Webless AI Privacy Policy

1. Definitions

In this Privacy Policy, the following terms have the meanings ascribed to them unless the context requires otherwise:

• “Personal Data” means any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, by reference to identifiers such as a name, identification number, location data, online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.
  

• “Data” means all information collected, processed, or stored by Webless AI in connection with the provision or use of its Services, including Personal Data and non-personal information.
  

• “Processing” means any operation performed on Data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, erasure, or destruction, by automated or manual means.
  

• “Client” means any company, organization, or entity that subscribes to or uses Webless AI’s AI-powered search and content discovery Services, including embedding such Services on their websites for their end users.
  

• “User” or “Visitor” means any natural person who accesses or uses Webless AI’s website, services, or embedded AI search features on a Client’s website, including end users submitting queries or interacting with the Services.
  

• “Services” refers collectively to the AI-powered search, personalization, content discovery platform, APIs, software, and related features offered by Webless AI, whether directly or embedded on Client websites.
  

• “Cookies” means small text files stored on a User’s device by a web browser at the request of a website, used to recognize the User, remember preferences, or collect usage data. (Note: Webless AI does not currently use cookies.)
  

• “Sensitive Personal Data” means any data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for unique identification, health data, sex life, or sexual orientation; or other categories recognized as sensitive under applicable laws.
  

• “Data Controller” means the entity that determines the purposes and means of Processing Personal Data. In contexts where data is collected on Client websites, the Client usually acts as Data Controller for end user data, with Webless AI acting as Data Processor.
  

• “Data Processor” means the entity that Processes Personal Data on behalf of the Data Controller. Webless AI functions as a Data Processor for Client user data processed via its Services.
  

• “Consent” means any freely given, specific, informed, and unambiguous indication by a User or Data Subject of their agreement to the Processing of their Personal Data.
  

• “California Consumer Privacy Act (CCPA)” means the privacy law in California, USA, granting specific rights and protections to California residents regarding their Personal Data.
  

• “General Data Protection Regulation (GDPR)” means the European Union regulation (Regulation (EU) 2016/679) governing data protection and privacy for individuals within the European Economic Area.
  

• "Standard Contractual Clauses" (SCCs) means pre-approved contractual terms issued by the European Commission to ensure adequate protection of Personal Data transferred outside the European Economic Area (EEA), as required under GDPR Article 46. SCCs are used by Webless AI to safeguard cross-border Data transfers to countries like the United States or India, as described in Section 5.3.
  

• "Authorized Agent" means an individual or entity authorized by a California or Delaware resident to act on their behalf in exercising privacy rights under the California Consumer Privacy Act (CCPA) or the Delaware Personal Data Privacy Act (Delaware DPPA), such as requesting access or deletion of Personal Data. Authorized Agents must submit verified requests to Webless AI, as outlined in Section 6.2.
  

• “Data Subject Rights” means the rights granted to individuals under applicable privacy laws, including rights of access, correction, deletion, restriction, portability, and objection relating to their Personal Data.
  

2. Information We Collect

At Webless AI, we collect various types of information to provide, operate, maintain, and improve our AI-powered search, personalization, and content discovery services effectively and securely. The information we collect falls into several categories, depending on your relationship with us (Client, end user, or visitor) and your interaction with our Services.

• 2.1. Information Provided by Clients and Their Users

  • Client Provided Data: When Clients subscribe to or engage with our Services, we collect data necessary to establish and maintain the business relationship and provide the Services, including contact details, billing and payment information, account credentials, and other profile information necessary to provide and manage the Service.

  • User Queries and Interactions: When visitors (users) interact with the AI search feature embedded on Client websites, we collect: (i) the search queries and textual inputs entered by the users; (ii) interaction metadata such as clicks, time stamps, page navigation following and search results, and (iii) voluntary data which the users might provide during the engagement. 

  • Voluntary User Data: Users or Clients may submit information to us through support requests, surveys, or other direct communications. This data is used to respond to inquiries, provide assistance, and improve our offerings. 

  • Content provided by the Client: Clients may provide or make accessible to us content, materials, documents, images, videos, data files, product information, website content, or other assets (collectively, “Client Content”) for the purposes of configuring, training, personalizing, or operating the Services. Client Content may include publicly available information from the Client’s website, as well as any proprietary or confidential materials the Client chooses to share.

