Privacy Policy

Effective date: 9 October 2026 · Last updated: 9 October 2026

Version: 1.6

This Privacy Policy explains what personal data Webimaker collects when you use Webi, why we collect it, who receives it, how long we keep it and how we protect it. It also explains your rights and how to use them.

Webi AI (the app called "Webi" on your phone) is a product of Webimaker ("Webimaker", "we", "us", "our"), based in West Bengal, India. Please read this policy together with our Terms & Conditions, Refund & Cancellation Policy and Shipping & Delivery Policy. You can open all four in the app under Settings > Legal.

Finding Settings: open the menu (the ☰ button at the top left), then tap the gear icon "Settings". You can also tap your name at the bottom of the menu.

The short version

• We collect what we need to run Webi: your account details, your chats, Business profiles and their policies, and email drafts, the photos and documents you attach, daily usage counts, plan and purchase records, and emails you send us.
• Your messages are sent to our AI service provider to generate Webi's answers (see section 6). Depending on the terms that apply to our use of its service, it may keep that content, use it to improve its products, and have people review it. Do not type sensitive personal information into Webi.
• If you send emails from Webi, they go from your phone straight to your own email provider (for example Gmail). Your email address and app password are saved only on your phone, encrypted, and never sent to us.
• Photos and documents you attach are stored with your chat by our hosting provider, Supabase, and sent to our AI service provider so Webi can read them (see sections 3, 6 and 7). Deleting a chat or your account deletes its files. We may also clear stored files from time to time to keep our storage within its limits; your chats stay, but those files can then no longer be opened. Do not attach files with other people's sensitive personal information (for example ID cards or bank statements) unless you are allowed to share them.
• Google Play handles all payments. We never see your card, UPI or bank details.
• No ads, no analytics tools, no third-party trackers. We do not sell your personal data.
• You are in control. You can download your data, correct it, delete chats and delete your account at any time in the app.
• Questions? Email support@webimaker.com.

1. Who we are

Webimaker provides Webi and is responsible for your personal data. This makes us the "controller" under laws such as the EU and UK General Data Protection Regulation (GDPR), and the "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act").

• Name: Webimaker (product: Webi AI, app name "Webi")
• Registered address: Bagula Bus Stand, near PNB Bank ATM, Bagula, Nadia, West Bengal 741502, India
• Email for everything (support, privacy, complaints, refunds and account deletion): support@webimaker.com
• Telephone: we provide support by email. If you ask at support@webimaker.com, we will email you our telephone number without delay.

Privacy contact

Privacy contact: Webimaker, support@webimaker.com, Bagula Bus Stand, near PNB Bank ATM, Bagula, Nadia, West Bengal 741502, India

We (Webimaker, at support@webimaker.com) answer questions about how we process personal data and handle privacy requests and complaints from every country. This same contact also covers the privacy roles that other laws describe, for example:

• the person in charge of the protection of personal information (Quebec, Canada);
• the individual responsible for data protection under Singapore's Personal Data Protection Act;
• the chief privacy officer (South Korea); and
• the data protection contact, or "encarregado" (Brazil).

If we appoint a representative for any region, we will add their details to this section.

2. What this policy covers

This policy applies to:

• the Webi app for Android;
• emails between you and us; and
• the public web pages where we publish our policies.

It does not cover services run by other companies, such as Google Play or the email service you use to write to us, even when you reach them from Webi. Their own privacy policies apply to them.

Where Webi is offered

Webi is offered only in countries where it is available on Google Play, and we may limit where it is available. This policy includes information for people in many regions (see section 14). Including a region in this policy does not mean that Webi is offered there.

Language

This policy is written in English. If you would like to read it in Hindi, Bengali or another language listed in the Eighth Schedule to the Constitution of India, email us and we will provide a translation. If a translation differs from the English text, the English text applies, unless your local law says otherwise.

3. The personal data we collect

This section lists, item by item, all the personal data Webi collects.

Account details

When you sign up, you give us:

• your full name;
• your email address;
• a password;
• your country (chosen from a list); and
• your phone number (checked for a valid format and saved in international format, for example +91 followed by your number).

We also create an account id and record when your account was created and last updated.

Your password is handled by our hosting provider's sign-in service (Supabase Auth), which stores it only in hashed form. The Webi app never stores your password.

All of these details are required. If you do not give them, we cannot create your account.

Why we ask for your phone number. We use it only to:

• identify your account when you contact support or ask us to delete your account;
• help keep your account secure, for example to check that a request really comes from you; and
• contact you about something important to do with the service, if that is ever needed.

We never use your phone number for marketing and we never sell it. Webi does not currently send SMS messages or call users.

Your consent record

The sign-up screen shows one box, which is already ticked:

"I agree to the Terms & Conditions and Privacy Policy, including Webi using my messages to generate AI replies."

The names "Terms & Conditions" and "Privacy Policy" in the box are links that open the full documents, so you can read them before you sign up. You can untick the box, but you cannot create an account while it is unticked. By tapping Create account with the box ticked, you agree to the Terms & Conditions and consent to the processing described in this Privacy Policy, including Webi using your messages to generate AI replies.

We store, with your account, the versions of the Terms & Conditions and the Privacy Policy you accepted (each recorded as a date, for example 2026-10-09 for version 1.6) and the time you gave consent. These details are included when you use Download my data. You can withdraw your consent at any time (see section 12).

Your chats and Business profiles

• Chats: each conversation's title, whether it is pinned, which Business profile you chose for it (if any), its step-by-step plan when Webi guides you through one (the steps, which are done, and when it changed), and its dates and times.
• Messages: every message you send and every answer Webi gives you, including Deep Reports and the documents and website code made in Canvas.
• Business profiles: the name and the details you type about your business. Webi uses a Business profile in a conversation when you choose it for that conversation, or when your messages in that conversation name it (or ask about your business, if it is your only profile).
• Policies: the rules you save in a Business profile (for example returns, delivery or payment), each with a type, a title and its text.
• Customer replies and email drafts: when you use Reply to a customer, the customer's message you paste (and any screenshot you attach) and Webi's reply; when you use Write an email, your request and Webi's draft, your edits, the To and Cc addresses you enter, and, after you send it, the sender name, the design you used and the time it was sent. These are saved in the chat. Your sending email address is not saved with them.

Your chats contain whatever you choose to write. That can include information about you, your business or other people.

Photos and documents

If you use Photo or Document (the + button next to the message box), we also collect:

• the photos (JPG or PNG) and documents (PDF, Word, Excel, PowerPoint, TXT or CSV) you choose to attach to a message;
• their details: file name, type, size, and pixel size or number of pages; and
• which chat and message each file belongs to.

