W
WebAlza

Privacy Policy

Last Updated: October 2026

1. Introduction

WebAlza ("we", "us", or "our") operates the platform at webalza.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our multi-channel outreach platform and related services. By accessing or using WebAlza, you consent to the data practices described in this policy.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

  • Full name
  • Email address
  • Password (stored as a salted hash; we never store plaintext passwords)

2.2 LinkedIn Account Credentials

To enable LinkedIn outreach, you may connect your LinkedIn account through our secure messaging integration. We never receive or store your raw LinkedIn password. The access tokens issued by the integration are stored encrypted at rest using AES-256 and are only used to perform actions on your behalf.

2.3 Email Account Credentials

To enable email outreach, you may connect an IMAP/SMTP mailbox. Your IMAP and SMTP credentials are stored encrypted at rest using AES-256 and are only decrypted when needed to send or monitor messages on your behalf.

2.4 Prospect Data

When you build outreach campaigns, we collect and store prospect data, including:

  • LinkedIn profile URLs and public profile information
  • Email addresses
  • Company name, title, and industry
  • Website URLs and domain information

2.5 Campaign Content

We store the outreach content you create and send, including:

  • Outreach messages and templates
  • Campaign sequences and steps
  • Personalization variables and AI-generated message variants

2.6 Website Redesigns

When you use the website redesign feature, we collect and store:

  • Source URLs submitted for analysis
  • Website screenshots captured during analysis
  • AI-generated redesign content and previews
  • Google PageSpeed audit results for the analyzed site

2.7 Analytics Data

We compute and store campaign analytics, including:

  • Reply rates and response times
  • Campaign performance metrics
  • Estimated pipeline value and conversion statistics

2.8 Payment Data

Payments are processed by Polar and Creem, our payment providers. We do not store full card numbers or raw payment instrument data. We retain only transaction confirmations, subscription status, and billing identifiers returned by the payment provider.

2.9 Technical Data

When you interact with WebAlza, we automatically collect technical data, including:

  • IP address
  • Browser type and version
  • Device and operating system information
  • Session logs and request IDs

2.10 Agent and API Credentials

If you connect external AI agents through our MCP server, we store and process:

  • API keys — stored only as cryptographic hashes; the plain key is shown to you once at creation
  • OAuth client registrations, consent grants, and token metadata for each connected agent (tokens are stored encrypted and rotated automatically)
  • Connection and usage records — which agent is connected, when it connects, and its recent activity — visible to you under Dashboard → Connect Your Agent

3. AI Processing

To power redesign generation and message personalization, your content (prospect URLs, website screenshots, and campaign messages) is sent to third-party AI providers, including OpenAI, Anthropic, Google Gemini, XAI, DeepSeek, and GLM.

No model training: We do not train AI models on your data. Each AI provider processes data according to its own terms of service and privacy policy, which govern how inputs and outputs are handled on their systems.

You are responsible for ensuring you have the rights to send any content (including prospect data and screenshots) to AI providers through our platform.

External agents: when you connect your own AI agent through our MCP server, data your agent retrieves from WebAlza is also processed by the provider operating that agent (for example, the company behind Claude or Cursor). That processing happens under your own agreement with that provider, outside our control — review your agent provider's privacy policy before connecting it.

4. How We Use Your Information

We use the information we collect to:

  • Provide the outreach, redesign, inbox, and analytics features of WebAlza
  • Process payments and manage your subscription
  • Send service notifications, security alerts, and product updates
  • Improve our platform and develop new features
  • Detect, prevent, and address fraud, abuse, and security issues
  • Comply with legal, accounting, and regulatory obligations

5. Data Storage and Security

We use industry-standard security measures to protect your data:

