Back

Privacy Policy - CometWeb Insight

Last updated: October 4, 2026 (effective October 4, 2026) | Version 1.7

1. Data Controller

The controller of your personal data (account data) is Maciej Zmitrukiewicz, a sole trader operating under the unregistered-business regime (działalność nierejestrowana) under the brand "CometWeb", based in Wrocław, Poland. Contact for data-protection matters: maciej@cometweb.io. CometWeb is the product brand, not a separate company. We protect your privacy in accordance with GDPR (EU Regulation 2016/679) and applicable Polish data-protection law. We have not appointed a formal DPO — the email above is the single point of contact for data-protection enquiries.

2. Data We Collect

Registration data:

  • First and last name
  • Email address
  • Password (stored encrypted with Argon2)
  • When registering via Google or GitHub: public account identifier, email address, profile picture (avatar URL) and username — provided by the OAuth provider

Login data (automatic):

  • IP address
  • Device type (desktop/tablet/mobile)
  • Browser type
  • Login date and time

Service data:

  • URLs of analyzed websites
  • Analysis results (SEO, performance, accessibility, security, digital ecology)
  • Analysis points usage history
  • A/B test data: test names, variants, statistical significance thresholds and results associated with your Account

2a. Data Processed by AI Systems

To provide AI features (analyses, recommendations, chat), your project data may be sent to third-party large language model (LLM) providers: OpenRouter (primary gateway, not exclusive) and OpenAI (including direct api.openai.com for project/third-party context). DeepSeek and Perplexity only as OpenRouter slugs. Current list: /about-ai. Data transmitted includes: URLs of analyzed websites, performance/SEO/accessibility metrics, chat message content, and excerpts from analyzed pages. The optional MCP connector (Growth+) is a separate egress flow: project data goes only to the MCP client you authorise yourself — you choose the recipient, and the scope is limited to read-only tools. CometWeb does not control how the client you chose processes that data afterwards.

Legal basis: Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR (legitimate interests — providing AI features).

CometWeb applies data minimization: only data necessary for the requested AI feature is transmitted. Data from analyzed websites (which may include third-party personal data) is supported by a Legitimate Interest Assessment (LIA), with safeguards including the right to object and restriction of processing (details: section 7 and contact in section 10).

Provider-side retention: gateway (OpenRouter) and upstream model providers (including OpenAI, also via direct api.openai.com) retain logs as specified by the provider (including possible abuse/security logs). On the paid path we aim for no training on customer data and Zero Data Retention where contracted and verified — for direct OpenAI, ZDR may be self-asserted until account evidence is filed; that is not the same guarantee as CometWeb’s own retention. CometWeb does not store prompt bodies in ai_request_audit (metadata up to 180 days — section 9).

International transfers: when processing occurs outside the EEA, we rely on appropriate legal safeguards (including Standard Contractual Clauses, adequacy decisions, or equivalent provider safeguards). Full transfer and LIA details are available on request at maciej@cometweb.io.

3. Purposes of Processing

We process your data to:

  • Provide website analysis services
  • Manage your account and subscription
  • Communicate about services (notifications, updates)
  • Ensure Service security
  • Improve our services (anonymous analytics)

4. Legal Basis for Processing

  • Art. 6(1)(b) GDPR – contract performance (service provision)
  • Art. 6(1)(a) GDPR – your consent (marketing)
  • Art. 6(1)(f) GDPR – legitimate interest (security, analytics)

5. Data Security

We implement advanced security measures:

  • Password encryption with Argon2 algorithm
  • HTTPS connections
  • Session tokens in secure cookies (httpOnly)
  • Protection against CSRF and other attacks

6. Data Sharing

We do not sell your data. We may share it only with:

  • Technical service providers (hosting, email) – under data processing agreements
  • Government authorities – when required by law

7. Your Rights (GDPR)

You have the right to:

  • Access – obtain information about processed data
  • Rectification – correct inaccurate data
  • Erasure – request deletion of data ("right to be forgotten")
  • Restriction – limit processing in certain cases
  • Data portability – receive data in machine-readable format
  • Object – to processing based on legitimate interest
  • Complaint – to supervisory authority

8. Cookies

A detailed description of cookies used in the Service (app.cometweb.io) is available in our Cookies Policy. We use essential cookies in particular for:

  • User session management
  • Security (CSRF token)
  • Remembering preferences (language, theme)

Optional analytics cookies in the Service require separate consent via the cookie banner. The marketing site cometweb.io has a separate cookies policy.

9. Data Retention

  • Account data – for the duration of account + 30 days
  • Analysis data – 12 months from execution
  • Login logs – 90 days
  • AI request audit metadata – 180 days
  • Contact form submissions – 90 days (erasure also via /api/privacy/email)

10. Data Processing and Sub-processors

By connecting Google Search Console, Google Analytics 4 or Bing and by analysing chosen sites, the user may transfer data for which the user remains the controller (it may include third parties' data, e.g. their site's visitors). For such data the operator acts as a processor, processing it only on the user's documented instructions to provide the service, keeping it confidential and secured, and deleting or returning it after the service ends. This section sets out the basic data-processing (DPA) terms between the user and the operator.