• 2.2. Automatically Collected Information

  When Users visit the Webless AI website (webless.ai) or use our AI search services on Client sites, we automatically collect certain technical data to facilitate the operation and security of the Services, including: (i) Internet Protocol (IP) address, which may be used for geolocation and fraud prevention; (ii) Browser type, version, and language; (iii) Device type, operating system, and version; (iv) Unique device identifiers such as mobile device ID, browser fingerprinting information; and (v) Referring websites, pages viewed, date and time stamps of access.
  

  We also capture data on how users use and interact with our Services, including: (i) specific features accessed and frequency of use; (ii) search results selection and dwell time (iii) Error reports and diagnostic data essential for troubleshooting.   
  

• 2.3. Publicly Available Information

  Our Services rely on indexing and processing publicly available information related to our Clients, including but not limited to website content, blogs, FAQs, whitepapers, podcasts, videos, help documents, and knowledge bases hosted on Client domains or publicly accessible sources. This collection is strictly limited to content that is publicly accessible, with no unauthorized access to private or proprietary data. In addition, we may process non-public content (such as gated resources, narrative documents, sales pitches, or Client provided media) in the event such content is voluntarily provided by the Client or made accessible to us with the Client’s explicit permission. We do not access any private or proprietary data without authorization.   
  

3. Data from third Parties

We may supplement our Client data by obtaining information from partnered third party sources such as: (a) Data enrichment providers, who enhance the accuracy or completeness of Client data; (b) Analytics and marketing partners who assist with understanding user behavior and campaign effectiveness; (c) security providers offering threat intelligence or fraud detection data. Any data received from third parties is subject to strict contractual privacy and security obligations and is handled in accordance with applicable laws.

4. How we use your Data

We may supplement our Client data by obtaining information from partnered third party sources such as: (a) Data enrichment providers, who enhance the accuracy or completeness of Client data; (b) Analytics and marketing partners who assist with understanding user behavior and campaign effectiveness; (c) security providers offering threat intelligence or fraud detection data. Any data received from third parties is subject to strict contractual privacy and security obligations and is handled in accordance with applicable laws.

• 4.1. Service Delivery and Operations

  We use your Data to provide, deliver, and maintain the full functionality of our AI-powered search, personalization, analytics, chat, and content discovery Services, including but not limited to:

  • Perform performance monitoring, application diagnostics, and bug fixes to maintain service uptime, prevent disruptions, and respond to incidents promptly
    

  • Conduct infrastructure scaling, backups, disaster recovery, and business continuity planning to ensure resilience and protect user data against loss or damage. 
    

• 4.2. Personalization, Improvement, and Innovation

  We leverage collected Data to: 
  

  • Deliver personalized and contextual search results, recommendations, and user interface customizations on Client websites to optimize user engagement and satisfaction.
    

  • Analyze patterns in usage data, such as frequency and types of queries, navigation behavior following AI responses, and feedback signals, in order to identify opportunities for enhancing user experience and platform efficiency.
    

  • Continuously improve our underlying AI and machine learning models by using anonymized data to refine algorithms, reduce errors, detect bias, and increase the accuracy and relevance of generated content.
    

  • Conduct research and development on new features, tools, and services, including pilot programs, beta testing, and performance benchmarking, always maintaining user privacy and leveraging privacy-enhancing techniques like data anonymization and aggregation where feasible.
    

  • Implement a Privacy by Design approach by embedding privacy considerations and data minimization throughout our product lifecycle, developing ethical AI practices, and adhering to industry best practices and regulatory standards.
    

  • Respond to a chat message
    

• 4.3. Communications and Customer Support

  We use your Data to: 
  

  1. Send service-related communications including notifications regarding Service updates, scheduled maintenance, security alerts, changes to terms or policies, and other important announcements.
  2. Provide customer and technical support through multiple channels such as email, chat, or phone; respond to inquiries, troubleshoot issues, and address complaints or feedback in a timely manner.
  3. Process billing, payments, refunds, and invoice delivery related to your account and subscriptions while maintaining confidentiality and security of payment information.
  4. Facilitate client onboarding, training, and success programs by tailoring support materials and communication based on Client needs and interactions.

• 4.4. Marketing and Promotions

  Subject to applicable law, including obtaining necessary consents, we may use Data to: 
  

  1. Communicate marketing messages such as newsletters, promotional offers, invitations to events, surveys, and information about new features or Services that may interest you.
  2. Customize marketing content and advertising based on Client preferences and historical engagement data to provide relevant and targeted communications.
  3. Respect user choices by providing clear and accessible mechanisms for opting out of marketing communications, including “unsubscribe” links and preference centers in all marketing emails and messages.
  4. Conduct analysis of marketing campaigns’ effectiveness and audience reach to optimize marketing strategies while safeguarding user privacy.

