Draft, pending legal review. This document is a pre-launch template draft and is not yet in force. The counsel-approved version becomes version 1.0 and takes effect at launch.
This policy explains what personal data AEC Integrations (the "service") collects, why, how long we keep it, and the rights you have over it. The service is operated by The WBS Project (the "operator", "we", "us"), which is the data controller for the personal data described here. It is written to comply with the EU and UK General Data Protection Regulation (GDPR).
Controller: Pending, Pending. Data-protection contact: founders@thewbsproject.com.
What we collect
We collect only what we need to run the service:
- Contact details you give us: for example the email address you provide to join the waitlist, send feedback, submit a review, or report a correction. Reviews and requests may include any additional information you choose to enter.
- Review and request content: the text, ratings, and optional metadata you submit (such as your role, years of use, and your firm), together with limited technical context (such as a timestamp) used for moderation and anti-abuse. The optional firm you give is used only in aggregate (a count of distinct firms that have reviewed) and is not shown on your published review; it is removed if you delete your account.
- Usage and analytics data: pages viewed, approximate location derived from IP, device and browser type, and similar event data, collected through privacy-respecting product analytics to understand how the service is used. This is the part of our measurement that depends on your consent.
- Operational telemetry: anonymous error reports and page-performance measurements, used only to keep the service reliable and secure. This data carries no account identifier, no advertising identifier, and no identifier we can link back to you across visits. See "Do Not Track, Global Privacy Control, and operational telemetry" below.
We do not sell your personal data, and we do not use it for third-party advertising.
Lawful basis
We rely on the following lawful bases under the GDPR:
- Legitimate interests: operating, securing, and improving the service, moderating content, and preventing abuse, balanced against your rights.
- Consent: where required, for example for non-essential analytics cookies; you can withdraw consent at any time.
- Contract / steps before a contract: to provide a feature you have asked for, such as adding you to the waitlist or publishing a review you submit.
- Legal obligation: where we must process data to comply with the law.
Cookies and similar technologies
We use a small number of strictly necessary cookies to make the service work, and, subject to your consent where required, analytics that help us measure and improve it. You can control non-essential cookies through the consent controls provided in the service and through your browser settings.
Do Not Track, Global Privacy Control, and operational telemetry
We honour the Do Not Track (DNT) and Global Privacy Control (GPC) browser signals as an opt-out of product analytics. If your browser sends either signal, we do not show you the consent banner, we do not record pageviews or product events for you, and we do not store any analytics identifier in your browser. That decision cannot be overridden by a previously stored choice.
A narrow slice of operational telemetry runs for every visitor, whether or not you have consented and whether or not you send DNT or GPC. It is limited to two things: error reports, so we learn that a page failed, and performance measurements, so we learn that a page was slow. We treat this as strictly necessary to operating the service securely and reliably, and it is scoped to match:
- it carries no identifiers of any kind, and nothing that links one visit to another;
- it writes nothing persistent to your browser, no cookie and no local storage entry, so it leaves no trace between page loads;
- it is never used for advertising, profiling, or measuring you as an individual, and it tells us that an error or a slow page happened, not who it happened to.
We do not record your screen. There is no session recording, session replay, or similar playback of your activity on the service.
Because we do not sell or share personal data, the statutory scope of the GPC signal does not apply to us in any case; we honour it as an analytics opt-out regardless.
How we share data
We share personal data only with service providers ("processors") that help us run the service, for example hosting and content delivery, email delivery, product analytics, and application monitoring, under contracts that require them to protect it and use it only on our instructions. Some of these providers may process data outside your country; where they do, we rely on appropriate safeguards such as the European Commission's standard contractual clauses. We may also disclose data where required by law or to protect the rights, safety, and security of the service and its users.
Reviews you submit are intended for publication and, once approved, are visible to the public. Do not include personal data in a review that you do not want to be public.
Retention
We keep personal data only as long as we need it for the purposes above:
- Waitlist and feedback emails: until you ask us to remove them or they are no longer needed.
- Published reviews and requests: for as long as the content remains published, plus a limited period for audit and abuse-prevention.
- Analytics and monitoring data: for a limited retention window in line with the relevant provider's settings, after which it is deleted or aggregated.
Your rights
Subject to applicable law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent. You also have the right to lodge a complaint with your local data-protection authority. To exercise any of these rights, contact us at founders@thewbsproject.com; we will respond within the timeframe the law requires.
Deletion
To request deletion of your personal data, including a waitlist or feedback email, or a review you submitted, contact us at founders@thewbsproject.com. We will delete or anonymise the data we hold about you, except where we are required or permitted by law to retain it (for example, a limited audit record kept for abuse prevention).
Children
The service is intended for professional use and is not directed at children under 16. We do not knowingly collect personal data from children.
Changes to this policy
We may update this policy from time to time. The current version and its effective date are shown at the top of this page, and the full change history is the public commit log of this repository. Where a change materially affects how we use your personal data, we will take additional steps to make it prominent.
Contact
Privacy questions or requests: founders@thewbsproject.com.