Webi makes photos smaller on your phone before it uploads them, and removes their location and camera details (EXIF data). Documents are uploaded as they are. For Word, Excel, PowerPoint, TXT and CSV files, Webi also reads their text on your phone, so that it can send that text to the AI. Nothing is uploaded until you tap Send.

A photo or document can contain information about you or other people, for example a face, a name, a phone number or a bill. Only attach files that you have the right to share, and do not attach files with other people's sensitive personal information (for example ID cards, bank statements or medical reports) unless you are allowed to share them.

Usage information

• How many messages and Deep Reports you use each day, so we can apply your plan's daily limits. The limits reset at 12:00 AM India Standard Time (IST).
• How many photos and documents you upload each day, for the same reason.
• The timing details we need to give a message back to your daily count if an answer fails.
• How many messages you have sent in the current minute (a short running count, not a history), so we can apply a fair-use limit on how many messages can be sent per minute.

Plan and purchase information

Google Play handles all payments for paid plans. When you buy, renew or change a plan, Google Play tells us the following, and we store it with your account:

• your plan;
• the Google Play purchase token, order id, product id and base plan;
• purchase, renewal and expiry times;
• whether the subscription renews automatically;
• the price and currency, as Google Play reports them; and
• the status of the subscription (active, pending, cancelled, expired, revoked or replaced), whether the purchase has been acknowledged with Google Play, and when the app last checked it with Google Play and reported it to us.

If we give you a plan by hand (for example, to fix a billing problem), we record that plan, when it starts, when it ends (if it has an end date), and a short internal note about why we gave it.

Google also shows us order details in our Google Play Console, such as the order number, product, price, date and status, and the buyer's country (and in some cases region or postal code). We use this only to answer billing questions and handle refunds.

We never receive your card, UPI or bank details. Google Play handles them under its own terms.

Emails you send us

If you email us, we receive your email address and whatever you put in the email and its attachments.

When you use Settings > Help & support > Contact support or Report a problem, Webi opens your email app with a message that already includes your app version, Android version, device model and account id, to help us find the problem. You can read and change this before you send it.

If an AI answer, in the main chat or in AI Help, is wrong, offensive or harmful, you can tell us the same way, or by emailing support@webimaker.com. Webi does not send us the answer by itself: we receive only what is in your email, so please include the text of the answer or a screenshot.

AI Help questions

AI Help (Settings > Help & support > Help center) answers questions about using Webi. It is available only when you are logged in.

• Your Help questions and Help's answers are sent to our AI service provider to generate the answers (see section 6).
• They are not stored on our servers. They are kept only in your phone's memory while the app is open, and they are gone when the app is closed.
• Your phone keeps a daily count of the Help questions asked on it, so that the number of questions per day can be limited.

Technical information

• Our hosting provider, Supabase, receives your device's IP address and basic technical details of each request (such as its time and the app's request details), including when the app uploads or opens a photo or document. It also records sign-in and account security events (such as the time, IP address, account id, email address and name). These logs are used to keep the service secure, prevent abuse and keep it running.
• Our AI service provider receives your device's IP address and request metadata each time Webi sends it a message or a Help question, because the app connects to it directly from your phone (see section 6).

Information stored only on your phone

Webi keeps some information only on your phone, in the app's private storage:

• your login session (sign-in tokens, with your account id, email address, name, country and phone number) and, while you wait for an email confirmation code or a password-reset code, the email address it was sent to;
• your theme choice (System, Light or Dark);
• a copy of your pinned chats (chat ids and when you pinned them), so they load quickly;
• markers that remember which notices you have already seen;
• your daily AI Help question count;
• if you set up email sending for a Business profile: your email provider and server settings, email address, sender name, the design you chose for professional emails, and your app password or email password. All of it is encrypted with a key kept in Android's secure key store on your phone. It is never sent to us. It is deleted when you remove it, delete that profile, log out, your session ends, or you delete your account;
• a list of the emails you sent from this phone (which draft and when, without addresses), which sends were still in progress, and how many emails you sent today, used to show "Sent" or "Not sure it was sent" and to apply Webi's daily sending limit;
• copies of photos and files you are about to send, and of the photos and files in your chats, kept in the app's cache so they show quickly. They are deleted when you log out or delete your account; copies of files you did not send are deleted the next time you open Webi after 24 hours, and older copies are removed when the cache gets full; and
• a temporary marker used while you switch plans (it holds the Google Play purchase token being replaced).

None of this is copied into Android cloud backup or onto a new phone when you transfer your data.

When you sign up, or change your country in Settings, Webi uses your phone's SIM card, mobile network or language settings to suggest a country. You always confirm or change it. Webi tells the AI the country saved on your account (or, if none is saved, the country your phone suggests), and in chats also that country's currency, so answers fit where you are.

Google Play also tells the app the country of your Google Play account. Webi uses it only to choose the currency for the plan prices it shows you (AI Help receives these same prices, see section 6). Webi keeps it only in the app's memory and never sends it to the AI or to our servers. Until Google Play has told the app this country, Webi uses the country on your account, or else your phone's country, to choose that currency.

What we do not collect

Webi does not:

• ask for your precise location;
• access your contacts, camera or microphone, or browse your photos or files: Webi only receives a photo or file you pick yourself in Android's photo picker or file picker;
• use an advertising ID;
• include advertising, analytics or crash-reporting tools; or
• ask for sensitive personal information, such as health information or government ID numbers.

4. Where your data comes from

• From you: when you sign up, chat, attach photos or documents, create Business profiles or email us.
• From your phone: technical information, your phone's country, and the information listed under "Information stored only on your phone" in section 3.
• From Google Play: your purchase and subscription records, and your Google Play account's country (kept only in the app's memory and used only for prices).
• From the AI: the answers that our AI service provider's AI model generates for you, which we save in your chats.
• From our hosting provider: technical and security logs.

We do not buy personal data from data brokers or collect it from other sources.

5. How we use your data, and our legal bases

We use your personal data only for the purposes below. Laws such as the GDPR require us to give a "legal basis" for each purpose. India's DPDP Act works differently; see "India: consent and legitimate uses" at the end of this section.

