Privacy policy

WebValet is operated by Shaheer Malik, trading as WebValet, based in Dubai, United Arab Emirates. For data protection law, Shaheer Malik is the controller of the personal data described in this policy. Where you use WebValet to process data about your own customers (for example traffic data from your Analytics property), you are the controller of that data and we act as your processor under our Data processing addendum.

Controller

Shaheer Malik, trading as WebValet, Dubai, United Arab Emirates

Privacy contact

privacy@webvalet.app

Security contact

security@webvalet.app

Websites covered

webvalet.app, app.webvalet.app and the audit widget on shaheermalik.com/website-audit

We have not appointed a Data Protection Officer because the law does not require one for a business of our size. The privacy contact above answers every request personally.

1. The free audit (no account)

When you paste a URL on webvalet.app or shaheermalik.com/website-audit we record the URL, the time, your IP address, your browser's user agent and a Cloudflare Turnstile token. The IP address is used only to enforce the limit of three audits per visitor per day and to block abuse. It is hashed with a daily key and the hash is discarded after 24 hours. The audit result itself is cached for 7 days per domain so the next person who audits the same site gets an instant result. Audit results contain data about a public website, not about you, except where the website is your personal site.

2. Signing in with Google

Google is the only sign-in method at launch. When you click Continue with Google we receive your name, email address, profile picture URL and a stable Google account ID directly from Google. We ask for nothing else at this step. We use these to create your account, address you by name, send the Monday report and alerts, and keep your audit attached to your account.

3. Connecting Google Search Console and Google Analytics (optional)

This is a separate step with its own consent screen. If you connect, we receive an OAuth refresh token for the read-only scopes webmasters.readonly and analytics.readonly. We use it to read search queries, clicks, impressions, average positions, sitemap status and traffic reports for the properties you pick. We never write to your Google account and never read Gmail, Drive, Ads or any other Google service. Full details, including the exact API methods, are on the Google data use page. Tokens are encrypted at rest and deleted the moment you disconnect.

4. Monitoring your website

For every site you add we crawl its public pages (within your plan's page cap), store page titles, descriptions, headings, links, images and structured data, take screenshots, check uptime every 5 minutes, check your SSL certificate and domain expiry, and look up rankings, backlinks and AI answers through DataForSEO. This is data about a public website. If your pages contain personal data (for example staff names on a team page), it is stored as part of the crawl and covered by the retention rules below.

5. Paying for a plan or report

Checkout happens on Polar's hosted page. Polar is the merchant of record: it collects your payment details, bills you and handles sales tax and VAT. Polar sends us your Polar customer ID, your email, the product you bought, the billing country, the card brand and last four digits, and invoice history. We never receive or store your full card number. Polar's own privacy policy applies to the checkout page.

6. Talking to us

If you email hello@webvalet.app, use the contact form or reply to a report, we keep the conversation and your email address so we can answer and so we have a record of what was agreed. Support conversations are kept for 24 months.

7. Using the website and the dashboard

We use PostHog for product analytics: page views, button clicks, which audit steps complete, whether an audit turns into a sign-up and whether a checkout starts. Events are tied to a random ID before sign-in and to your account afterwards. We do not record sessions with replay, and we do not use advertising pixels. Cloudflare keeps short-lived request logs (IP, URL, status) for security and performance. See the Cookie policy for the cookies involved.

8. Autopilot connections

If you enable Autopilot we store the credential needed to apply changes on your site: a WordPress application password or plugin key, a Cloudflare API token scoped to your zone, or a Webflow or Shopify access token once those integrations ship. These are encrypted at rest with a key held outside the database and are used only to apply the changes you approved. Every change, its before and after value, who approved it and when, is recorded so it can be undone.

9. Things we deliberately do not collect

• Passwords. There are none; Google handles sign-in.
• Payment card numbers. Polar handles them.
• Data from Gmail, Drive, Calendar, Ads or any Google service other than the two read-only APIs you connect.
• Precise location. We see the country of your IP address for rate limiting and nothing finer.
• Special category data (health, religion, politics). If a crawled page contains such data about third parties, it is stored only as part of the public page content.

