Privacy policy

What this policy covers

WebAct is operated by Webact. For support, privacy, security, or account-data requests, email support@webact.work.

This policy covers webact.work, the account service at app.webact.work, and the WebAct Chrome extension. WebAct provides chat and browser automation on pages you activate. Public free-tool pages describe workflows; they do not run an extraction simply because you visit them.

Website and free tools

Public pages load static HTML, CSS, JavaScript, fonts, and images from the website host. The host may process connection details such as IP address, request time, browser information, and requested URL to deliver and protect the site.

The free-tool pages show illustrative examples and copyable task instructions. They do not extract data from your pages. Tasks run through the extension after you activate it on a source page; context shared with a task is processed by the selected AI provider. The website’s example CSV contains only synthetic data.

The contact composer also prepares text locally. It does not create a ticket or send an email. If you copy, download, or send the prepared message, the destination you choose receives it.

This website uses Google Analytics to measure visits and page views. The Google tag loads when a page opens and may set analytics cookies to distinguish visitors and sessions.

Account and service records

We process your email address, account identifier, verification status, sessions, and security events to create and protect your account and synchronize sign-in between the account website and extension in the same Chrome profile. Email/password accounts store salted password hashes, not readable passwords. Verification and recovery challenges are stored as hashes.

We record monthly task counts, plan status, and service usage to enforce your allowance. Where paid billing is enabled, Paddle handles payment entry and we store customer and subscription references; we do not store full card details.

Google sign-in: access, use, storage, and sharing

If you choose Sign in with Google when available, WebAct requests only the openid and email scopes. We receive your Google account identifier (sub), email address, email-verification status, and token claims needed to validate the sign-in. We do not request your Google password, Gmail messages, Google Drive files, contacts, or calendar through this sign-in flow. Activating WebAct on a Google webpage and sharing its visible content is a separate browser action described below.

We use these identity details to authenticate you, associate the Google identity with your WebAct account, maintain your WebAct session, and protect against unauthorized access. We store your Google account identifier, email address, and verification status in our account database on Scaleway in Paris, France. The Google token is validated during sign-in; we do not persist Google access or refresh tokens for ongoing Google API access.

Google processes the authorization request. Our hosting provider processes the account records on our behalf, and Brevo receives your email address when we send account or security messages. Google sign-in identity records are not sent to AI providers or webhook destinations as task context. Information you independently include in a prompt or shared webpage follows the task-processing rules below.

We do not sell Google user data, use it for advertising or credit decisions, or use Google sign-in data to train AI models. Human access is limited to authorized support, security, and legal needs. WebAct’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We retain the account identity while your account is active and as necessary for security or legal obligations. To request deletion of the account and associated Google identity, email support@webact.work. You can also revoke Google authorization in your Google Account connections. Revocation prevents future authorized access but does not itself delete WebAct records or end an already-issued WebAct session; sign out of WebAct and request deletion separately.

Page content and AI assistance

When you activate WebAct and request assistance, the extension can process your instructions, selected or visible page content, source URL, relevant page controls, images or attachments you choose, and observations of task results. Share only the context you intend the assistant to use.

Selecting an area tells the assistant where to focus; it does not restrict sharing to that area. Relevant surrounding page text and controls may also be included. Ordinary form values can be shared, and automatic filtering should not be treated as a guarantee that all sensitive content is removed. Avoid sharing pages containing secrets or unnecessary personal information. Turning off page sharing affects new observations, not information already sent.

Browser mode uses the selected provider session, currently ChatGPT. Managed AI uses the configured API connection. Prompts, shared context, and task observations can be sent through the WebAct service and to the selected AI connection. Their retention and provider data controls differ.

Automation state can persist in the WebAct service, including the instruction, latest observation, action receipts, pending steps, and result summary. Some approved code actions can return additional page data or make network requests using the page’s signed-in access. Review the code and scope before approving it.

Deleting local WebAct history does not delete a conversation stored by an AI provider. Use the provider’s own controls for provider-held records.

Why the data is used

We use service data to deliver the assistance you request, authenticate and protect accounts, coordinate and verify tasks, enforce usage allowances, deliver account emails and opted-in integrations, manage enabled subscriptions, and investigate faults or abuse.

WebAct does not sell personal information or use extension page content to build advertising profiles, target advertisements, or determine creditworthiness. Website audience measurement is separate from extension task processing.

Where applicable data-protection law requires a legal basis, we rely on providing the service you request, legitimate interests in securing and maintaining the service, legal obligations, or consent for optional processing where required. You can contact us about the basis applicable to your information.

Providers and destinations

• Scaleway: hosts the account/API service and PostgreSQL database in Paris, France (fr-par-1), and encrypted deployment backups in Paris Object Storage (fr-par).
• Netlify: hosts the public static website and processes connection metadata needed to serve and protect it.
• Google: provides optional Google sign-in and website measurement through Google Analytics. These are separate from the selected AI connection.
• Brevo: receives your email address and transactional message content for verification, welcome, password recovery, and account-security emails.
• AI providers: the current browser connection uses your ChatGPT account. Managed WabAct AI, when enabled and selected, uses the configured OpenAI API connection. The selected route receives your instructions, shared context, and task results. Browser-provider credentials are used locally by the extension and are not sent to the WebAct server.
• Paddle: processes payments and subscriptions when billing is enabled.
• Your integrations: configured webhooks, n8n, Make, or Zapier destinations receive the task instruction, result summary, source-page URL, and verification explanation. This delivery payload excludes full page snapshots and binary attachments.