Purposes and legal bases

• To create and run your account (sign-up, email confirmation, login, password reset and your profile). Legal basis: performance of our contract with you.
• To provide the AI chat: sending your messages and their context to our AI service provider, showing you the answers (including Deep Reports), and saving your chats and Business profiles. Legal basis: performance of our contract with you. Webi cannot write answers without sending your messages to our AI service provider, so this is necessary for that contract. Any use our AI service provider makes of this content for its own purposes under its terms (see section 6) is its own processing, and it is responsible for it.
• To store your photos and documents with your chats and send them to our AI service provider with your messages (including letting you open, save and share them, and deleting them when you delete a chat or your account). Legal basis: performance of our contract with you. Any use our AI service provider makes for its own purposes is its own processing, as above.
• To answer your AI Help questions. Legal basis: performance of our contract with you. Any use our AI service provider makes for its own purposes is its own processing, as above.
• To apply plan limits and fair use (daily and per-minute counts and resets, including daily uploads). Legal basis: performance of our contract with you, and our legitimate interest in preventing abuse of the service.
• To sell and manage paid plans with Google Play: checking purchases, unlocking your plan, restoring purchases, handling billing questions and refunds, and giving a plan by hand where needed. Legal basis: performance of our contract with you, and legal obligation where the law requires us to keep transaction records.
• To use your phone number to identify your account, keep it secure and contact you about something important. Legal basis: our legitimate interest in identifying your account when you contact us, confirming who is making a request, keeping accounts secure and reaching you about important service matters.
• To keep Webi and your account secure and to prevent fraud and abuse. Legal basis: our legitimate interest in protecting Webi, our users and our business.
• To give support and handle complaints and privacy requests. Legal basis: performance of our contract with you, legal obligation where the law requires us to respond, and our legitimate interest in helping our users.
• To keep proof of your consent and of the terms you accepted. Legal basis: legal obligation where a law requires it, and otherwise our legitimate interest in being able to show what was agreed.
• To send you service messages, such as email confirmation codes, password reset codes, and notices about changes to our policies or about a security incident. Legal basis: performance of our contract with you, and legal obligation where the law requires the notice.
• To comply with the law, respond to lawful requests from authorities, enforce our Terms & Conditions, and establish, exercise or defend legal claims. Legal basis: legal obligation, and our legitimate interest in protecting our rights.
• To carry out a business transfer (see section 7). Legal basis: our legitimate interest in being able to sell or reorganise our business.

Under the GDPR and UK GDPR, "legal obligation" covers only obligations under EU, EU member state or UK law. Where we follow other laws, such as Indian law, we rely on our legitimate interest in complying with them.

Where we rely on legitimate interests, we have checked that they are not overridden by your interests and rights. You can object at any time (see section 12).

What we do not do

• We do not use your data for advertising and we do not build marketing profiles about you.
• We do not send marketing messages. If that ever changes, we will ask for your consent first where the law requires it.
• Webimaker does not use your chats or files to train AI models. What our AI service provider may do with content it receives is explained in section 6.

India: consent and legitimate uses

Under the DPDP Act, we process your personal data on the basis of the consent you give when you sign up by tapping Create account with the consent box ticked (section 3), for the purposes described in this policy. You can withdraw your consent at any time (see section 12).

We may also process personal data without consent for the "legitimate uses" that section 7 of the DPDP Act allows. For example, when you voluntarily give us data for a specific purpose and have not told us you object (such as emailing us for support), or when we must comply with a law, a court order or a lawful request from the government.

6. How Webi's AI works

Webi's answers are written by an AI model, not by a person. In this policy, "our AI service provider" means a third-party company in the United States that provides the AI model that writes Webi's answers.

What Webi sends to our AI service provider

Each time you send a message in a chat, Webi sends our AI service provider:

• your message;
• the photos and documents you attached to it, with their file names (photos and PDF files as files; for Word, Excel, PowerPoint, TXT and CSV files, the text Webi read from them);
• the recent messages in that conversation (yours and Webi's earlier answers), including some of the recent photos and documents in it again, so that Webi can answer follow-up questions about them;
• the Business profile you chose for that conversation (its name, details and policies), if any; if none is chosen, the names and a short summary of each of your Business profiles, and the full profile of any business your message names or that the conversation is still about (named in your last messages, or in Webi's last answer when you reply to it briefly), or of your only profile when you ask about "my business" or about its policies, products, customers or prices;
• the step-by-step plan saved for that conversation, if Webi is guiding you through one (its steps and which are done), and, while Webi waits for your answer to its offer of such a plan, a short part of that offer;
• today's date;
• your country and its currency; and
• Webi's own instructions to the AI.

When you use Reply to a customer, your message is the customer's message you paste (and any screenshot you attach), with your optional note. When you use Write an email, your message is your request. Your email sign-in details, and the To and Cc addresses you type on a draft, are never sent to our AI service provider.

When you use AI Help, Webi sends our AI service provider your question, the earlier questions and answers from the same Help session, today's date, whether you are signed in, Webi Help's own instructions, your plan name, how many messages you have left today and your daily limit, the list of Webi's plans with their prices and features, your country and the app version.

For chat messages and AI Help, the app connects to our AI service provider directly from your phone, so our AI service provider also receives your device's IP address and request metadata.

What Webi does not send

Webi does not send our AI service provider your name, email address, phone number, password, payment details, or your Google Play purchase details (such as your order id, purchase token, purchase and renewal times or the price you paid), unless you type them into a message, a Business profile or AI Help yourself, or they appear in a photo or document you attach. The only information about your plan that is sent is what AI Help uses, as listed above: your plan name, how many messages you have left today and your daily limit.

How our AI service provider handles this content

Our AI service provider processes this content under the terms that apply to our use of its service. Depending on those terms, it may:

• keep the content;
• use it to provide, improve and develop its own products and services; and
• have human reviewers read it.

Our AI service provider may process this content in the United States and other countries. Where it uses content for its own purposes, as described above, it does so on its own behalf and is responsible for that use. If you would like a summary of the terms that currently apply, including how long it keeps content and whether it uses content to improve its products, or if you want to make a request about how it handles your data, email us at support@webimaker.com. We will answer you and, where needed, pass your request on to it.

We cannot delete content that our AI service provider has already received, including photos and documents. Deleting a chat or your account removes it from our systems, but not from our AI service provider's.

Please do not enter sensitive personal information

Because of this, do not type any of the following into chats, Business profiles or AI Help, and do not attach photos or documents that contain it (for example pictures of ID cards, bank statements or medical reports):

• health or medical information;
• government ID numbers (such as Aadhaar, PAN, passport or social security numbers);
• passwords or one-time codes (OTPs);
• full card or bank account numbers; or
• other people's private information.