Under the GDPR and similar laws we need a legal basis for each use. Here they are.

We do not use your data for advertising, we do not sell it, we do not share it with data brokers, and we do not make automated decisions about you with legal or similarly significant effects. The audit score is an automated assessment of a website, not of a person.

WebValet uses Claude, a family of AI models made by Anthropic, to write the plain-English parts of the product: audit summaries, fix suggestions, rewritten titles and descriptions, the Monday report narrative, Ask WebValet answers, AI answer gap pages and persona reviews.

What is sent to Anthropic

• Content from your website's public pages (titles, headings, body text, structured data) and the issues our checks found.
• Aggregated numbers from Search Console and Analytics when a feature needs them, for example "clicks on /pricing fell 20% last week". We send totals and page paths, never visitor-level data.
• Your questions in Ask WebValet and the site data needed to answer them.
• Competitor pages and AI answers we have collected, for comparison features.

What is not sent

• Your name, email address or Google account details.
• Your Google tokens or any Autopilot credentials.
• Payment information.
• Raw Analytics rows about individual visitors.

No training on your data

We use Anthropic's commercial API. Under Anthropic's commercial terms, inputs and outputs sent through the API are not used to train Anthropic's models. Anthropic may retain API data for a limited period to detect abuse and then deletes it. We do not train our own models on your data either.

AI output can be wrong

AI-written suggestions are drafts. Autopilot shows you every change before it goes live and you can undo it in one click. Ask WebValet answers from your site's data but can still make mistakes, so check anything you plan to act on. We label AI-generated text in the dashboard.

In practice this means:

• We only use Google user data to provide and improve the features you see in WebValet: the Impact log, the real-traffic charts, the Found on Google module and the Monday report.
• We never transfer Google user data to others except as needed to provide those features (our hosting and database providers listed under Subprocessors), to comply with the law, or as part of a merger or acquisition with notice to you.
• We never use Google user data for advertising, never sell it, and never let humans read it except with your permission for support, for security reasons, or where the law requires.
• We never use Google user data to train generalised AI or machine-learning models. Aggregated numbers may be sent to Claude to write a sentence in your report, as described in the AI processing section, and that provider does not train on them either.
• Access is read-only. We do not modify anything in your Google account.

The dedicated Google data use page lists the exact scopes, the API methods we call, what is displayed and how to revoke access.

We share data only with service providers that help us run WebValet, each under a contract that limits what they can do with it. The full list with locations is on the Subprocessors page. In summary:

We may also disclose data when the law requires it, to protect someone's safety, to enforce our terms, or to a buyer if WebValet is sold, in which case this policy continues to apply and we will tell you first.

If you are on the Agency plan and invite team members or share a client portal, those people see the data for the sites in that workspace. You are responsible for who you invite.

WebValet is run from the United Arab Emirates. Our providers store data mainly in the European Union (our Cloudflare D1 database, Western Europe), the United States (Anthropic, Polar, Resend, PostHog, DataForSEO, Brandfetch, Google) and on Cloudflare's global network. Your data therefore crosses borders.

Where the GDPR or UK GDPR applies, transfers outside the EEA or UK rely on the European Commission's Standard Contractual Clauses (and the UK addendum) built into each provider's data processing terms, plus the EU-US Data Privacy Framework where the provider is certified. Where the UAE PDPL applies, we transfer data to countries with adequate protection or under contractual safeguards, as the law allows. Where the Saudi PDPL applies, we rely on the exceptions and safeguards for cross-border transfers in that law and its implementing regulations.

You can ask us at any time for a copy of the safeguards used for a particular provider.

The 90-day window after cancellation exists so you can come back without losing your Impact log and history. If you would rather we delete everything sooner, use Settings → Delete account or email privacy@webvalet.app and we will delete within 30 days.

Everything travels over HTTPS. Data at rest is encrypted by our database and storage providers. Google tokens and Autopilot credentials are additionally encrypted at the application level with a key stored as a Cloudflare secret, so a database leak alone would not expose them. Google scopes are the minimum read-only set. There are no passwords to leak. Access to production systems is limited to the founder with hardware two-factor authentication. The full picture, including how to report a vulnerability, is on the Security page.

