 2026)
• Google Fonts: Global CDN — EU-US Data Privacy Framework (IP address only)
• Firebase App Check / Google reCAPTCHA Enterprise: global service — EU-US Data Privacy Framework; Google's Cloud Data Processing Addendum; form content is not sent
• Google Cloud / Firebase: stored data in the EU region (europe-central2); server logs (IP addresses) in Google Cloud Logging, global location — no EU-only guarantee
• Resend: EU sending region (eu-west-1 Ireland) with US infrastructure transit — Standard Contractual Clauses (SCCs); 30-day delivery log retention

Retention Periods:

• See Section 5 (Data Retention)

Security Measures:

• See Section 8 (Security Measures)

BY USING OUR WEBSITE, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO THIS PRIVACY POLICY.

Last Updated: October 7, 2026 Version: 2.7.2 — added Google reCAPTCHA Enterprise (Firebase App Check), the bot check that runs only when you submit the free AI-visibility check, an audit request or a free-pilot application, to the service providers in §4.1, the strictly necessary cookies in §9.3 (the cookie _GRECAPTCHA), the legal basis in §3.2, the transfers in §7 and the Article 30 appendix, and made §9.5 say what that check does instead of claiming nothing of the kind exists; version 2.7.1 — corrected the retention of server logs (30 days, not 90) and said where they are kept (Google Cloud Logging, global location, no EU-only guarantee) in §2.2, §4.1, §5, §7 and the Article 30 appendix, which had said that stored data never leaves the EU; version 2.7 — removed the promise of an email notice for material changes in §13 (we have no email channel to registered users) and replaced it with what we actually do (version + date bump, plus this changelog line); corrected §2.7 to say plans are prepared with the help of AI tools rather than claiming none of your snapshot data ever reaches one, while stating plainly that your account's personal identifiers are never included in what is sent; corrected §2.1 to describe both portal sign-in methods actually in use (Google OAuth and email + password — some client accounts were set up the latter way); and cross-referenced §3.2 and §6.7 with the §2.8(c) exception (a pilot application recorded under Art. 6(1)(b) instead of consent when the required tick cannot be confirmed) so all three places agree with each other.