• 4.5. Legal Compliance, Regulatory Requirements, and Enforcement

  We process Data to: 
  

  1. Comply with applicable laws, statutes, regulations, orders, and industry standards, including responding to lawful requests from government and regulatory authorities in jurisdictions where we operate.
  2. Detect, prevent, or investigate activities that may violate our Terms of Service, acceptable use policies, or pose legal, security, or reputational risks, including unauthorized access, intellectual property infringement, or spam.
  3. Protect the rights, property, safety, or security of Webless AI, our Clients, or Users, including by enforcing legal claims or defending against litigation.
  4. Perform due diligence, audit trails, and reporting obligations required by law, contractual agreements with Clients, or data protection authorities.

• 4.6. Data Aggregation, Anonymization, and Reporting

  We may: 
  

  1. Aggregate, pseudonymize, de-identify, or otherwise anonymize Data to create statistical or analytical reports that do not identify any individual or account.
  2. Use aggregated data to produce insights related to service usage trends, industry benchmarks, or AI model performance to drive innovation and inform Stakeholders.
  3. Share anonymized datasets or analysis results with partners, industry groups, or the public, provided that such disclosures do not compromise personal privacy or proprietary information.
  4. Maintain strict access controls and apply technical safeguards to ensure anonymized data cannot be re-identified.

• 4.7. Automated Processing and AI Transparency

  We leverage collected Data to: 
  

  1. Our Services feature automated decision-making based on AI and machine learning techniques to interpret queries, rank and generate search results, and personalize user experiences.
  2. We are committed to transparency about how AI systems operate and impact Users, providing clear disclosures about automated processing where required by law.
  3. Users and Clients retain rights under applicable regulations to request human intervention, appeal automated decisions, restrict profiling, or object to certain automated processing activities.
  4. We continuously evaluate and mitigate risks related to algorithmic bias, inaccurate inferences, or unwarranted sensitive data exposure, incorporating human oversight and validation where appropriate.
  5. Explicit consent is obtained in cases where Sensitive Personal Data might be processed by AI models, with strict controls ensuring compliance with privacy principles.

• 4.8. Data Minimization and Purpose Limitation

  We leverage collected Data to: 
  

  1. We adhere to a strict data minimization principle by collecting, storing, and using only the Data necessary to fulfil the purposes outlined in this Policy and maintain operational efficiency.
  2. Data is retained only for as long as reasonably necessary to provide the Services, comply with legal or contractual obligations, or as otherwise consented to by Users or Clients.
  3. We periodically review data collection practices and retention schedules to ensure alignment with evolving regulatory requirements and technological standards.
  4. We avoid excessive, irrelevant, or unrelated processing of Data and implement security and governance measures to prevent misuse.

5. Legal bases for processing  

We process Personal Data on legal grounds required by applicable data protection laws, including the General Data Protection Regulation (GDPR) for users in European Economic Area (EEA). This section explains the lawful bases on which we rely to collect, use, and share your Personal Data.

• 5.1. Contractual Necessity

  We process Personal Data where it is necessary for the performance of a contract to which you or your organization (“Client”) are a party, including: (a) Providing the AI-powered search and content discovery Services; (b) Managing subscriptions, billing, customer support, and communications related to the Services; (c) Enabling access controls and user authentication.
  

• 5.2. Consent

  Where required by law, we process Personal Data based on your explicit and informed consent that you have provided to the Client, such as: (a) Marketing communications and promotional offers; (b) Cookies and tracking technologies, if any, implemented by the Client requiring opt-in consent; (c) Processing of any Sensitive Personal Data if applicable. Consent may be withdrawn at any time by contacting the Client. However, withdrawal will not affect the lawfulness of processing performed prior to withdrawal.
  

• 5.3. Legitimate Interest

  We process Personal Data based on our legitimate interests where such interests are not overridden by your rights or freedoms. Legitimate interests include but are not limited to: (a) Operating, improving, and securing our Services; (b) Research and development to enhance AI capabilities; (c) Fraud prevention and maintaining data integrity. (d) Conducting analytics and usage analysis for Service optimization; and (e) Enforcing terms of use and protecting security.
  

• 5.4. Legal Compliance

  We process Personal Data to comply with applicable laws, regulations, or governmental requests, such as: (a) Responding to lawful requests by courts, law enforcement, or regulatory authorities; (b) Fulfilling tax, accounting, and financial reporting obligations; and (c) Investigating and preventing unlawful or prohibited activities.
  