If you enter information about other people, such as your customers or employees, you are responsible for making sure you are allowed to share it.

AI answers can be wrong

AI answers can be inaccurate, incomplete or out of date. They are not professional legal, financial, tax or medical advice, so please check anything important. Our AI service provider's automated safety systems may also block some questions or answers. Our Terms & Conditions explain this in more detail.

Website previews in Canvas

When you preview a website made in Canvas, the preview runs inside the app and does not connect to the internet. If you tap a link in it and confirm, the link opens in another app, such as your browser, which handles it under its own terms.

7. Who receives your data

We share personal data only with the recipients below. For each one we explain who it is, how to contact it (for our AI service provider and our email service provider, how to contact us about it), where it is, what it receives, why, when and how, how long the data is kept, and how you can refuse.

Supabase, Inc. (hosting, sign-in and file storage)

Supabase hosts our database, sign-in service and file storage, and sends, through our email service provider (see below), the emails with the codes that confirm your address and reset your password. It processes data for us under its Data Processing Addendum and uses its own sub-processors.

• Contact: Supabase, Inc., privacy@supabase.com (see also Supabase's privacy notice).
• Where: a company based in the United States. Its servers may be outside your country.
• What: your account details, consent record, chats and messages, Business profiles, the photos and documents in your chats with their details (file name, type, size, pixel size or number of pages), usage counts, plan and purchase records, and technical and security logs.
• Why: to store your data and files, run sign-in, let only your account open your files, and send account emails.
• When and how: continuously, whenever you use Webi, over encrypted (HTTPS) connections.
• How long: as described in section 9 (files: until you delete the chat or your account, or until we clear stored files; then they are deleted from storage within minutes, at the latest within 24 hours).
• How to refuse: do not create an account, or delete your account (section 10).

Our AI service provider (AI answers)

• Who: a third-party company that provides the AI model that writes Webi's answers (see section 6).
• Role: it processes the content of your messages, attached files and Help questions for us, to generate answers. It acts on its own behalf, as an independent controller, for the technical data it collects when the app connects to it, such as your IP address, and for any use of content for its own purposes that the terms that apply allow (see section 6).
• Contact: for any question about how our AI service provider handles your data, email us at support@webimaker.com.
• Where: a company based in the United States, which may process data in other countries.
• What: the content and metadata listed in section 6.
• Why: to generate Webi's answers and AI Help's answers.
• When and how: each time you send a message or a Help question, directly from your phone, always over encrypted (HTTPS) connections.
• How long: as set by the terms that apply to our use of its service. Email us and we will tell you the period that currently applies. We cannot delete content our AI service provider has received.
• How to refuse: do not send the information. Webi cannot work without the AI, so if you do not want your messages sent to our AI service provider, please do not use Webi. You can delete your account at any time.

Google and its affiliates: Google Play (payments)

When you buy a paid plan, Google Play and Google Payments process your payment and order information as an independent controller, under the Google Play Terms of Service, the Google Privacy Policy and the Google Payments Privacy Notice.

• Contact: Google, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, through the contact options in the Google Privacy Policy.
• Where: the United States and other countries where Google operates.
• What: Google receives your payment details from you directly. With each purchase, Webi gives Google Play your Webi account id (a random code that identifies your Webi account, not your name, email or phone number), so that the subscription is linked to your Webi account and cannot be used by another account. Google Play and Webi exchange the purchase information listed in section 3.
• Why: to take payments, manage subscriptions and handle refunds.
• When and how: when you buy, renew, change, cancel or restore a plan, over encrypted connections.
• How long: Google keeps its own order records under its own policies.
• How to refuse: use the Free plan.

Our email service provider (support email and account emails)

• Who: our email service provider, which hosts the support@webimaker.com mailbox and delivers the account emails Webi sends you (the codes to confirm your email address and to reset your password).
• Role: it stores and handles our support emails, and delivers our account emails, for us, as our service provider.
• Contact: for any question about how our email service provider handles your data, email us at support@webimaker.com.
• Where: it may process your emails outside your country.
• What: the content of the emails you send to support@webimaker.com (including your email address and any attachments) and our replies; for account emails, your email address and the email's content, including the one-time code.
• Why: to answer your support requests, questions and complaints, and to deliver account emails.
• When and how: each time you email us or we reply to you, and each time Webi emails you a code.
• How long: support emails are kept for up to 24 months (see section 9). Copies of account emails are kept under our email service provider's terms; each code stops working 1 hour after it was sent, or once it has been used.
• How to refuse: use the tools in the app instead of email where you can. Account emails are needed to create an account and to reset a password.

Your own email provider (emails you send from Webi)

• Who: the email provider you choose when you set up email sending (for example Gmail, Zoho Mail, Yahoo Mail or your web host's email service).
• Role: it is your own service provider, chosen by you, and handles your emails under its own terms and privacy policy. Webimaker is not involved in delivering them and never receives them.
• What: your email address and app password (to sign in), and each email you send: the To and Cc addresses, the subject, the text and design, and your sender name. When you tap Save or Send test email, it also receives the sign-in check or the test email.
• When and how: only when you tap Save, Send test email or Send, directly from your phone, over an encrypted (TLS) connection. Webi checks the server's security certificate before it sends your password.
• How long: as set by your email provider (for example, emails in your Sent folder).
• How to refuse: don't set up email sending; use Copy or Open in email app instead.

Authorities and legal claims

We disclose personal data to courts, regulators, law enforcement or other authorities only when the law requires us to, for example under a valid court order or a lawful request from a government authority. We may also use or disclose personal data where needed to establish, exercise or defend legal claims. Where the law allows and it is practical, we will tell you first.

Business transfers

If Webimaker or Webi is sold, merged or transferred to another organisation, your personal data may be transferred to the buyer, who must use it in line with this policy. We will tell you in the app or by email before the transfer, and you can delete your account before it happens.

No other sharing

We do not sell or rent your personal data, we do not share it for advertising, and we do not give it to data brokers.

8. International transfers

Webimaker is based in India. Supabase is based in the United States and its servers (including where your files are stored) may be in other countries. Our AI service provider is based in the United States and may process data in the United States and other countries. Google, for Google Play payments, processes data in the United States and other countries. Our email service provider, which hosts the support@webimaker.com mailbox and delivers our account emails, may process support emails and account emails outside your country.

We cannot name every country in advance, because these providers choose, and can change, the sub-processors and data centres they use. For reference, Supabase lists its sub-processors and their locations in its sub-processor list, and Google lists its data centre locations on its data centre locations page.

