Article 1 – Roles and Responsibilities
WEBFUL SAS (RCS Nantes 993 924 349) acts in two distinct capacities:
- Processor for the data of visitors to the measured websites: the account holder ("the Client") determines the purposes and means of processing; Webful acts on the Client's instructions, within the framework of Article 28 GDPR. This processing is governed by a Data Processing Agreement (DPA) made available to each Client.
- Independent data controller for the data it collects directly from account holders (identification, authentication, billing), described in this policy.
DPO Contact: contact form
Article 2 – Data Collected
The collected data includes:
- the email address provided during registration,
- the URL of the website being analyzed,
- website traffic statistics (page views, average duration, traffic sources),
- pseudonymized IP addresses (hashed, never stored in clear text).
This data is essential for the proper functioning of the Webful service.
Article 3 – Purpose and Legal Basis
Legal basis: The processing of personal data is based on the performance of the contract (Article 6.1.b GDPR) between the User and WEBFUL SAS. By subscribing to Webful, the User consents to the processing of their data as required for service operation.
Data is used exclusively to:
- Provide traffic analytics to the website owner (primary purpose)
- Manage the user account and authentication
- Process billing for paid subscriptions
- Improve service performance and features
- Ensure server security and maintenance
- Send technical notifications related to service operation (automatic reports if enabled, security alerts)
No unsolicited marketing communication. Users may disable report emails at any time from their dashboard.
Article 4 – Data Retention Period
Personal data is retained under the following conditions:
- Account data (email, name, password): As long as the account remains active. Permanent deletion occurs 30 days after account closure.
- Usage statistics (page views, traffic): Retention varies by account:
- Free account (Free plan): 90 days
- Pro account: 24 months (730 days), included as soon as you have 2 sites or one active add-on, or via the "24-month history" option on a single site
- Aggregated and anonymized data: Retained indefinitely for service improvement (no possibility of re-identification)
- Server and security logs: Maximum 3 months
- Billing data: 10 years (legal accounting requirement)
When an account is deleted, all personal data is permanently erased within 30 days, unless legally required otherwise (e.g., invoices).
Article 5 – Data Hosting
Data is stored on a dedicated server hosted by OVHcloud, in its datacenters located in France (European Union).
No data transfer outside the European Union is performed. For a Client established in Switzerland, hosting within the EU constitutes a transfer to a country offering adequate protection within the meaning of Article 16 of the Swiss Federal Act on Data Protection (FADP); no additional safeguards are required in this respect.
Article 6 – Your Rights (GDPR)
Under the General Data Protection Regulation (GDPR), you have the following rights over your personal data:
- Right of access: Obtain a copy of your personal data
- Right to rectification: Correct inaccurate or incomplete data
- Right to erasure: Request deletion of your data (under conditions)
- Right to restriction: Temporarily limit data processing
- Right to portability: Export your data in a structured format
- Right to object: Object to the processing of your data
- Right to withdraw consent: At any time, without affecting prior processing
To exercise your rights:
Through our contact form
Mail: WEBFUL SAS – GDPR Officer – 5 Grande Rue, 44520 Grand-Auverné, France
You may also file a complaint with the competent supervisory authority: the CNIL (French Data Protection Authority): www.cnil.fr for the European Union, or the FDPIC (Swiss Federal Data Protection and Information Commissioner): www.edoeb.admin.ch for Switzerland.
Article 7 – Security
Webful implements technical and organizational measures to ensure data security (HTTPS connection, encrypted passwords, pseudonymized IPs).
Article 8 – Confidentiality and Non-Disclosure
Data is never sold, exchanged, or transferred to third parties.
No advertising data or marketing profiling is performed.
Last update: June 19, 2026
WEBFUL SAS – RCS Nantes 993 924 349 – Intra-community VAT FR43993924349
