Privacy Policy

The data controller is Maciej Zmitrukiewicz, a natural person operating the CometWeb brand. There is no registered company yet (no KRS / NIP for CometWeb). Privacy contact: hello@cometweb.io.

We collect: e-mail (registration), company name (optional), scanned URLs, technical logs (IP, user-agent, timestamp). On cometweb.io, the contact, demo, trial, newsletter and guide forms collect what you type in (name, e-mail, company, website, message); we store it in our own CRM on Hostinger (Frankfurt, DE) and e-mail it to ourselves through Resend. URLs you enter in the free tools are fetched by our server. We do not collect third-party data beyond scanned public domains.

We process data under contract (Art. 6(1)(b) GDPR) — to provide the service: domain scanning, report generation, billing. On the marketing site we may process analytics data under consent (Art. 6(1)(a)) via Google Tag Manager, Google Analytics 4 and Microsoft Clarity. We do not use scan results, reports, or other product data for profiling, AI model training, or any purpose other than providing the service.

Technical logs — 30 days. Sign-in logs — 90 days. AI request audit log — 180 days. Scan trend/archive windows — per plan (Free: current snapshot only, no trend archive; Growth: 30 days; Studio: 90 days; Scale: 365 days). Account data — until account deletion + 30 days grace.

You have the right to access, rectify, erase, restrict processing, port data, and lodge a complaint with the President of UODO (PL). We respond to requests within 72 hours.

Application data is stored on EU servers (Hostinger — Frankfurt, DE). Some vendors process data outside the EEA: Cloudflare (edge network in front of the app and the site), sign-in via Okta/Auth0 (EU-region tenant; Okta Inc. is a US company), payments via Stripe (IE + US), AI features via OpenRouter and directly via OpenAI (US), Google APIs used as Insight data sources, SERP data via SearchApi when you use that view, e-mail from cometweb.io forms via Resend Inc. (US) and, after consent, marketing-site analytics via Google LLC and Microsoft Clarity (US). These transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCC). SERP providers you connect with your own key (SerpApi, DataForSEO) receive queries on your instruction without a DPA on our side. The full list is on the GDPR page.

Hostinger (hosting · Frankfurt, DE), Cloudflare (CDN, firewall, TLS · global edge), Okta/Auth0 (sign-in · EU region), Stripe (payments · IE + US), OpenRouter and OpenAI (AI features · US), Anthropic (AI model via OpenRouter · US), Google APIs (Search Console, GA4, PageSpeed / CrUX, Safe Browsing · US/EU), Microsoft (Bing Webmaster and Clarity integrations, optional · US/EU), SearchApi (SERP data, only when used · US), SerpApi and DataForSEO (only with your own key), Resend (cometweb.io form e-mail · US), HubSpot (optional CRM integration in Insight · EU), Google Tag Manager & Analytics 4 and Microsoft Clarity (marketing-site analytics · US, after consent). Pinecone, Yandex and Kit are listed but switched off. Public legal and DPA links are in the table on the GDPR page.

Material changes are announced 30 days before taking effect — via email and an in-app banner. Minor edits (typos, formatting) — without notice. v4.3: controller named as a natural person (no registered company); EEA transfer summary aligned with SCC; privacy contact without a dedicated DPO placeholder.