Data processing addendum

You are the controller of personal data in your sites, Google properties and client accounts. WebValet is the processor. For account data about you (name, email, billing), WebValet is an independent controller as described in the Privacy policy.

WebValet processes personal data only on your documented instructions: the Terms, this DPA, and the settings you choose in the product (sites added, Google properties connected, Autopilot rules). We will tell you if we believe an instruction breaks data protection law.

Subject matter

Monitoring, auditing, reporting on and fixing websites

Duration

While you have an account, plus 90 days

Nature and purpose

Crawling public pages, reading search and traffic data, generating reports and AI summaries, applying approved changes

Data subjects

Your website visitors (aggregated traffic data), people named on your public pages, your team members and clients

Categories

Aggregated search and analytics data, page content, names and roles on public pages, team member emails

Special categories

None intended; any present in public page content is processed only as part of that content

Everyone with access to personal data is bound by confidentiality. WebValet implements the measures in the Security page: encryption in transit and at rest, encrypted credentials, per-account access control, least-privilege scopes, logging, backups and incident response. We review them at least annually.

You authorise the subprocessors listed on the Subprocessors page. We will email account owners at least 14 days before adding one; you may object within that period, and if we cannot resolve the objection you may cancel with a pro rata refund. Subprocessors are bound by written terms at least as protective as this DPA.

WebValet is in the UAE and uses providers in the United States and the EU. Transfers of EU, UK or Swiss personal data rely on the European Commission's Standard Contractual Clauses (module 2 and 3, as applicable) and the UK International Data Transfer Addendum, which are incorporated here by reference, together with providers' own certifications (for example the EU-US Data Privacy Framework where a provider is certified). Transfers from the UAE and Saudi Arabia comply with the UAE PDPL and Saudi PDPL transfer rules.

If a data subject contacts WebValet about your data we forward the request to you within 5 business days and do not respond directly unless you ask us to. We provide export and deletion tools in Settings and help with impact assessments and regulator enquiries at no charge where reasonable.

We notify you without undue delay, and within 48 hours of confirming a breach affecting your data, with the information you need for your own notifications, and we cooperate with your investigation.

At the end of the service you can export your data from Settings. We delete personal data 90 days after account closure, and earlier on request, except copies required by law (invoices) and backups, which expire on their normal schedule (30 days).

Once a year, or after a breach, you may request written evidence of our compliance (this DPA, our security measures, provider certifications). If that is insufficient under your law, you may conduct an audit on 30 days' notice, at your cost, during business hours, without disrupting the service, and subject to confidentiality.

Liability under this DPA is subject to the limits in the Terms of service. If this DPA conflicts with the Terms, this DPA wins for data protection matters. If the Standard Contractual Clauses conflict with this DPA, the Clauses win.

• Access control: Google OAuth sign-in, hardware-key 2FA for staff, every database query scoped to the signed-in account.
• Encryption: TLS 1.2+ in transit; AES-256 at rest (provider managed); AES-256-GCM for stored credentials with keys in a separate secret store.
• Minimisation: read-only Google scopes; property-level selection; crawl caps per plan.
• Integrity: previewed, logged and reversible Autopilot changes; signed webhooks from Polar.
• Availability: Cloudflare edge, Cloudflare D1 point-in-time recovery (Time Travel, 30 days), uptime monitoring of WebValet itself.
• Logging and monitoring: request logs without secrets, error tracking, spend caps on AI providers.
• Vendor management: written terms with every subprocessor; annual review.