GDPR data protection measures

1. Information clause (Art. 13)

Full text in the Privacy Policy. Summary: we collect data only to provide the service, store it in the EU, and some vendors process it outside the EEA (e.g. Cloudflare, AI model providers, Stripe, Auth0, consented marketing analytics) under the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCC). Every vendor is listed in section 4.

2. Security measures (Art. 32)

Encryption in transit (TLS) across the site, app, and API.
Email-and-password accounts: passwords are stored only as Argon2 hashes (older bcrypt hashes are verify-only). Google/GitHub sign-in runs via Auth0 (EU region). Sessions live in httpOnly cookies.
Role-based access control (RBAC) for workspaces and admin actions.
Admin actions are logged in an audit trail.
Daily database backups with time-limited retention, kept within the same hosting environment (no second-location copy yet).

3. Privacy contact (no dedicated DPO)

No dedicated Data Protection Officer (DPO) has been appointed. Privacy contact: Maciej Zmitrukiewicz · hello@cometweb.io. Rights requests — response in 72h, substantive decision within 30 days.

4. List of sub-processors

Hostinger International Ltd. Hosting: the Insight app and its database (Frankfurt, DE), cometweb.io, our self-hosted CRM (Twenty, Frankfurt, DE) that stores cometweb.io form submissions, application e-mail (SMTP) EU (app: Frankfurt, DE) Hostinger DPA ↗
Cloudflare, Inc. / Cloudflare Germany GmbH CDN, firewall and TLS termination in front of app.cometweb.io and cometweb.io: processes every request, including IP addresses. Turnstile bot check on the guide download forms (loads from challenges.cloudflare.com once you start filling in the form). Cookieless Web Analytics for visitors outside the EU Global edge (DPF + SCC) Cloudflare DPA ↗
Okta, Inc. (Auth0) Sign-in and account authentication EU region (Okta Inc., DPF + SCC) Okta legal terms ↗
Stripe, Inc. / Stripe Payments Europe Ltd. Payments and subscriptions IE + US (DPF + SCC) Stripe DPA ↗
OpenRouter, Inc. AI features (AI Insights, Orb, Code Fix): main gateway that routes prompts to model providers (e.g. OpenAI, Anthropic, DeepSeek, Perplexity) US (DPF + SCC) OpenRouter privacy policy ↗
OpenAI, LLC AI features: some requests go directly to the OpenAI API, others reach OpenAI models through OpenRouter US (DPF + SCC) OpenAI DPA ↗
Anthropic, PBC AI model provider, reached only through OpenRouter US (DPF + SCC) Anthropic privacy policy ↗
Google LLC (APIs) Insight data sources: Search Console and GA4 (only when you connect them), PageSpeed Insights / CrUX, Safe Browsing, favicons of audited domains. On cometweb.io, the free performance auditor sends the URL you enter to the PageSpeed Insights API from our server US / EU (DPF) Google Cloud DPA ↗
Google LLC (Tag Manager / Analytics 4) Marketing-site tag container and traffic analytics (consent; ad signals denied via Consent Mode) US (DPF + SCC) Google Ads Data Processing Terms ↗
Microsoft Corporation (Clarity) Marketing-site UX analytics / session replay (consent; no Clarity cookies; form fields masked; linked to the GA4 client ID); optional Insight integration that reads Clarity data for your own site US / EU (DPF + SCC) Microsoft Products and Services DPA ↗
Microsoft Corporation (Bing Webmaster) Optional Insight integration, only when you add a Bing Webmaster API key US / EU (DPF + SCC) Microsoft Products and Services DPA ↗
SearchApi LLC SERP data for the SERP / Share of Voice view (only when you use it) US (SCC) SearchApi DPA ↗
SerpApi, LLC SERP data, only with your own SerpApi key (BYOK, Growth+); queries and project domains are sent from our servers on your instruction US (no DPA in place) SerpApi legal ↗
DataForSEO SERP data, only with your own DataForSEO login (BYOK, Growth+); queries and project domains Location not confirmed (no DPA in place) DataForSEO ↗
Resend Inc. E-mail delivery for cometweb.io forms and guide download links US (SCC) Resend DPA ↗
Kit (ConvertKit LLC) Newsletter sending. Not active: newsletter sign-ups are kept in our own CRM and nothing is sent to Kit today US (SCC) Not active
HubSpot, Inc. Optional Insight integration that reads your own CRM data. cometweb.io forms no longer go to HubSpot EU (EU data centre) HubSpot DPA ↗
Simple Icons CDN Brand icons your browser loads inside the app: only your IP address and a fixed icon name (a recipient, not a processor) Global edge No DPA (public static CDN)
Pinecone Systems, Inc. Vector store for AI retrieval. Not active: switched off in production, would need a DPA before it is enabled US Not active
Yandex LLC / Direct Cursus Technology B.V. Optional Yandex sign-in, Metrica and Webmaster integration. Not active: switched off, because Russia has no adequacy decision and no transfer safeguard is in place RU Not active

Need a data processing agreement (Art. 28 GDPR) for your clients' data? It is available on request: hello@cometweb.io.

5. Data Protection Impact Assessment (DPIA)

We assess the privacy impact of features that process personal data before shipping them. Documentation available on request.

6. Breach notification procedure

We notify the supervisory authority within 72 hours and the affected users. Security vulnerability reports (product or cometweb.io): email hello@cometweb.io — we usually reply within 1–2 business days. Please do not include customer personal data unless required to reproduce the issue.