Privacy Policy

1. Scope

This Privacy Policy explains how Webium LLC ("Webium") collects, uses, discloses and protects personal information when you use webium.ai, create a Webium account, build or host a project, contact support, or otherwise interact with Webium.

This policy does not replace the privacy notice that a Webium customer must give to the end users of that customer's own application.

2. Information we collect

Account and contact information

Name, email address, account identifiers, password-verification information, organization information you choose to provide, communication preferences and account status.

Billing and transaction information

Subscription plan, project subscriptions, transaction identifiers, billing country/address information and payment status. If a third-party payment processor handles payment cards, Webium does not need to store full card numbers or card verification values.

Project and AI interaction information

Prompts, instructions, conversations, project names, generated plans, source code, configuration, uploaded reference files, versions, integration metadata and other materials you choose to place in a project.

Customer application data

Depending on what you build, a Webium-hosted application may process information submitted by your application's end users. For this data, the Webium customer decides what to collect and why, and Webium generally processes it on the customer's instructions under the DPA.

Usage, security and technical information

IP address or derived network/security information, browser/device information, request metadata, authentication events, error logs, service diagnostics, project activity and similar information needed to operate, secure and troubleshoot the Service. Webium aims to minimize collection of raw identifiers where they are not necessary.

Support communications

Messages, attachments, logs and other information you provide when requesting help, reporting abuse or communicating with us.

3. How we use information

• provide, maintain and improve the Service;
• authenticate users and protect accounts;
• generate, edit, deploy and host customer applications;
• process subscriptions and maintain transaction records;
• provide support and respond to requests;
• detect fraud, abuse, malware and security incidents;
• comply with legal obligations and enforce agreements;
• measure service reliability and product usage; and
• send service messages and, where legally permitted, marketing communications.

4. Artificial intelligence processing

Webium may send prompts, relevant project context and other material needed for an AI task to an AI service provider. Webium does not use Customer Content to train Webium-owned general-purpose AI models. If Webium ever offers an optional program that uses Customer Content for model training or generalized improvement beyond providing the customer's service, Webium will describe that program and obtain any consent required by law before using the information for that purpose.

See our AI Use & Transparency Policy and Subprocessor List.

5. Legal bases for EEA/UK processing

Where the GDPR, UK GDPR or similar law applies to Webium as a controller, our legal bases may include:

• Contract: processing needed to create and administer your account, build and host projects, and provide support;
• Legitimate interests: securing the Service, preventing fraud, maintaining service reliability, improving features and conducting ordinary business operations, where those interests are not overridden by your rights;
• Consent: where we ask for consent, such as certain optional cookies or marketing; and
• Legal obligation: tax, accounting, sanctions, lawful requests and other obligations.

6. How we disclose information

We may disclose information to:

• service providers and subprocessors that help deliver cloud infrastructure, AI functionality, transactional email, payments, monitoring or support;
• professional advisers, auditors and insurers under appropriate confidentiality duties;
• government authorities or other parties when disclosure is required by law or reasonably necessary to protect rights, safety and security; and
• a buyer, investor or successor in connection with a financing, merger, acquisition, reorganization or sale, subject to applicable law.

Webium does not sell personal information for money. As of the Effective Date, Webium does not share personal information for cross-context behavioral advertising.

7. Service providers and subprocessors

Our current principal subprocessors are listed at webium.ai/subprocessors.html. Customer application data is subject to the DPA where applicable.

8. International transfers

Webium is a U.S. company and its providers may process information in the United States, Europe and other countries. Where required, Webium uses contractual or other lawful transfer mechanisms. For customer personal data transferred from the EEA, UK or Switzerland to Webium as processor, the transfer terms in our DPA apply.

9. Retention

We retain information for as long as reasonably necessary to provide the Service, maintain security and business records, comply with law, resolve disputes and enforce agreements. Retention varies by data type and customer instructions. When a project or account is deleted, information may remain temporarily in logs, backups, fraud-prevention systems or legal records until overwritten or removed under normal retention schedules.

Customers are responsible for determining retention periods for personal data collected through their own applications and for issuing appropriate deletion instructions.

10. Security

We use reasonable technical and organizational safeguards appropriate to the nature of the Service. These may include access controls, secure credential handling, encryption in transit, logging, data minimization and security monitoring. No system can be guaranteed completely secure. See Security.

11. Your choices and rights

Depending on where you live and subject to legal exceptions, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent or information about our processing. You may also have the right to appeal certain privacy-request decisions.

Submit a request using Privacy Requests or email support@webium.ai. We may need to verify your identity before completing a request.

12. EEA, UK and Swiss rights

If applicable law grants these rights, you may object to processing based on legitimate interests, request restriction of processing, request data portability, or lodge a complaint with your local data-protection authority. Withdrawing consent does not affect processing that was lawful before withdrawal.

13. United States state privacy rights

Residents of California and certain other U.S. states may have rights to know/access, correct, delete, obtain a portable copy, opt out of certain sale/sharing or targeted advertising, and limit certain uses of sensitive information, depending on whether the applicable law covers Webium and the particular processing.

Webium does not discriminate against users for exercising applicable privacy rights. See our Notice at Collection.

14. California disclosures

For purposes of California privacy law, the categories of personal information Webium may collect include identifiers, commercial information, internet or other electronic activity, professional information you provide, customer records, account login/security information, and contents of communications or files you intentionally provide to the Service. The purposes and disclosure categories are described in this Policy and our Notice at Collection.

As of the Effective Date, Webium does not sell personal information and does not share personal information for cross-context behavioral advertising.

15. Consumer health and other sensitive data

Webium is not intended to be used as a repository for regulated health, biometric or similarly sensitive data unless Webium expressly agrees to such use in writing. Washington's consumer-health privacy law and other specialized laws may impose obligations beyond ordinary website privacy rules. Customers building applications that collect health or sensitive information are responsible for obtaining appropriate legal review and must not assume Webium's general Service is configured for those laws.

16. Children

The Webium Service is intended for adults and is not directed to children. You must be at least 18 to create a Webium account. Customers must not intentionally use the general Webium Service to collect personal information from children where specialized child-privacy obligations would apply unless Webium has expressly approved that use in writing.

17. Cookies and browser storage

See our Cookie Policy. Where consent is required for non-essential technologies, Webium will seek consent before using them.

18. Changes to this Policy

We may update this Policy as our practices or legal obligations change. We will update the Effective Date and provide additional notice for material changes where required by law.

19. Contact