• 5.5. Processing under CCPA

  For California residents, processing Personal Data complies with CCPA. We process Personal Information as part of our business operations, including: (a) To provide the Services you request and fulfil contractual obligations; (b) To comply with legal obligations and respond to lawful requests by public authorities; (c) For our legitimate business interests, such as improving services, preventing fraud, and maintaining security; and (d) In accordance with your rights to opt out of certain uses or disclosures of your personal information, where applicable.
  

• 5.6. Special Categories of Data

  Webless AI does not intentionally collect or process “special categories” of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or biometric information). Should such data be collected inadvertently or voluntarily provided, it will be treated with heightened security and only processed when expressly permitted by law and with written confirmation with the Client.
  

6. Data Sharing and Disclosure

Webless AI respects your privacy and only shares your Data in limited, controlled circumstances necessary to provide our Services, comply with legal obligations, or protect rights. We do not sell your personal data.

• 6.1. Recipients of Personal Data

  We may share your Personal Data with the following categories of recipients:

  1. Service Providers and Vendors: We share Data with trusted third-party service providers who perform functions on our behalf, such as:
     
     1. Cloud hosting and infrastructure providers.
     2. Payment processors and billing services.
     3. Customer support and helpdesk platforms.
     4. Analytics, marketing, and communication providers.
     5. Security and fraud prevention vendors.
  2. Clients: Our Clients control data collected from end users on their websites. We share such data with Clients as necessary to operate and improve the Services they use. Clients are responsible for informing their end users about data collection and usage on their own websites and fulfilling related data subject rights.
  3. Legal and Regulatory Authorities: We may disclose Data where required to do so by law or in response to valid legal processes, including court orders, subpoenas, or government requests. We take steps to verify requests and limit disclosures to what is necessary.
  4. Business Transfers: In the event of a merger, acquisition, restructuring, sale, or transfer of assets involving Webless AI, your Data may be transferred as part of the transaction. We will ensure the receiving entity is bound by similar privacy and security obligations.

• 6.2. Data Sharing Agreements

  We enter into appropriate data sharing or processing agreements with all data recipients to ensure: (a) Personal Data is handled securely and in compliance with applicable laws; (b) Restrictions on how Data may be used, retained, and disclosed are clearly defined; (c) Obligations related to Data Subject Rights, security incident notifications, and data breach management are included.
  

• 6.3. Cross-Border Data Transfers

  Your Data may be transferred to, processed, and stored in countries outside your country of residence, including the United States and India. Where required by data protection laws such as GDPR, we implement safeguards such as Standard Contractual Clauses, Binding Corporate Rules, or other mechanisms approved by regulatory authorities to ensure adequate data protection.
  

• 6.4. Security and Confidentiality

  We maintain strict confidentiality obligations with all recipients of your Data and implement reasonable administrative and technical safeguards to prevent unauthorized access, use, or disclosure.
  

7. Your rights in relation to your data

• 7.1. Data Subject Rights Under Applicable Privacy Laws

  Webless AI respects the rights of individuals whose Personal Data we process, whether as end users interacting with AI search features or as representatives of Clients. Depending on your jurisdiction and applicable privacy laws, you may be entitled to the following rights regarding your Personal Data:
  

  1. Right to Access: You have the right to request access to the Personal Data we hold about you to understand what data is being processed and for what purposes.
  2. Right to Rectification: You may request correction of inaccurate or incomplete Personal Data concerning you.
  3. Right to Erasure ("Right to be Forgotten"): Subject to legal and contractual exceptions, you may request deletion of your Personal Data where it is no longer necessary for the purposes it was collected or processed, or where you have withdrawn consent.
  4. Right to Restrict Processing: You may request that we limit the processing of your Personal Data under certain circumstances, such as during dispute of accuracy or objection to processing.
  5. Right to Data Portability: Where applicable, you have the right to receive your Personal Data in a structured, commonly used, and machine-readable format and transmit it to another data controller.
  6. Right to Object: You may object to Processing of your Personal Data on grounds related to your particular situation, including profiling or processing for direct marketing purposes.
  7. Right to Withdraw Consent: Where Processing is based on consent, you may withdraw your consent at any time without affecting processing performed prior to withdrawal.
  8. Right to Opt-Out of Sale of Personal Data: If applicable, you have the right to opt-out of the sale of your Personal Data. Webless AI does not sell Personal Data.
  9. Rights Related to Automated Decision-Making: You may request human intervention, express your point of view, or contest automated decisions affecting you, subject to applicable law.