This means your personal data is processed outside the country where you live, including in countries whose data protection laws may be different from, and in some cases less protective than, the laws of your country.

To protect your data when it is transferred:

• Adequacy: the European Commission, the UK and Switzerland have not recognised India as giving an adequate level of data protection. For the United States, their adequacy decisions cover only companies certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework.
• Webimaker (India): you give your data to us directly, and we protect it as described in this policy wherever we access it.
• Supabase: we rely on the European Commission's Standard Contractual Clauses (controller-to-processor module), with the UK Addendum and the Swiss amendments, which form part of Supabase's Data Processing Addendum.
• Our AI service provider (United States): our AI service provider is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, so transfers to it in the United States are covered by those adequacy decisions. Where adequacy does not cover a transfer, our AI service provider states that it relies on Standard Contractual Clauses.
• Google (Google Play): Google has certified that it follows the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, so transfers to Google in the United States are covered by those adequacy decisions. For transfers that adequacy does not cover, Google says it relies on Standard Contractual Clauses (see Google's data transfer frameworks).
• Our email service provider: where support emails and account emails are transferred outside your country, we rely on the transfer safeguards in our email service provider's terms (for example, an adequacy decision or standard contractual clauses, where the law requires them). You can ask us which safeguards currently apply.
• Consent: where a law requires your consent for a transfer (for example in Japan), we rely on the consent you gave at sign-up after being told about the transfers in this policy.
• Brazil: for transfers of data about people in Brazil, we rely on the standard contractual clauses approved by Brazil's National Data Protection Authority (ANPD) where our providers include them in their terms, and otherwise on the transfer being necessary to perform our contract with you (LGPD Article 33, IX, with Article 7, V), as explained in this section. You can ask us for the full text of the clauses we rely on, and we will send it within 15 days.

Data processed in another country may be accessed by the courts, law enforcement and national security authorities of that country, under that country's laws.

India's DPDP Act allows personal data to be transferred outside India, except to countries the Government of India restricts. We will follow any such restriction.

You can ask us for more information about these safeguards, or a copy of them, by emailing support@webimaker.com.

9. How long we keep your data

We keep personal data only as long as we need it for the purposes in this policy.

• Account details (name, email, phone number, country, account id): as long as your account exists. Deleted immediately when you delete your account.
• Consent record: as long as your account exists. Deleted with your account.
• Chats and messages (including email drafts and the record of emails you sent): until you delete the chat, use Clear all chats, or delete your account.
• Photos and documents in your chats: as long as their chat exists: until you delete the chat, use Clear all chats, or delete your account. The files are then deleted from storage within minutes, and at the latest within 24 hours. A file that was uploaded but never saved with a message (for example because the app was closed while sending) is deleted automatically within about a day. To keep our file storage within its limits, we may also delete all stored photos and documents from time to time, without notice. Your chats and messages stay; those files then show as "File no longer available" and can no longer be opened. Save any file you want to keep.
• Business profiles and their policies: until you delete the profile or your account.
• Usage counts: as long as your account exists. Deleted with your account.
• Plan and purchase records: as long as your account exists. Deleted with your account.
• AI Help conversations: not stored on our servers. Kept only in your phone's memory while the app is open.
• Support emails: as long as we need them to handle your request, and no longer than 24 months.
• Technical and security logs: kept by our hosting provider for security and abuse prevention, then deleted automatically within 90 days.
• Information on your phone: your login session until you log out or delete your account; your email sending settings until you remove them, delete the profile, log out or delete your account; the list of emails sent from the phone until you log out or delete your account (only the latest 300 are kept); the cached copies of photos and files until you log out or delete your account (copies of files you did not send until the next time you open Webi after 24 hours); the copy of your pinned chats and the notice markers until you delete your account; the plan-switch marker only until your plan switch is recorded (and never after you delete your account); your theme choice and the Help question count until you clear the app's storage or uninstall Webi. Clearing the app's storage or uninstalling Webi removes all of this information. The Help question count starts again each day.
• Backups: deleted data can remain in our hosting provider's database backups for up to 30 days, until those backups are overwritten.
• Records the law requires us to keep: see "What deletion cannot reach" in section 10.
• Account emails (the codes to confirm your email address and to reset your password): each code stops working 1 hour after it was sent, or once it has been used. Copies of these emails held by our email service provider are kept under its terms.
• Copies held by our AI service provider and by Google Play: kept under the terms that apply to them, which we do not control. For our AI service provider, email us and we will tell you the period that currently applies.

We do not currently delete inactive accounts automatically. If we decide to, we will update this policy and warn you by email before deleting anything.

10. Deleting your data and your account

Deleting chats and Business profiles

• You can delete a single chat at any time.
• To delete all your chats, go to Settings > Your data > Clear all chats. This does not delete your Business profiles.
• To edit or delete a Business profile, go to Settings > Your data > Business profiles.
• Deleting a Business profile deletes its policies and removes its email sending settings from your phone. Emails you already sent stay with the people you sent them to and in your email account.
• Deleting a chat (or using Clear all chats) also deletes the photos and documents in it: from our database straight away, and from storage within minutes (at the latest within 24 hours), even if your phone goes offline right after.

Deleted items are removed from our database permanently. "What deletion cannot reach" below explains the copies that deletion does not cover.

Before you delete your account

• Cancel your Google Play subscription first. Deleting your Webi account does not cancel it, and uninstalling Webi does not cancel it either. To cancel, go to Settings > Plan > Manage subscription, or open the Play Store, tap your profile icon, then Payments & subscriptions > Subscriptions > Webi > Cancel subscription.
• Any paid time you have left is lost when you delete your account. It is not refunded, except where the law requires a refund. See our Refund & Cancellation Policy.
• If you want a copy of your data, use Settings > Your data > Download my data before you delete your account. The file lists your photos and documents but does not contain the files themselves, so save any you want to keep from the chat first (open the photo and tap Save, or tap a document and then Save a copy).

Deleting your account in the app

1. Open the menu (the ☰ button at the top left), then tap the gear icon "Settings".
2. Under Account, tap Delete account.
3. Enter your password, type DELETE, then tap Delete my account permanently.

Everything linked to your account is then deleted permanently and immediately: your profile and login, your consent record, all chats and messages, the photos and documents in your chats (removed from storage within minutes, at the latest within 24 hours), your Business profiles, usage counts, and plan and purchase records. Your login session and the account data Webi keeps on your phone (the cached copies of photos and files, the copy of your pinned chats, the notice markers and any plan-switch marker) are cleared at the same time. Your theme choice and the phone's daily AI Help question count are not linked to your account. They stay on the phone until you clear Webi's storage or uninstall it. This cannot be undone.

