Privacy Policy

1. Introduction

WhatWebCo ("we", "us", or "our") operates the whatwebco.com website and the WhatWebCo application (collectively, the "Service"). This Privacy Policy explains how we collect, use, store, and share information — including data obtained through Google APIs — when you use our Service.

2. Information We Collect

• Account information: name and email address when you register.
• Usage data: pages visited, features used, browser type, IP address, and device identifiers.
• Payment information: processed by our third-party payment provider; we do not store full card numbers.
• Lead & CRM data: business names, contact details, notes, and tasks you create within the Service, including business contact details we source and enrich on your behalf. See Section 5 for details.
• Google user data: if you connect your Google account, we may access your Google profile information (name and email), Google Calendar events, and your Gmail account's send capability solely to provide Service features such as calendar sync and email integration. See Section 4 for details.

3. How We Use Your Information

• To provide, maintain, and improve the Service.
• To authenticate your identity and manage your account.
• To process transactions and send related notices.
• To respond to support requests and communicate updates.
• To detect, prevent, and address fraud and security issues.
• To comply with legal obligations.

4. Google User Data — Access, Use, Storage & Sharing

When you authorise WhatWebCo to connect with your Google account, we adhere to theGoogle API Services User Data Policy, including the Limited Use requirements.

4.1 What We Access

• Basic Google profile data (name, email address, profile photo URL).
• Google Calendar events (read & write) to sync appointments within the Service.
• Gmail send capability to send emails on your behalf through the Service.

4.2 How We Use Google Data

• To display your Google Calendar events alongside WhatWebCo tasks and appointments.
• To send emails from the Service using your Gmail account when you choose to do so.
• To pre-fill your profile with your Google name and email.

We do not use Google user data for advertising, market research, or any purpose unrelated to providing and improving the Service.

4.3 How We Store Google Data

• OAuth tokens are stored encrypted at rest in our database.
• Cached calendar data is stored only as long as needed to provide the Service and is automatically purged when you disconnect your Google account.
• We do not read, access, or store the content of your emails — we only use Gmail's send capability to send messages on your behalf.

4.4 How We Share Google Data

• We do not sell, rent, or trade Google user data to third parties.
• Google data may be shared with infrastructure sub-processors (e.g., cloud hosting providers) solely to operate the Service, under strict confidentiality agreements.
• We may disclose Google data if required by law or valid legal process.

4.5 Revoking Access

You can disconnect your Google account at any time from Settings → Integrations within the Service, or by visiting your Google Account permissions page. Upon disconnection, we delete stored Google tokens and cached Google data within 30 days.

5. Business Contact Enrichment

To help our customers reach the right contact at a business, we enrich lead records using publicly available sources: the business's own public website, and — for UK limited companies — the Companies House public register.

5.1 What We Access

• Company name, company number, and registration status via the Companies House Public Data API.
• The name of a currently-serving director or officer, where a confident match is found.
• We do not access nationality, date of birth, or residential address data, even though it is available from the same source.

5.2 Legal Basis

Company officer information is a public register maintained by UK law specifically so third parties can identify who controls a company. We process this limited data on the basis of our legitimate interests (Article 6(1)(f) UK GDPR) in identifying an appropriate point of contact at businesses that may benefit from the Service, having weighed this against the interests and reasonable expectations of the individuals concerned.

5.3 Your Rights

If you are a director whose name has been attached to a lead record and you would like it removed, contact us at privacy@whatwebco.com and we will delete it. This right exists independently of any rights held by the WhatWebCo customer that owns the lead record.

6. Data Sharing & Third Parties

We may share non-Google data with trusted third-party service providers who assist us in operating the Service (hosting, analytics, payment processing). These providers are bound by confidentiality obligations and may only use your data to perform services on our behalf.

We do not sell your personal information to any third party.

7. Data Retention

We retain your account data for as long as your account is active or as needed to provide the Service. If you delete your account, we will remove your personal data within 90 days, except where retention is required by law.

8. Security

We implement industry-standard security measures including encryption in transit (TLS) and at rest, access controls, and regular security assessments to protect your data.

9. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, or export your personal data. To exercise these rights, contact us at privacy@whatwebco.com.

10. Cookies

We use essential cookies to maintain your session and preferences. We may use analytics cookies to understand how the Service is used. You can control cookie preferences through your browser settings.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the effective date. Your continued use of the Service after changes constitutes acceptance.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at privacy@whatwebco.com.