Webaeon · Legal
Privacy Policy
Last updated: 2026-09-21
How Webaeon collects, uses, stores, and protects your personal data when you use our website health audit and monitoring service.
1. Introduction
This Privacy Policy explains how Webaeon ("we", "us", "our") collects, uses, stores, and protects personal data when you use our website health audit and monitoring service (the "Service") available at [webaeon.com] (the "Website").
We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the Maltese Data Protection Act (Cap. 586).
2. Data Controller
The data controller responsible for your personal data is:
Webaeon is a Bluetoolcase brand
Blue Tool Case
Flat 10 Springvale Block B,
Triq ix-xarretta,
Santa Venera, SVR 1920, Malta
Email: [email protected]
3. Data We Collect
3.1 Data you provide to us
- Email address — required to deliver your audit report and account communications.
- Website URL — the address of the website you ask us to audit or monitor.
- Account details — if you create an account: [name, email address, password (stored hashed and encrypted)].
- Communications — any messages you send us, including replies to our emails.
3.2 Data we collect automatically
- Technical data — IP address, browser type and version, device type, operating system, and referring pages, collected through server logs and Google Analytics.
- Audit data — the results of audits performed on the website URL you submit, including data retrieved from Google PageSpeed Insights (e.g., performance scores, layout-shift and rendering data), SSL/DNS/route checks, and the plain-English diagnostic report generated for you.
- Usage data — how you interact with the Website (pages visited, time spent, clicks).
3.3 Data we do not collect
We do not intentionally collect special categories of data (e.g., health, race, religion, political opinions) or data of children under 18. We do not collect payment card details [unless you add billing — see checklist below].
4. How We Use Your Data
We use your personal data to:
- Provide the Service — run audits on the website URL you submit, generate your plain-English health report using AI, and email it to you.
- Notify you and us — send you service emails (reports, alerts, account notices) via our email provider, and send internal notifications about new audit requests to our own Telegram channel so we can fulfil them promptly.
- Improve the Service — analyse audit outcomes and usage patterns to improve accuracy and performance.
- Security and fraud prevention — monitor for abuse, unauthorised access, and technical faults.
- Comply with legal obligations — where required by law.
5. Legal Bases for Processing (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Providing the audit service and sending reports | Performance of a contract (Art. 6(1)(b)) |
| Account management and service communications | Performance of a contract (Art. 6(1)(b)) |
| Analytics and measurement | Consent, where required by applicable ePrivacy and data-protection rules. Analytics technologies are not activated until the visitor provides consent |
| Analytics, service improvement, security | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)) — you can withdraw at any time |
| Retention for legal/tax compliance | Legal obligation (Art. 6(1)(c)) |
6. Third-Party Processors
We share personal data only with the service providers necessary to operate the Service. All processors are bound by data processing agreements and may only process data on our documented instructions.
| Processor | Purpose | Data shared | Location |
|---|---|---|---|
| Cloudflare | Content delivery network (CDN), DNS management, DDoS protection, and SSL/TLS termination | IP addresses, request headers, web traffic routing data | Global edge network EU & USA |
| Anthropic (Claude) | AI generation of plain-English audit reports | Website URL, audit findings | EU(Ireland) |
| Resend | Transactional email delivery (reports, alerts) | Email address, report content | USA |
| Telegram | Internal notifications of new audit requests | Email address, website URL | UAE |
| Google PageSpeed Insights API | Performance and rendering data for audits | Website URL | EU |
| Google Analytics | Website usage analytics | Technical/usage data, cookies | EU |
| Supabase | Database storage of submissions, accounts, audit records | All data described in Section 3 | EU(Ireland) |
| Hetzner | Server hosting (Helsinki, Finland) | All data described in Section 3 | EU (Finland) |
Note: Anthropic's API terms do not use your data to train their models by default.
7. International Data Transfers
Your data is primarily stored on servers in the European Economic Area (Hetzner, Helsinki, Finland). Where data is transferred to or processed by third-party providers operating outside the EEA or running distributed global infrastructure (such as Cloudflare, Anthropic, or Resend), we rely on appropriate safeguards under GDPR Chapter V. These include the EU-US Data Privacy Framework (where certified) and European Commission-approved Standard Contractual Clauses (SCCs), supplemented by supplementary technical measures where appropriate.
Cloudflare processes web request metadata across its global edge network to route traffic and protect the Service from DDoS attacks and malicious requests.
You can request a copy of the relevant safeguards by contacting us at [email protected].
8. Data Retention
We retain personal data only as long as necessary for the purposes described in this policy:
| Data | Retention period |
|---|---|
| Audit submissions, audit results, and associated personal data | 2 years from the date of collection |
| Account data | 2 years from your last activity on the Service, unless you request deletion earlier |
| Server and access logs | [30 days], used for security and troubleshooting |
| Analytics data | Governed by the retention settings in Google Analytics (see Section 9) |
After the retention period expires, data is deleted or irreversibly anonymised. You may request earlier deletion at any time (see Section 11).
9. Cookies and Analytics
The Website uses cookies and similar technologies:
- Strictly necessary and security cookies — essential for core site operations, route balancing, and threat mitigation (including security cookies deployed by Cloudflare, such as bot-detection and challenge cookies).
- Analytics cookies — set by Google Analytics to help us understand how visitors use the Website (pages visited, device type, approximate region). We use IP anonymisation where supported.
You can control or block cookies through your browser settings and via our cookie banner. Blocking strictly necessary or security cookies may impact your ability to access or use the Service.
10. Security
We implement appropriate technical and organisational measures to protect your data, including:
- Encryption of data in transit (TLS/HTTPS) and at rest.
- Access controls restricting data to authorised personnel only.
- Secure credential storage (hashed passwords).
- Regular monitoring of infrastructure hosted on Hetzner (Helsinki, Finland).
- Network-level DDoS mitigation, edge rate limiting, and web application firewall (WAF) protection provided via Cloudflare.
No method of transmission or storage is 100% secure, but we take reasonable steps to protect your data.
11. Your Rights
Under the GDPR, you have the right to:
- Access — obtain a copy of the personal data we hold about you.
- Rectification — correct inaccurate or incomplete data.
- Erasure — request deletion of your data ("right to be forgotten").
- Restriction — limit how we process your data in certain circumstances.
- Portability — receive your data in a structured, machine-readable format.
- Object — object to processing based on legitimate interests or for direct marketing.
- Withdraw consent — at any time, where processing is based on consent.
To exercise any of these rights, email [email protected]. We will respond within one month, as required by law. If you are unsatisfied with our response, you have the right to lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC) of Malta — idpc.org.mt.
12. Children
The Service is not directed at children under 18, and we do not knowingly collect personal data from them. If you believe a child has provided us with data, contact us and we will delete it.
13. Changes to This Policy
We may update this policy from time to time. Material changes will be notified on the Website and, where appropriate, by email. The "Last updated" date at the top reflects the latest revision.
14. Contact
Questions about this policy or your data can be sent to:
Webaeon
Email: [email protected]
Springvale Block B, Triq ix-Xarretta, Santa Venera, SVR 1920, Malta