Deleting your account by email

You can also ask us by email, for example if you have uninstalled Webi or cannot log in. Email support@webimaker.com from the email address of your Webi account, with the subject "Delete my Webi account". We will ask you to confirm the request, and we will delete your account within 30 days of your confirmation. The points in "Before you delete your account" apply here too.

What deletion cannot reach

When you delete your account, a few copies are outside the reach of that deletion:

• Backups: our hosting provider's database backups may contain your deleted data for up to 30 days, until they are overwritten.
• Content our AI service provider has already received (see section 6), including photos and documents.
• Google Play's own order records, including the Webi account id linked to each purchase. Google is an independent controller and keeps its own records of your purchases.
• Emails in our support mailbox, which we keep for up to 24 months. You can ask us to delete them sooner, unless we need them for a legal claim or a legal obligation.
• Technical and security logs kept by our hosting provider, deleted automatically within 90 days (see section 9).
• Records the law requires us to keep. Where a law requires us to keep certain records (for example, transaction records, or the processing logs required under India's Digital Personal Data Protection Rules, 2025 once they apply), we keep only the minimum required, for the period required, and use it only for that purpose. Once those Rules apply, they require such logs to be kept for at least one year from the processing.

Apart from these, Webimaker keeps no other copy of your data.

11. How we protect your data

We use reasonable technical and organisational measures to protect your personal data, including:

• encrypted HTTPS/TLS connections for all traffic between the app, our hosting provider, our AI service provider and Google Play;
• database access rules (row level security) so that each account can read and change only its own data;
• private file storage: your photos and documents have no public links, and storage access rules let only your own account open them;
• location and camera details (EXIF data) removed from photos on your phone before they are uploaded;
• purchase recording and limit counting carried out inside the database, not in the app;
• passwords handled by Supabase Auth in hashed form, never stored by the app;
• your login session kept in the app's private storage, excluded from cloud backup and device transfer;
• email sending settings encrypted on your phone with a key kept in Android's secure key store, and sent only to your own email provider over an encrypted connection; and
• access to personal data limited to the people at Webimaker who need it to run Webi and support you.

Our providers apply their own security measures to their systems.

No method of sending or storing data is completely secure, so we cannot guarantee absolute security. You can help by using a strong password that you do not use anywhere else, keeping it secret, logging out on shared devices (Settings > Account > Log out) and telling us straight away if you think someone else has used your account. To change your password, go to Settings > Account > Change password, enter your current password and then your new password twice, and tap Change password. You stay logged in on this phone and are logged out on your other devices (this can take up to an hour). If you have forgotten your current password, tap Forgot your current password? on that page and then Send code (or, when you are logged out, tap Forgot password? on the log-in screen, enter your email and tap Send code). We will email you a one-time code, not a link. Enter the code in the Webi app and type your new password twice. The code works only once and expires 1 hour after it is sent, and asking for a new code makes the old one stop working. If the email does not arrive, check your spam folder. Never share the code with anyone: we will never ask you for it. After your password changes, you are logged out on your other devices (this can take up to an hour).

12. Your rights

Depending on where you live, the law gives you some or all of the rights below. We offer them to every user, wherever you live, except where the law allows us to refuse (for example, where a request would reveal another person's data).

• Access: ask whether we process your personal data, and get a copy of it and information about how we use it and who receives it.
• Correction: have inaccurate or incomplete data corrected or completed.
• Deletion: have your data deleted.
• Portability: get your data in a structured, commonly used, machine-readable format. Download my data gives you a JSON file.
• Objection and restriction: object to processing based on our legitimate interests, and ask us to restrict (pause) processing in some situations.
• Withdraw consent: withdraw your consent at any time (see below).
• Nominate (India): nominate another person to use your rights if you die or become unable to use them yourself.
• Appeal: ask us to reconsider if we refuse your request.
• Complain: complain to us, and to a data protection authority or other regulator (see section 14).
• Fair treatment: we will not treat you differently or worse because you use your rights.

Withdrawing consent

You can withdraw your consent as easily as you gave it, by deleting your account in the app (Settings > Account > Delete account) or by emailing us. Webi cannot provide its service without the processing described in this policy, so withdrawing consent means your account will be closed and deleted as explained in section 10. Withdrawing consent does not affect processing that was carried out before you withdrew it.

13. How to use your rights

In the app

• Download your data: Settings > Your data > Download my data. This creates a JSON file with your account details and consent record, your profile, Business profiles, chats and messages, the list of your photos and documents (their details, not the files themselves: save those from the chat), usage, and plan and purchase records. The file is saved where you choose, so please keep it safe.
• Correct your details: edit your name, country and phone number in Settings. To change your Business profiles, go to Settings > Your data > Business profiles. To change your email address, email us.
• Delete chats: delete a single chat, or use Settings > Your data > Clear all chats.
• Delete your account: Settings > Account > Delete account (see section 10).

By email

For anything else (for example, a summary of your data, objection, restriction, nomination, an appeal or a question), email support@webimaker.com from the email address of your Webi account and tell us what you would like. The email address of your account is the identifier we use to find your account.

Checking it is you

We must make sure a request really comes from you. We usually do this by checking that it comes from your account's email address. We may also ask you to confirm the request or to give the phone number saved on your account. We will never ask for your password, or for a code we email you to confirm your email address or reset your password, by email, by phone or in a chat. You type them only into the Webi app's own screens: when you create your account, confirm your email address with the code we email you, log in, change your password, reset a forgotten password with the code we email you, or confirm that you want to delete your account.

Someone acting for you

Someone else can make a request for you (for example, an authorised agent under California law) if they show us your signed permission. We may also check directly with you. In India, a person you have nominated can use your rights if you die or become unable to use them yourself.

How quickly we respond

• We acknowledge every email within 48 hours.
• We reply within 3 business days.
• We resolve complaints within 30 days.
• We complete privacy requests within 30 days, or sooner where your local law requires (for example, 15 days for a full access report in Brazil, or 10 days in South Korea).

When we acknowledge a complaint, we give you a reference number so you can follow it up. If a request is very complex, or we receive a large number of requests, we may need more time where the law allows. If so, we will tell you within 30 days why and when to expect an answer.

Using your rights is free. Where the law allows, we may refuse a request that is clearly unfounded or excessive, and we will explain why.

