Privacy Policy

We collect information in the following ways:

• Account Data: When you sign in via Google or GitHub OAuth, we receive your email address, name, and profile picture from the OAuth provider. We do not store or manage passwords — authentication is fully delegated to these trusted third-party providers.
• Audit Submissions: Website URLs and domains you submit for auditing are collected and processed to generate diagnostic reports. This data is linked to your account.
• Usage Data: We automatically log metadata such as your IP address, browser type, operating system, pages visited, and timestamps when you access our services. This helps us ensure uptime, security, and product improvements.
• Payment Information: If you subscribe to a paid plan, payment details (card number, billing address) are handled exclusively by our payment processors (Cashfree / Stripe). We only store transaction identifiers and subscription status — never raw card data.
• Cookies & Session Data: We use HttpOnly cookies to manage authenticated sessions securely. We may also use analytics cookies to understand how users interact with our platform.

We use the data we collect for the following purposes:

• To authenticate your identity and maintain your account.
• To run technical website audits against URLs you submit.
• To generate AI-powered fix recommendations, performance reports, and competitive benchmarks.
• To process payments and manage your subscription tier.
• To send you transactional emails (audit complete, billing receipts, critical security alerts). We do not send unsolicited marketing emails unless you explicitly opt in.
• To detect and prevent fraud, abuse, or unauthorized access to our platform.
• To analyze aggregate usage patterns and improve our product. All such analysis is performed on anonymized or pseudonymized datasets.

We do not sell, rent, or trade your personal data or audit results to any third party for advertising or marketing purposes.

Your data is stored on encrypted databases hosted on AWS infrastructure within secure, access-controlled environments. We apply industry-standard security controls including:

• TLS 1.3 encryption in transit for all API and web traffic.
• AES-256 encryption at rest for all database volumes.
• HttpOnly, SameSite cookies to prevent XSS and CSRF attacks.
• Role-based access controls (RBAC) limiting employee data access.
• Regular automated security audits and penetration testing.

Retention: We retain your account data as long as your account is active. Audit data is retained for 90 days by default on free plans, and up to 1 year on paid plans. You may request deletion of your data at any time — see Section 7 for details.

We integrate with a number of third-party providers to deliver our services:

• Google OAuth: Used for sign-in. We only request access to your email address and basic profile. We do not access your Google Drive, Gmail, Calendar, or any other personal Google data.
• GitHub OAuth: Used as an alternative sign-in. We only request your public profile and email address.
• Cashfree / Stripe: Used for payment processing. Card data is collected and stored exclusively by these PCI-DSS compliant processors.
• OpenAI / AI APIs: Used to generate AI-assisted code fixes and recommendations. URL data may be sent to these APIs for processing. Requests are made server-side and are not retained by the AI provider beyond the session.
• Analytics: We may use privacy-respecting analytics tools (e.g., Plausible, PostHog) to collect anonymized usage metrics. We do not use Google Analytics.

Google API Policy Compliance: WebSurgeon.tech's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We only access your Google email and profile information to create and secure your account.

We use the following types of cookies:

You can control cookie behavior through your browser settings. Disabling session cookies will prevent you from logging in to the platform.

We do not share your personal data except in the following limited circumstances:

• Service Providers: Trusted vendors (payment processors, cloud hosts, AI APIs) who process data on our behalf, bound by data processing agreements.
• Legal Compliance: If required by law, a court order, or regulatory requirement, we may disclose data to authorities. We will notify you if legally permitted to do so.
• Business Transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity. We will notify you via email before this occurs.
• Consent: We may share data with third parties you have explicitly authorized.

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of all personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your account and all associated data. You can initiate this from your account settings, or by visiting our Data Deletion page.
• Portability: Request a machine-readable export of your audit history and account data.
• Objection / Restriction: Object to or restrict processing of your data in certain circumstances.

To exercise any of these rights, email us at privacy@websurgeon.tech. We will respond within 30 days.

WebSurgeon.tech is not directed to children under the age of 13 (or 16 in the European Economic Area). We do not knowingly collect personal data from children. If we become aware that a child has provided us with personal data, we will take steps to delete such information promptly. If you believe a child has submitted data to us, please contact us at privacy@websurgeon.tech.

WebSurgeon.tech is operated from India. If you access our services from the European Union, United Kingdom, or other regions with data transfer restrictions, please note that your data may be transferred to and processed in India or on AWS servers in other regions.

Where required by applicable law, we use appropriate safeguards (such as Standard Contractual Clauses) to protect international data transfers. By using our services, you consent to this transfer.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. When we make significant changes, we will:

• Update the "Last Updated" date at the top of this page.
• Send a notification email to your registered address at least 14 days before the changes take effect.
• Display a banner on the platform for logged-in users.

Your continued use of WebSurgeon.tech after the effective date constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests relating to this Privacy Policy, please reach out to us through any of the following channels:

We aim to respond to all privacy-related inquiries within 3 business days.