We may disclose information when required by law, to address security incidents or abuse, or for support you authorize. Authorized personnel may access records for these purposes; shared page content is not routinely reviewed by humans. A receiving provider controls its own retained copies under its terms and privacy practices.

How long information remains

• Contact-composer input: held in the current page; not saved by the site. Your own downloads, clipboard, and browser restoration are separate.
• Local extension library: retained in the browser profile until you remove records, reach history limits, clear extension data, or uninstall. Signing out hides account-scoped local work; it does not delete that library.
• Login: account sessions last up to 30 days and can be revoked earlier. OAuth state is short-lived. See Cookies & storage.
• Automation state: execution expires after 24 hours, but expiry or cancellation is not deletion. The service retains bounded recent instructions, observations, actions, and results; new tasks prune older terminal entries beyond the recent-task limit. There is no fixed automatic deletion period for all task records. You may request deletion by email.
• Webhook delivery: payloads can remain for up to 7 days; deduplication receipts can remain for up to 30 days. Removing a destination does not withdraw an accepted delivery.
• Account, security, and billing records: retained while needed to operate your account, resolve disputes, prevent fraud, or meet applicable legal obligations. We assess verified deletion requests against those needs and explain any records we must retain. Encrypted deployment backups have a 30-day retention window; relevant deletion requests must be reapplied if a backup is restored.

Your choices and requests

You can choose the context you share, review or stop tasks, clear local history, remove connected destinations, sign out, and uninstall the extension. Canceling a task, signing out, uninstalling, canceling billing, and requesting account deletion are different actions.

Depending on applicable law, you may be entitled to request access, correction, deletion, restriction, portability, or to object to particular processing. Where processing relies on consent, you may withdraw it. You may also be able to complain to your relevant data-protection authority. Rights and exceptions depend on your location and the processing involved.

Email support@webact.work from your account email to request access, correction, export, or deletion, including the Google identity linked to your account. We may verify account ownership, but will never ask you to send your password or verification code. We respond within the period required by applicable law. Deleting a WebAct account does not delete provider conversations, delivered emails, integration copies, or downloaded files; use the relevant provider’s controls for those records.

Processing locations and children

The WebAct account service, database, and deployment backups are hosted in Scaleway’s Paris region in France. Website hosting, Google identity and analytics, AI, email, payment, and integration providers may process data in other countries. Hosting the WebAct database in France does not mean that all processing remains in France. Where applicable law requires safeguards for an international transfer, we use the arrangements required for that transfer; contact support@webact.work for information about processing relevant to your account.

WebAct is designed for general productivity and is not directed to children. The selected provider’s age requirements also apply. Contact us if you believe a child has supplied personal information inappropriately.

Security and browser storage

WebAct uses HTTPS, salted password hashing, hashed session records, expiring sign-in challenges, account isolation, and encrypted integration secrets and backup archives. These controls reduce risk but cannot guarantee absolute security. Report security concerns to support@webact.work.

The account website uses a secure, HttpOnly session cookie. The extension stores preferences, account-scoped local history, saved tasks, and temporary workflow resources in your Chrome profile. A language cookie and local storage synchronize your language choice. Website Google Analytics may use separate analytics cookies; browser cookie controls and Google’s analytics opt-out tools can limit that measurement.

WebAct’s use and transfer of information received from Chrome extension APIs adheres to the Chrome Web Store User Data Policy, including its Limited Use requirements.

Updates to this policy

This page will show the date of the current policy. Material changes to data use should be reflected in the policy and relevant product disclosures before the new processing begins.

Read the related cookie information and security overview for more detail about the current implementation.

Product diagnostics and approximate location

WebAct records account-linked feature use, task steps, model validation results, errors and timing to troubleshoot problems and improve the product. Task traces are kept for 30 days; activity events for 90 days.

Optional. For new messages, let the WebAct administrator review your instructions, assistant replies, site origin and action summaries to investigate problems and improve WebAct. Shared content is kept for up to 30 days. Full page snapshots, form values, attachments and exported datasets are excluded. Recognized credentials are redacted; avoid including secrets in messages.

Turning this off removes shared content from the live troubleshooting archive and stops further content collection. Operational activity remains; encrypted backups expire on their normal retention schedule.

The service estimates country and city from connection IP addresses using a database hosted on WebAct’s server. It retains the last known country/city and a rounded city marker, not GPS or precise device location; IP addresses are not stored in the map records or sent to a geolocation API. Results can be inaccurate, especially with VPNs or mobile networks. Only the authorized administrator can view this information.

Diagnostic uploads retry locally for up to 7 days, with a maximum of 100 queued reports per browser profile. Service events and non-blocking issues are retained for 90 days; unresolved blocking issues remain until reviewed or recovered. Location records remain with the account. These records support product operation and improvement, not advertising or tracking across unrelated websites.

Temporary data for tools

When you ask WebAct to process data, it can store selected text, collected rows, calculation results and processing progress in your Chrome profile for up to 7 days, separated by account and site. Requested excerpts and row batches may be sent through WebAct to your selected AI provider to perform the task. Raw exported datasets are excluded from the administrator’s troubleshooting archive. Diagnostics may identify the public tool recipe you used and record processing counts, errors and outcomes to improve WebAct.