W
WebAlza

Privacy Policy

Last Updated: August 2026

1. Introduction

WebAlza ("we", "us", or "our") operates the platform at webalza.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our multi-channel outreach platform and related services. By accessing or using WebAlza, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Full name
  • Email address
  • Password (stored as a salted hash; we never store plaintext passwords)

2.2 LinkedIn Account Credentials

To enable LinkedIn outreach, you may connect your LinkedIn account via Unipile OAuth. We never receive or store your raw LinkedIn password. The access tokens issued by Unipile are stored encrypted at rest using AES-256 and are only used to perform actions on your behalf.

2.3 Email Account Credentials

To enable email outreach, you may connect an IMAP/SMTP mailbox. Your IMAP and SMTP credentials are stored encrypted at rest using AES-256 and are only decrypted when needed to send or monitor messages on your behalf.

2.4 Prospect Data

When you build outreach campaigns, we collect and store prospect data, including:

  • LinkedIn profile URLs and public profile information
  • Email addresses
  • Company name, title, and industry
  • Website URLs and domain information

2.5 Campaign Content

We store the outreach content you create and send, including:

  • Outreach messages and templates
  • Campaign sequences and steps
  • Personalization variables and AI-generated message variants

2.6 Website Redesigns

When you use the website redesign feature, we collect and store:

  • Source URLs submitted for analysis
  • Website screenshots captured during analysis
  • AI-generated redesign content and previews
  • Google PageSpeed audit results for the analyzed site

2.7 Analytics Data

We compute and store campaign analytics, including:

  • Reply rates and response times
  • Campaign performance metrics
  • Estimated pipeline value and conversion statistics

2.8 Payment Data

Payments are processed by Polar and Creem, our payment providers. We do not store full card numbers or raw payment instrument data. We retain only transaction confirmations, subscription status, and billing identifiers returned by the payment provider.

2.9 Technical Data

When you interact with WebAlza, we automatically collect technical data, including:

  • IP address
  • Browser type and version
  • Device and operating system information
  • Session logs and request IDs

3. AI Processing

To power redesign generation and message personalization, your content (prospect URLs, website screenshots, and campaign messages) is sent to third-party AI providers, including OpenAI, Anthropic, Google Gemini, XAI, DeepSeek, and GLM.

No model training: We do not train AI models on your data. Each AI provider processes data according to its own terms of service and privacy policy, which govern how inputs and outputs are handled on their systems.

You are responsible for ensuring you have the rights to send any content (including prospect data and screenshots) to AI providers through our platform.

4. How We Use Your Information

We use the information we collect to:

  • Provide the outreach, redesign, inbox, and analytics features of WebAlza
  • Process payments and manage your subscription
  • Send service notifications, security alerts, and product updates
  • Improve our platform and develop new features
  • Detect, prevent, and address fraud, abuse, and security issues
  • Comply with legal, accounting, and regulatory obligations

5. Data Storage and Security

We use industry-standard security measures to protect your data:

  • Primary database: Data is stored in MongoDB with encryption at rest
  • File storage: Screenshots and redesign previews are stored in Backblaze B2
  • Job queues: Redis is used for transient job queue data only
  • Credential encryption: LinkedIn tokens, email passwords, and AI API keys are encrypted at rest using AES-256
  • Transit encryption: All data in transit is protected via HTTPS/TLS
  • Audit trails: Request IDs are propagated via AsyncLocalStorage for security and debugging audit trails

6. Third-Party Services

We rely on the following third-party services to operate WebAlza:

  • Unipile: LinkedIn automation and multi-channel messaging API
  • Polar: Payment processing and billing
  • Creem: Payment processing and billing
  • AI Providers: OpenAI, Anthropic, Google Gemini, XAI, DeepSeek, and GLM
  • Backblaze B2: File storage for screenshots and redesign previews

Each third-party service operates under its own privacy policy and terms. We encourage you to review their policies to understand how they handle your data.

7. Cookies

We use cookies only for essential functionality:

  • Authentication cookies: To maintain your logged-in session
  • Preference cookies: To remember your theme and display settings

We do not use third-party advertising or tracking cookies.

8. Your Rights (GDPR/CCPA)

Depending on your jurisdiction, you may have the following rights:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Request correction of inaccurate or incomplete data
  • Erasure: Request deletion of your account and associated data
  • Data portability: Request export of your data in a machine-readable format
  • Objection: Object to certain processing of your data
  • Withdraw consent: Disconnect your LinkedIn or email accounts at any time from your account settings

To exercise any of these rights, contact us at support@webalza.com . We will respond within the timeframe required by applicable law.

9. Data Retention

We retain your data as follows:

  • Account data: Retained for the lifetime of your account
  • Campaign and prospect data: Retained while your account is active
  • Post-deletion: Deleted within 30 days of an account deletion request
  • Payment records: Retained as required by tax law (typically 7 years)
  • System logs: Retained for 90 days for security and debugging

10. Children's Privacy

WebAlza is not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us immediately and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the "Last Updated" date shown at the top of this page. This policy is effective as of the "Last Updated" date shown.

12. Contact

If you have questions about this Privacy Policy or our data practices, contact us at support@webalza.com .