Privacy Policy

We may collect account details such as name, email address, company information, billing details, and any website URLs or domains you submit through audits, diagnostic tools, and dashboard workflows.

We also collect operational information needed to run the service securely, including usage activity, diagnostic telemetry, device and browser signals, payment events, and support communications.

We use collected information to provide technical audits, generate tool outputs, maintain user workspaces, optimize platform speed, process subscription billing, respond to support inquiries, and protect against security incidents or malicious abuse.

Under the EU General Data Protection Regulation (GDPR), processing is grounded upon Article 6 legal bases: contractual necessity to deliver services, legitimate interests in platform defense, and affirmative consent for optional telemetry.

Under India's Digital Personal Data Protection Act, 2023 (DPDPA), processing is strictly carried out with your explicit, informed consent for specified purposes, or for legitimate uses such as billing fulfillment, security auditing, and responding to voluntary submissions.

In strict accordance with DPDPA Section 8(7) (Storage Limitation), GDPR Article 5(1)(e), and Indian CERT-In Cybersecurity Directions (Section 70B of the IT Act), we maintain the following formal data retention periods:

• System & Security Logs (IP addresses, HTTP request telemetry, authentication logs): Retained for exactly 180 days (mandatory CERT-In incident tracking baseline) in encrypted log storage, after which they are permanently purged.

• Ephemeral Guest Scans: Crawl telemetry and audit previews generated by unregistered guests are automatically deleted from server memory and database caches after 30 days.

• Registered User Workspaces: Audit reports, crawl history, and domain performance metrics remain accessible for the duration of an active subscription, and are permanently wiped 30 days after account termination or erasure request.

• Billing & Financial Invoices: Invoices, payment confirmation tokens, and GST/VAT tax transaction identifiers are retained for 7 years to satisfy statutory tax and corporate accounting mandates.

• Consent Records: Audit records of cookie and privacy consent choices (timestamp, version) are retained for up to 3 years to demonstrate regulatory compliance.

We do not sell, rent, or trade personal data. We disclose information only to vetted third-party infrastructure providers, payment gateways, and diagnostic engines under strict Data Processing Agreements (DPAs):

• Cloud Hosting & Compute: Hostinger Datacenters (ISO/IEC 27001:2022 certified).

• Edge Security & DDoS Protection: Cloudflare Anycast CDN.

• Payment Processing: Razorpay (PCI-DSS Level 1 certified; tokenized transactions with zero local card storage).

• AI Diagnostics: Google Cloud Vertex AI (zero customer data retention for model training).

We may also disclose information where strictly required by law, court order, or to defend our users against active cyber attacks.

If you reside in the European Economic Area (EEA) or the United Kingdom, you have the right to access your personal data (Art. 15), rectify inaccurate data (Art. 16), request erasure (Art. 17), restrict processing (Art. 18), data portability (Art. 20), and object to processing (Art. 21).

You may exercise any of these rights at any time by contacting privacy@webkernelai.com.

If you are a Data Principal located in India, the Digital Personal Data Protection Act, 2023 grants you the following statutory rights:

• Right to Access & Summary: Request a concise summary of personal data being processed and the identities of all Data Processors with whom such data has been shared.

• Right to Correction & Erasure: Request the correction of misleading or inaccurate personal data, the completion of incomplete data, and the erasure of personal data that is no longer necessary for the purpose of processing.

• Right of Grievance Redressal: Access a readily available, time-bound grievance redressal mechanism regarding any act or omission in our processing of your personal data.

• Right to Nominate: Designate any individual who shall, in the event of death or incapacity, exercise your data protection rights on your behalf.

To submit a Data Principal Request (DPR), email grievance@webkernelai.com with the subject line 'DPDPA Data Principal Request'.

In strict compliance with Section 9 of the DPDPA 2023, WebKernelAI does not knowingly collect personal data from individuals under 18 years of age without verifiable parental consent.

We do not track, conduct behavioral profiling, or serve targeted advertisements directed at minors. If we learn that a user is under 18 years of age without appropriate authorization, we will promptly terminate the account and purge their personal data.

Pursuant to Section 8 of the DPDPA 2023, WebKernelAI has designated a Grievance Redressal Officer for personal data inquiries, consent revocation, and complaints:

• Designated Officer: Data Protection & Grievance Officer (Attn: Aamir Sahil)

• Email: grievance@webkernelai.com (Secondary: support@webkernelai.com)

• Response & Redressal Turnaround: All formal grievances are acknowledged within 48 hours and investigated/resolved within 7 business days.

• Escalation to the Data Protection Board of India (DPBI): If you are unsatisfied with our internal grievance resolution, you have the statutory right to escalate your complaint to the Data Protection Board of India.

Consent can be withdrawn as easily as it was given. You can adjust or revoke your cookie and tracking preferences at any time via the 'Manage Cookie Preferences' button on our Cookies page, or by clearing your browser storage.

Withdrawing consent does not affect the legality of any data processing undertaken prior to the withdrawal.