Appeals and complaints

If we refuse your request, or you are unhappy with how we handled it, reply to our email with "Appeal" in the subject. We will review it and answer within 30 days. You can also complain to the data protection authority or regulator where you live (see section 14).

14. Information for specific regions

The rights in sections 12 and 13 apply to everyone. This section adds information that particular laws require. It is written to be true whether or not Webi is offered in each region.

India

We follow the Information Technology Act, 2000 and its rules on reasonable security practices and sensitive personal data, and the DPDP Act and the Digital Personal Data Protection Rules, 2025 as their provisions come into force.

Under the DPDP Act, you have the right to:

• get a summary of the personal data we process about you and the processing we carry out, and the identities of all other Data Fiduciaries and Data Processors we have shared it with, with a description of what was shared (section 7 describes all our recipients; email us to receive their identities);
• have your personal data corrected, completed, updated or erased;
• have your complaints handled by us; and
• nominate another person to use your rights if you die or become unable to use them. To nominate someone, email us from your account's email address with the person's name and email address.

Complaints: write to us at support@webimaker.com (section 1). We acknowledge within 48 hours and resolve within 30 days. The law allows up to 90 days, but we commit to 30. If you are not satisfied with our answer, you can complain to the Data Protection Board of India. The Board works as a digital office, so complaints are made online, in the way the Board sets out on its official website. The DPDP Act asks you to use our complaint process first.

Consent: you gave consent when you signed up by tapping Create account with the consent box ticked (section 3). You can withdraw it at any time as explained in section 12.

European Economic Area, United Kingdom and Switzerland

If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to how we process your data:

• Our legal bases are listed in section 5. Our legitimate interests are: keeping Webi and your account secure, preventing fraud and abuse, keeping AI answers safe, identifying your account when you contact us, confirming who is making a request, reaching you about important service matters, helping our users, being able to show what was agreed, complying with laws outside the EU and UK, enforcing our Terms & Conditions and defending legal claims, and business transfers.
• You have the rights in section 12, including the right to object at any time to processing based on our legitimate interests, and the right not to be subject to decisions based solely on automated processing that have legal or similarly significant effects on you. We do not make such decisions (section 17).
• We respond within one month. Where the law allows, we can extend this by two more months for complex requests, and we will tell you within the first month if we do.
• Giving your account details is necessary to enter into our contract with you. Without them, we cannot create your account.
• International transfers are explained in section 8.
• You can complain to the data protection authority where you live, where you work, or where you think the problem happened. EU and EEA authorities are listed on the European Data Protection Board website. In the UK, contact the Information Commissioner's Office. In Switzerland, contact the Federal Data Protection and Information Commissioner.

United States: California

If you live in California, the California Consumer Privacy Act (as amended by the California Privacy Rights Act) gives you the right to:

• know and access the personal information we collect, use and disclose about you, including the categories and specific pieces;
• delete your personal information;
• correct inaccurate personal information;
• opt out of the sale or sharing of your personal information. We do not sell or share personal information, so there is nothing to opt out of;
• limit the use of sensitive personal information. We use sensitive personal information only to provide and secure your account, as the law permits, so this right does not apply; and
• not be discriminated or retaliated against for using your rights.

To use these rights, follow section 13. We acknowledge your request within 48 hours and complete it within 30 days. If a request is very complex, we may take longer where the CCPA allows (up to 90 days in total). If so, we will tell you within those 30 days why we need more time and when to expect an answer. You can also contact the California Privacy Protection Agency or the California Attorney General.

Global Privacy Control and Do Not Track: we do not sell or share personal information, so a Global Privacy Control signal changes nothing about how we handle your data. We do not track you across other companies' apps or websites, and no third party does so through Webi, so we do not respond differently to Do Not Track signals.

Direct marketing ("Shine the Light"): we do not disclose personal information to third parties for their own direct marketing.

California notice at collection

In the past 12 months we have collected the following categories of personal information. The purposes are in section 5, the sources in section 4, and how long we keep each item in section 9.

• Identifiers: name, email address, phone number, account id and IP address.
• Personal information described in California's customer records law: name and phone number.
• Commercial information: your plan and your purchase and subscription records.
• Internet or other electronic network activity: usage counts, app version, and technical and security logs.
• Audio, electronic, visual or similar information: the photos you attach.
• Professional or employment-related information: only what you choose to write about your business in Business profiles or chats, or what is in the documents you attach.
• Other information you give us: your country, and the content of your chats, Business profiles, attached documents and emails.
• Sensitive personal information: your account login (email address and password), used only to provide and secure your account.

We do not collect precise geolocation and we do not create profiles or inferences about you.

In the past 12 months we have disclosed personal information for business purposes to:

• Supabase, Inc. (our service provider for hosting, sign-in and file storage): all of the categories above, including the photo and document files.
• Our AI service provider (our service provider or contractor when it generates answers for us; for the technical data it collects on its own behalf, such as your IP address, and for any use of content for its own purposes that the terms that apply allow, it receives that information as a third party; see section 6), to generate answers: identifiers (your device's IP address); commercial information (your plan name, for AI Help); internet or other electronic network activity (the app version and your daily message counts, for AI Help); visual information (the photos you attach); professional information you write about your business or that is in the documents you attach; and other information you give us (your country and the content of your chats, attached documents, Business profiles and AI Help questions). Depending on the terms that apply to our use of its service, our AI service provider may also use this content to provide, improve and develop its own products and services (see section 6).
• Our email service provider (our service provider for the support@webimaker.com mailbox, which it hosts, and for delivering account emails), to answer support requests and deliver account emails: the identifiers and other information in the emails you send us, and your email address in the account emails we send you.
• Google Play, for payments: identifiers and commercial information (the purchase information in section 3).
• Authorities, when the law requires it: the categories the legal request covers.

We have not sold or shared personal information in the past 12 months, and we have no actual knowledge of selling or sharing the personal information of anyone under 16.

United States: other states

If you live in another US state with a consumer privacy law (for example Colorado, Connecticut, Texas or Virginia), you may have similar rights, including the right to appeal our decision on your request. To appeal, follow "Appeals and complaints" in section 13. We answer appeals within 30 days. If we deny your appeal, you can contact your state's Attorney General.

Brazil

If Brazil's General Data Protection Law (LGPD) applies, you have the right to:

• confirmation that we process your personal data;
• access to your data;
• correction of incomplete, inaccurate or out-of-date data;
• anonymisation, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
• portability of your data;
• deletion of data processed with your consent;
• information about the public and private entities we share your data with;
• information about the possibility of not giving consent, and what happens if you do not;
• withdrawal of your consent;
• opposition to processing that does not comply with the law; and
• review of decisions made solely by automated processing.