  • Primary database: Data is stored in MongoDB with encryption at rest
  • File storage: Screenshots and redesign previews are stored in Backblaze B2
  • Job queues: Redis is used for transient job queue data only
  • Credential encryption: LinkedIn tokens, email passwords, and AI API keys are encrypted at rest using AES-256
  • Transit encryption: All data in transit is protected via HTTPS/TLS
  • Audit trails: Request IDs are propagated via AsyncLocalStorage for security and debugging audit trails

6. Third-Party Services

We rely on the following third-party services to operate WebAlza:

  • Messaging integration provider: LinkedIn automation and multi-channel messaging API
  • Explee: Business data enrichment — when you use our website resolution or work-email finding features, the lead's name, company name, and company domain are shared with Explee to look up publicly available business contact information
  • Polar: Payment processing and billing
  • Creem: Payment processing and billing
  • AI Providers: OpenAI, Anthropic, Google Gemini, XAI, DeepSeek, and GLM
  • Backblaze B2: File storage for screenshots and redesign previews
  • Your connected agent vendors: when you attach an external AI agent via MCP (Claude, Cursor, Codex, and similar), that vendor processes the workspace data your agent retrieves, under your agreement with them. You choose and control this processor — see section 3.

Each third-party service operates under its own privacy policy and terms. We encourage you to review their policies to understand how they handle your data.

7. Cookies

We use cookies only for essential functionality:

  • Authentication cookies: To maintain your logged-in session
  • Preference cookies: To remember your theme and display settings

We do not use third-party advertising or tracking cookies.

8. Your Rights (GDPR/CCPA)

Depending on your jurisdiction, you may have the following rights:

  • Access: Request a copy of the personal data we hold about you
  • Rectification: Request correction of inaccurate or incomplete data
  • Erasure: Request deletion of your account and associated data
  • Data portability: Request export of your data in a machine-readable format
  • Objection: Object to certain processing of your data
  • Withdraw consent: Disconnect your LinkedIn or email accounts at any time from your account settings

To exercise any of these rights, contact us at support@webalza.com . We will respond within the timeframe required by applicable law.

9. Data Retention

We retain your data as follows:

  • Account data: Retained for the lifetime of your account
  • Campaign and prospect data: Retained while your account is active
  • Post-deletion: Deleted within 30 days of an account deletion request
  • Payment records: Retained as required by tax law (typically 7 years)
  • System logs: Retained for 90 days for security and debugging

10. Children's Privacy

WebAlza is not directed to children under 16 years of age. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, please contact us immediately and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email and update the "Last Updated" date shown at the top of this page. This policy is effective as of the "Last Updated" date shown.

12. AI Assistant (Webalza Mate)

The optional AI assistant ("Webalza Mate") is disabled by default. Until you explicitly enable it and accept the AI-assistant provisions, Mate has no access to your data and performs no processing.

  • What Mate accesses: only the workspace data you direct it to work with — such as your campaigns, leads, audiences, inbox conversations, and performance analytics. Access is always scoped to your own account.
  • No model training: we do not use your data to train AI models, and we do not sell your data. We only send data to AI providers under API terms that contractually prohibit them from training on customer content.
  • No human training review: we do not submit your data to any human review process for the purpose of improving AI models.
  • Conversation records: your chats with Mate (including which tools it used and what you confirmed) are stored in your workspace so you keep an audit trail, and are removed when you delete the conversation or your account.
  • Confirmations: actions that send messages or start campaigns run only after you explicitly confirm them in the assistant. We record that confirmation for your account's audit trail.
  • Opt-out: you can disable Mate at any time from the assistant panel. Disabling stops all assistant processing of your data. Existing conversation records remain until you delete them or your account.

External agents: the safeguards above describe the built-in assistant. If you connect your own agents through the MCP server, their access is governed by section 2.10 and section 3 of this policy and by the "External Agents and MCP" section of our Terms — the connected agent operates under your credentials and your agreement with its provider, and you can revoke its access at any time from the dashboard.

13. Contact

If you have questions about this Privacy Policy or our data practices, contact us at support@webalza.com .