WEBWITA · Private beta · by invitation · no payment card
Privacy Policy
WebWita · Privacy Policy
Controller
Andrea De Donatis (Premium ADV) · NIP PL5272950014 · ul. Bluszczańska 21, 00-712 Warszawa, Poland · [email protected]. Contact [email protected] for privacy requests. Premium ADV is controller for account administration, platform security, support and optional product updates. A customer determines the purposes of personal data collected on their own site; where WebWita processes such data on the customer’s instructions, the Data Processing Agreement applies.
Data and purposes
Account data includes your email, password hash, selected language, invitation and acceptance records. We process website content, authorised uploads, revisions and generation requests to provide the service. Security records contain limited technical events and relevant account identifiers. Hosting and network providers process connection information. We do not need identity documents, sensitive categories of data or private credentials in prompts or uploads.
Legal bases
Necessary account and website processing is based on providing the requested service (GDPR Article 6(1)(b)). Proportionate abuse prevention, security and handling claims rely on legitimate interests (Article 6(1)(f)), subject to your rights. Legal obligations rely on Article 6(1)(c). Optional email marketing requires separate consent (Article 6(1)(a) and applicable communications rules); refusing it does not prevent beta access.
Providers and AI
Infrastructure uses the dedicated IONOS VPS and Cloudflare DNS, network and security services when activated. Operator-controlled disaster-recovery storage uses TerraMaster. The pilot’s local AI design processes generation on the operator’s server; no customer materials may be routed to an external model provider until that integration and the notice are updated. Network services may involve processing outside the EEA; applicable vendor agreements and lawful transfer safeguards must govern it. The current provider and activation register is available from [email protected].
Retention
Account and site data is retained during service use. A self-service deletion request immediately disables access and publication; data is erased after the 30-day recovery period, subject to applicable legal duties. Contact-message bodies are queued for at most 24 hours by the app before SMTP acceptance; subsequent provider processing follows its service terms. Accepted app messages are cleared immediately; mail metadata is kept for 30 days. Text/image instructions are cleared after seven days, with job metadata retained as needed for the stated quotas and up to 30 days for ordinary text jobs. Uploaded materials and their contextual descriptions remain while needed for the site. Versions keep at least ten recent revisions and the preceding 60 days within the stated allowance. App audit events are kept for 90 days; website access logs for 14 days and infrastructure/mail logs for up to 30 days. Sessions expire after seven days; expired tokens are purged within approximately three days. Restricted, encrypted disaster-recovery archives follow a planned cycle of approximately 13 months (397-day age policy), with protected newer recovery points and manual escalation if safe rotation cannot run. A minimal private deletion ledger is retained to prevent erased accounts/sites and reserved addresses from returning during recovery. Backup access is restricted; restored data is reconciled with deletion requests before reuse. Ask [email protected] about any legally necessary retention exception.
Analytics and manual review
We use aggregate feature counts to understand the product; reports hide event counts below five. Prompts and uploads are not an anonymous analytics dataset. Security flags are reviewed by a human and do not themselves establish wrongdoing. The owner receives a minimal notification and a link to the protected review screen, not unnecessary private content. The platform does not make decisions with legal or similarly significant effects solely by automated processing.
Your rights
Depending on the legal basis and circumstances, you may request access, correction, erasure, restriction, portability or object to processing. You can withdraw consent without affecting prior lawful processing. We normally respond within one month, with lawful extensions explained where necessary. You may complain to the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych (uodo.gov.pl), or another competent supervisory authority. Providing essential account data is necessary for the service; marketing is optional.
Transient messages and recovery
Disaster-recovery exports exclude transient email bodies and queues, authentication links, sessions and raw AI instructions. Restoring a backup does not replay historical messages. The app queues an unsent contact message for at most 24 hours and erases its body after authenticated SMTP acceptance. IONOS then processes delivery under its service terms; WebWita does not claim a separately verified provider-queue lifetime. The dedicated system mailbox receives delivery reports for manual review, under the provider’s mailbox service. Customers remain responsible for the retention of copies received in their own inboxes.