We provide a full access report within 15 days of your request. Our data protection contact (encarregado) is Webimaker, at support@webimaker.com (section 1). You can complain to the National Data Protection Authority (ANPD). International transfers are explained in section 8.

Canada (including Quebec)

You have the right to access your personal information, have it corrected, and withdraw your consent, subject to legal or contractual restrictions. In Quebec, you also have the right to receive your personal information in a structured, commonly used technological format (Download my data does this), and to be told about decisions made solely by automated processing (we make none, see section 17).

Our person in charge of the protection of personal information is Webimaker, at support@webimaker.com (section 1). Your data is processed outside Canada (section 8), where it may be accessed by the courts, law enforcement and national security authorities of those countries. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

Australia

If the Privacy Act 1988 applies, you can ask to access and correct your personal information. If you have a complaint, please contact us first. We will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner. We disclose personal information to recipients in the United States and other countries where Supabase, our AI service provider and Google (for Google Play payments) operate, and in any country where our email service provider processes support emails and account emails (see sections 7 and 8).

Japan

If Japan's Act on the Protection of Personal Information (APPI) applies, you can ask us to disclose the personal data we hold about you (including records of providing it to third parties), to correct, add to or delete it, to stop using it or delete it, and to stop providing it to third parties, as the APPI allows.

We provide personal data to recipients in other countries (see sections 7 and 8):

• United States (Supabase, our AI service provider, and Google for Google Play payments): the United States has no single, comprehensive federal privacy law. Personal data is protected by a mix of federal laws for specific sectors and state laws, such as the California Consumer Privacy Act.
• India (Webimaker): India's main law is the Digital Personal Data Protection Act, 2023.
• Other countries where Supabase (including its sub-processors), our AI service provider and Google (for Google Play payments) process data, and where our email service provider processes support emails and account emails. We cannot name all of these countries in advance, because these providers choose, and can change, the sub-processors and data centres they use. For reference, Supabase and Google publish where they process data: see Supabase's sub-processor list and Google's data centre locations. Data protection rules in those countries vary, and some may protect personal data less than Japanese law does.

Supabase protects your data under the Standard Contractual Clauses in its Data Processing Addendum, our AI service provider under its Data Privacy Framework certification and Standard Contractual Clauses, Google (for Google Play payments) under its Data Privacy Framework certification and Standard Contractual Clauses, and our email service provider under the transfer safeguards in its terms (see section 8). You can ask us for more information about these measures. You can complain to the Personal Information Protection Commission. Our name, address and contact details are in section 1.

South Korea

If Korea's Personal Information Protection Act applies, you have the right to access, correct and delete your personal information, to ask us to suspend processing, and to withdraw your consent. We respond within 10 days.

Section 7 lists each company that processes your data for us or receives it, including outside Korea: its name and contact details (for our AI service provider and our email service provider, a description of the company and our contact details for questions about it), its country (or, for our email service provider, that it may process data outside your country), the data it receives, the purpose, when and how the data is transferred, how long it is kept, and how you can refuse. When the retention period ends or you delete your account, we delete your data from our live database permanently so it cannot be restored there. Copies in backups are overwritten within 30 days.

Our chief privacy officer is Webimaker, at support@webimaker.com (section 1). You can also contact the Personal Information Protection Commission (PIPC) or the Korea Internet & Security Agency's Personal Information Infringement Report Center (phone 118).

Singapore

If Singapore's Personal Data Protection Act applies, you can ask to access and correct your personal data and withdraw your consent. If you withdraw consent, we will tell you what that means for your account before we act on it. Our individual responsible for data protection can be contacted through Webimaker, at support@webimaker.com (section 1). We protect data transferred outside Singapore as described in section 8. You can complain to the Personal Data Protection Commission.

15. Children

Webi is a business tool and is not designed for children. If you are a parent or guardian and believe a child has given us personal data, please email support@webimaker.com and we will delete it.

16. No selling, no ads, no tracking

• We do not sell or rent your personal data.
• We do not share your personal data for cross-context behavioural advertising (advertising based on your activity across other companies' apps and websites).
• Webi shows no ads and contains no analytics tools, no advertising SDKs and no third-party trackers.
• No third party collects personal data about you through Webi to track you across other apps or websites.

Cookies

The Webi app does not use cookies. The information it keeps on your phone is listed in section 3 and is used only to make the app work. We do not add cookies, analytics tools or trackers to the public web pages where we publish our policies. The service that hosts those pages may record standard technical information, such as your IP address, in its server logs for security.

17. Automated decision-making

Webi uses AI to generate replies to your messages. It does not make decisions about you that have legal or similarly significant effects, such as decisions about credit, employment or access to essential services.

Automated systems also count your daily limits and check the type and size of the files you attach, and our AI service provider's automated safety systems may block some content. These do not have legal or similarly significant effects on you. We do not profile you for advertising.

18. Data breaches

If a security incident affects your personal data, we will tell you without undue delay, by email and/or in the app. Where the relevant laws apply to us, we will also notify the authorities within the deadlines the law sets. Examples include India's CERT-In within 6 hours of noticing certain incidents, the Data Protection Board of India without delay with a detailed report within 72 hours once the DPDP Rules apply, EU and UK authorities within 72 hours, and Brazil's ANPD within 3 business days.

Our notice to you will explain what happened and when, what data was involved, the likely consequences for you, what we are doing about it, what you can do to protect yourself, and how to contact us.

19. Changes to this policy

We may update this policy, for example when Webi changes, when our providers change, or when the law changes. The "Last updated" date at the top shows when this policy last changed.

If we make a material change (for example, collecting a new type of data, using data for a new purpose, or sharing it with a new kind of recipient), we will tell you in the app and/or by email at least 30 days before the change takes effect, and ask for your consent again where the law requires. If the law or an urgent security need requires a change sooner, we will tell you as soon as we reasonably can. If you do not agree with the change, you can cancel your subscription in Google Play and delete your account before the change takes effect. You can ask us for earlier versions of this policy.

20. Contact us

For any question, request or complaint about this policy or your personal data, contact us (our details are also in section 1):

• Email: support@webimaker.com
• Telephone: we provide support by email. If you ask at support@webimaker.com, we will email you our telephone number without delay.
• Post: Webimaker, Bagula Bus Stand, near PNB Bank ATM, Bagula, Nadia, West Bengal 741502, India

Please write from the email address of your Webi account so we can find it quickly. Never send us your password.