• 7.2. Exercising Your Rights

  1. To exercise any of the rights described above, please contact Webless AI using the contact details provided in Section 13 of this Policy.
  2. We may require verification of identity to ensure that requests are made by the rightful Data Subject. We will respond to validated requests within the period required by applicable law.
  3. Certain rights may be limited or restricted as permitted by law, including where processing is necessary for compliance with legal obligations or to protect legitimate interests.

• 7.3. Client Control and Responsibilities:

  1. Clients as Data Controllers: When Webless AI provides Services embedded on Client websites that collect data from end users, the Client acts as the Data Controller, determining the purposes and means of processing such data.
  2. Client Obligations: Clients are responsible for ensuring that their collection, use, and disclosure of end user data comply with applicable data protection laws. Clients must provide appropriate privacy notices to their end users, informing them about the use of our embedded Services and how their Data will be processed. Clients are responsible for responding to end users’ data subject rights requests related to their websites and data.
  3. Webless AI as Data Processor: Webless AI acts as Data Processor for Client user data and complies with Client instructions regarding Personal Data. Webless AI assists Clients in fulfilling their data subject rights obligations upon Client request and within reasonable timeframes.
  4. Control Over Data Collection Features: Clients may manage or configure options that affect Personal Data collection and processing through our Services, including controls for cookies, analytics, and AI data processing settings, subject to technical feasibility.

8. Cookies and Similar Technologies

Webless AI currently does not use cookies, web beacons, pixel tags, or similar tracking technologies on our website or embedded Services. As such, no data is collected through cookies or device identifiers related to your use of our Services. We are committed to maintaining your privacy and limiting data collection to what is strictly necessary to provide and improve our AI-powered search Services. If we decide to implement cookies or similar technologies in the future, we will update this Privacy Policy accordingly and provide notice to Users and Clients, including options to manage or opt-out where required by law.

9. Data Security

• 1. Webless AI is committed to maintaining the confidentiality, integrity, and availability of personal data and employs a comprehensive information security management system certified under internationally recognized standards, including ISO/IEC 27001. Additionally, Webless AI undergoes regular third-party audits for SOC 2 compliance to ensure rigorous controls over financial reporting and data security.
  2. To safeguard Personal Data from unauthorized access, alteration, disclosure, or destruction, Webless AI implements appropriate administrative, technical, and physical security measures, including but not limited to:
     
     1. Encryption: We employ strong encryption protocols to protect data both in transit (using TLS/SSL) and at rest, wherever feasible and appropriate.
     2. Access Controls: Strict access control mechanisms are in place, including role-based access controls (RBAC), Single Sign-on (SSO), multi-factor authentication (MFA), and periodic access reviews to ensure that only authorized personnel have access to Personal Data.
     3. Security Assessments: We conduct regular security assessments, vulnerability scans, and penetration testing performed by qualified internal teams and independent external experts to identify and remediate security weaknesses proactively.
     4. Monitoring and Incident Response: We maintain continuous security monitoring and employ robust incident detection and response procedures aligned with industry best practices and standards such as ISO frameworks. In the event of a security incident, we have defined protocols for timely containment, investigation, notification, and remediation
     5. Physical Security: Our data centers and offices comply with strict physical security controls, including surveillance, restricted access, and environmental safeguards to protect against physical threats.
  3. While we deploy advanced security measures, no system is completely impervious to breach or misuse. We urge you to protect your account credentials diligently and immediately inform us if you suspect unauthorized use, data breaches, or any security vulnerabilities affecting your data or account.

10. Data Retention

• 1. Webless AI retains your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy, and to comply with applicable legal, regulatory, accounting, or reporting obligations.
  2. The retention period for Personal Data depends on the nature of the Data and the specific purpose for which it is processed, including but not limited to:
     
     1. Client and Account Data: Retained for the duration of your active account with us and thereafter for a reasonable period to facilitate ongoing support, manage account-related inquiries, and meet legal or contractual obligations.
     2. User Interaction Data: Retained for a limited timeframe necessary to support the functionality of our Services, analytics, troubleshooting, and continuous improvement of the AI-powered search features.
     3. Legal and Compliance Data: Personal Data necessary for resolving disputes, enforcing agreements, preventing fraud, or complying with applicable laws and regulations may be retained for extended periods as required by law or as reasonably necessary to protect our legal interests.
  3. When Personal Data is no longer required for the purposes described herein, we ensure that such Data is securely deleted, destroyed, or irreversibly anonymized in accordance with industry best practices and applicable legal requirements, thereby preventing identification of individuals.

11. Links to third party sites and services

12. Updates to this Privacy Policy

13. Minors

14. Grievance Officer / Contact Us