If a breach affects your data we will tell you without undue delay, and the relevant regulator within 72 hours where the law requires it.

Depending on where you live, you have some or all of the following rights. We give them to everyone regardless of location.

• Access: ask for a copy of the personal data we hold about you.
• Correction: fix anything inaccurate. Name and email come from Google, so update them there and sign in again.
• Deletion: delete your account from Settings, or ask us. See the retention table for what remains (invoices).
• Portability: export your site data, Impact log and reports as CSV or JSON from Settings, or ask us for a machine-readable copy.
• Restriction and objection: ask us to stop a particular use, including any use based on legitimate interest.
• Withdraw consent: disconnect Google from Settings or from your Google account permissions. This does not affect processing that happened before.
• Opt out of marketing: every sequence email has an unsubscribe link. Alerts and the Monday report are part of the service and stop when you remove the site or cancel.
• Complain: to us first, please, and to a supervisory authority if you are not satisfied.

EU and EEA (GDPR)

You have all the rights above under Articles 15 to 22. You can complain to the data protection authority in your country. We have not appointed an EU representative under Article 27; we will do so if our processing of EU residents' data reaches the point where the law requires it.

United Kingdom (UK GDPR)

Same rights as above. The supervisory authority is the Information Commissioner's Office, ico.org.uk.

United Arab Emirates (Federal Decree-Law No. 45 of 2021, the PDPL)

You have rights of access, correction, erasure, restriction, portability and objection to automated decisions. Complaints go to the UAE Data Office. If you are in the DIFC or ADGM free zones, their own data protection laws may apply to a business established there; WebValet is established onshore in Dubai.

Saudi Arabia (Personal Data Protection Law)

You have the right to be informed, to access, to request a copy, to correct, to delete and to withdraw consent. The regulator is the Saudi Data and AI Authority (SDAIA). Where the Saudi PDPL requires consent for a particular use, we ask for it in the product.

California (CCPA/CPRA) and other US states

You have the right to know, to delete, to correct, to opt out of sale or sharing, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in the CCPA, and we do not use sensitive personal information to infer characteristics. We honour Global Privacy Control signals for analytics cookies. Authorised agents can submit requests on your behalf with proof of authority.

How to make a request

Email privacy@webvalet.app from the address on your account, or use Settings. We answer within 30 days (45 under the CCPA if we tell you we need longer). We may ask you to confirm you own the Google account. Requests are free unless they are clearly repetitive.

We use a small number of cookies: a WebValet session cookie to keep you signed in, a PostHog cookie for analytics (only after you accept it where consent is required), Cloudflare cookies for security and Turnstile for bot protection. We do not use advertising cookies. The Cookie policy lists every cookie, how long it lasts and how to opt out.

WebValet is for businesses and people who run websites. It is not directed at children, and you must be at least 18 (or the age of majority where you live) to create an account. We do not knowingly collect personal data from anyone under 16. If you think a child has given us data, email privacy@webvalet.app and we will delete it.

WebValet publishes teardown pages at webvalet.app/teardown/[domain]: editorial reviews of the public homepages of well-known companies, based on the same audit anyone can run. They contain data about a public website (scores, issues, screenshots), not personal data, except where a public page names a person. If you represent a company featured in a teardown and want a correction or removal, email hello@webvalet.app and we will respond within 5 working days.

When you audit or monitor a site you do not own, the audit reads only what any visitor's browser would see. See the Acceptable use policy for the rules.

We will update this policy when the product changes, for example when Autopilot adds a new platform or we add a provider. Small changes are posted here with a new date. For changes that reduce your rights or add a new use of your data, we email account holders at least 14 days before they take effect. The date at the top is always the version in force.

Privacy requests

privacy@webvalet.app

Security reports

security@webvalet.app

Everything else

hello@webvalet.app

Post

WebValet, c/o Shaheer Malik, Dubai, United Arab Emirates (full postal address available on request)