We use trusted sub-processors acting on our instructions:

  • Hostinger (Hostinger International Ltd., Cyprus) — server (VPS) hosting, database and email (European Union)
  • Auth0, Inc. / Okta, Inc. — authentication, login and social sign-in; processes your email address and session metadata (USA/EU; EU–US Data Privacy Framework + SCCs)
  • Stripe, Inc. / Stripe Payments Europe, Ltd. — payments and subscription handling; processes billing data and your email address (Ireland/USA; EU–US Data Privacy Framework + SCCs)
  • Cloudflare, Inc. — edge network, WAF and the Turnstile anti-bot mechanism; as the TLS termination point it processes all traffic to the Service; while enabled, also Cloudflare Web Analytics — page-load and page-view measurement without cookies or identifiers (see the Cookies Policy, section 2.4) (USA/EU; EU–US Data Privacy Framework + SCCs)
  • Google LLC (Search Console / Analytics API) — fetching data from the accounts you connect (USA; EU–US Data Privacy Framework)
  • OpenRouter, Inc. (AI model gateway — primary, not exclusive) together with models reached via the gateway, plus OpenAI (including direct api.openai.com for project/third-party context after privacy rewrite). DeepSeek and Perplexity only as OpenRouter slugs (no direct api.deepseek.com). Current list: /about-ai (USA; EU–US Data Privacy Framework + SCCs)
  • Microsoft Corporation (Bing Webmaster Tools API, Microsoft Clarity) — fetching data from the accounts you connect (USA/EU; EU–US Data Privacy Framework + SCCs)
  • Yandex (Yandex Webmaster / Metrika) — only if you connect a Yandex account yourself. Russia is not covered by a European Commission adequacy decision; connecting this integration is your informed choice and you can disconnect it at any time
  • SearchApi LLC (searchapi.io) — external SERP API (search queries and project domains; no account PII). The vendor DPA is effective 31 March 2026 (accepted automatically by using the Services; no wet-ink signature); transfers to the USA rely on Standard Contractual Clauses (Commission Implementing Decision 2021/914). SearchApi DPA
  • DataForSEO — external SERP API (search queries and project domains; no account PII); currently disabled in the product until DPA / transfer mechanism are in place
  • Pinecone Systems, Inc. — vector knowledge base (RAG) for search across analysis history (USA); currently disabled in the product until DPA / transfer mechanism are in place

The current, machine-maintained sub-processor register is available at /api/auth/policy/sub-processors.

The database (MongoDB) is self-hosted on the operator's server (a Hostinger VPS in the EU) — we do not use an external cloud database provider.

AI processing: analysis content and related data are sent to language models via the OpenRouter gateway and/or direct api.openai.com (when project/third-party context requires the OpenAI allowlisted path). The current list of models is published at /about-ai. On the paid path we aim for no training on customer data and Zero Data Retention where contracted and verified — we do not claim that such a configuration is in place with every provider; for direct OpenAI, ZDR may be self-asserted until account evidence is filed; the provider may still keep abuse/security logs under its own policy. If a user gives separate, voluntary consent (in account settings), their analyses may be processed by free AI models that can use the data for training (the data is not published to public datasets); before sending to such models we pseudonymise the data — removing e.g. emails, IP addresses, phone numbers, URL query strings and common identifiers (card numbers, IBAN, national-ID-style numbers). This is strong minimisation but does not guarantee full anonymisation (e.g. names in free text). Consent can be withdrawn at any time in settings. Either way, please do not enter special-category data (Art. 9 GDPR) or data you are not permitted to share with third parties.

We apply four-layer pseudonymisation (technical regex, Art. 9/10 special categories, GUS dictionaries of first names / cities / streets, source-schema field blocking). We additionally require a separate "Full page context" consent before sending page content, search queries, or PII-bearing URL paths to free-tier models.

Irreversibility of inclusion in AI models: once consent is withdrawn, data previously sent via the free-model path may already have been incorporated into the model provider's training set. Removing such data from trained model weights may be technically impossible. Please consider this carefully before enabling the option.

11. Transfers Outside the EEA

Server hosting and email (Hostinger) are located in the European Union. AI providers (OpenRouter/OpenAI) and Google may process data outside the European Economic Area, including the USA. Such transfers rely on GDPR-compliant mechanisms — an adequacy decision (e.g. the EU–US Data Privacy Framework) or Standard Contractual Clauses (SCC).

12. Marketing and Consents

With your separate, voluntary consent we may send you marketing information (offers, news, materials) by email and via in-app / push notifications. Marketing consents are independent of the contract — not giving them does not limit use of the Service and they are not required at registration. Under the Electronic Communications Act (PKE, from 10 November 2024), each channel requires separate, unambiguous consent — in the Service this means separate toggles (off by default): marketing by email and in-app marketing (in-app / push notifications). Withdrawing one channel does not require giving up the other. You enable or withdraw them in Profile or Settings → Notifications. You may withdraw any consent at any time (in account settings or via a link in the email message), without affecting the lawfulness of processing before withdrawal. The legal basis for marketing is your consent (Art. 6(1)(a) GDPR).

13. Voluntary research contributions

With your separate, voluntary consent (off by default, not required at registration) you may share only pseudonymised aggregates of scan results for peer-reviewed academic research. We do not transfer account identifiers, project URLs, or personal data; a contribution is linked to your account only by an irreversible hash (HMAC) so that it can be deleted when you withdraw consent or delete your account — which is why, per Recital 26 GDPR, we call this pseudonymisation rather than full anonymisation — see this Policy and /research. Enable or withdraw consent in Settings → Your data. On the Free plan, active consent may increase your monthly Comet Credits limit by +10 cr (per current pricing). Legal basis: consent (Art. 6(1)(a) GDPR). Anonymization does not remove the need for consent before enabling contributions — we inform you in account settings, not on the registration form.

14. Contact

For data protection matters: maciej@cometweb.io