Privacy Policy

1. Who is responsible for your data

The company responsible for your personal data (the “controller” in GDPR terms) is WebWay OÜ, an Estonian company (registry code 17529905) based in Tallinn, Estonia. For any privacy question, write to info@webway.ee.

2. What this policy covers

This policy covers the website webway.ee, including the contact form on our contact page and the AI chat on our demo page. It also covers requests and messages that reach us by email, phone or messaging apps. It does not cover other websites we link to, or the client’s site that one portfolio demo loads when you ask for it (section 13).

3. What personal data we collect

We collect only the data we need. Depending on how you use the site, this may include:

• Data you give us yourself: your name, email address, phone number, company name and what you write in your message. You can send it through the contact form or contact us by email, phone or a messaging app. The form asks for your name, email address and message; the phone number and company name are optional. The website does not keep what the form collects: it passes your message straight to our inbox and to our customer-records system (CRM) and stores no copy of it (sections 7 and 9). The project calculator sends us nothing by itself. Its button opens this contact form with your answers already filled in, and nothing reaches us until you send the form yourself. Anything you type into the AI chat also belongs here; section 6 explains what happens to it.
• Technical data collected automatically. Our own logs record the page language, how long a request took, and a coded tag made from your IP address (the address of your internet connection), never the address itself. The tag is a salted SHA-256 hash. We use the same tag to count requests, so that one visitor cannot flood the site with them. Vercel, the company that hosts our site, records full IP addresses in its own logs, as any hosting company does. We count which pages are viewed without cookies, as the next point describes. Google Analytics measures your visit only if you allow analytics cookies.
• A page-view count without cookies. Every page of this site loads a small script from this site itself. For each page you open, the script sends one short message to our customer-records system (CRM) at webway-crm.vercel.app. The message contains the page address without anything after a “?”, your screen width, the first two letters of your browser’s language and the time. It also contains, with the first page you open only, the domain of the website whose link brought you here: only the domain, and nothing if that link was on this site. The pages you open after that carry none. The script places nothing on your device: no cookie and nothing in local storage. If your browser sends a “Do Not Track” or “Global Privacy Control” signal, the script stops before it sends anything, and your browser does not contact webway-crm.vercel.app at all. Like any request on the internet, the message reaches the CRM with your IP address and your browser’s user-agent (a short text naming your browser and operating system), and the CRM stores neither. It uses them only to filter out requests from bots; to note the country the visit came from (Vercel, which hosts the CRM, reads it from the IP address); to keep a one-minute counter, tied to a hash of the IP address, that stops one address from flooding the CRM; and to compute a daily visitor tag. That tag is a coded value made from your IP address, user-agent and the date (a keyed hash: HMAC-SHA256 with a secret key), so that several pages viewed on one day count as one visitor. The tag changes every day. Section 9 says what the CRM keeps and for how long.
• Settings stored in your browser: the colour theme you chose (dark or light) and your answer to the cookie question. Your language is not stored; it is part of the page address (/en, /et, /ru).

4. Why we process your data and on what legal basis

We use personal data for the following purposes. Each has a legal basis under Article 6 of the GDPR:

• To answer your enquiry, prepare a quote and take the steps you ask for before we enter into a contract. Legal basis: performance of a contract or steps before one (Art. 6(1)(b)). This is also the basis for what you send through the contact form: you send it so that we reply to you.
• To run, protect and improve the website, to stop one visitor from flooding it with requests, and to answer you when you write in the AI chat. Legal basis: our legitimate interest in keeping the site working and in showing what we build (Art. 6(1)(f)). Whether you use the chat at all is your choice.
• To count page views without cookies, as described in section 3: which pages are read, where visitors come from, from which countries and on which kind of device. Legal basis: our legitimate interest in knowing how the site is used so that we can improve it (Art. 6(1)(f)). You have the right to object to this at any time (Art. 21 GDPR). The count identifies nobody, so if you object by email, we have nothing to match your visits to: we could neither find them nor stop counting them. An objection therefore takes effect in your browser. A “Do Not Track” or “Global Privacy Control” signal stops the script before it sends anything, and so does a content blocker (such as an ad blocker) that blocks requests to webway-crm.vercel.app. If you have questions about the count, write to info@webway.ee.
• To run Google Analytics 4 and Google Ads, and to send you information you have asked for. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time. Neither Google Analytics nor Google Ads loads before you give it. The only measurement that runs without your consent is the page-view count without cookies described above, which places nothing on your device.
• To meet our accounting and other legal obligations. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).

5. Cookies and local storage

Our site sets no cookies of its own. It stores exactly two values in your browser’s local storage (a small storage area inside your browser): webway-theme, which holds “dark” or “light” and is saved only when you press the theme button, and webway-consent, which holds your answer to the cookie question and is saved only when you answer it. Neither has an expiry date; both stay until you clear this site’s data in your browser. Your language is not stored; it is part of the page address (/en, /et, /ru). The page-view count from section 3 adds nothing to this: it sets no cookie and saves nothing in your browser’s storage.

The only cookies that can appear are Google’s, from Google Analytics 4 (visit statistics) and Google Ads (measuring our ads and showing them to people who have visited the site). Nothing from Google loads until you allow it: no Google script and not a single request to a Google server. On your first visit, a small card in the corner of the screen asks you. “Allow” and “No thanks” are two buttons of the same size, side by side, and each takes one click. If you decline, nothing from Google loads and the site works exactly the same.

You can change your answer at any time with the “Cookie settings” link at the bottom of every page, which opens the same question again. You can also clear or block cookies and local storage in your browser settings. If you clear ours, the site simply asks about cookies again and forgets your theme.

6. The AI chat on our demo page

Our demo page (/ai-demo after the language part of the address, for example /en/ai-demo) has an AI chat you can write in. Using it is optional: if you never open it, nothing in this section happens.

When you send a message, your text (up to 600 characters) and up to eight earlier messages from the same conversation go to our server. From there they go on, word for word, to Anthropic PBC (api.anthropic.com) in the United States, which writes the reply. So Anthropic receives whatever you write, and this data leaves the European Economic Area (EEA).

Please do not type personal or confidential information into the chat, whether it is yours or anyone else’s. Everything you type is sent on, including any personal data you put in it. If you want to tell us something private, email info@webway.ee instead.

We keep no copy of the conversation. It exists only in your browser and is gone when you reload the page, and the text of your messages is never written to our logs. Our logs record only the coded tag of your IP address (a salted hash), the page language and how long the request took.

7. Service providers we share data with

We do not sell your personal data. For the website, only the following providers receive any data, and each receives only what its job needs. Vercel hosts the site and runs its server code; it records requests, including full IP addresses, in its own logs. Anthropic PBC writes the replies in the AI chat and receives the text you type there. Upstash stores the counters that limit requests; they hold a hashed IP and a number, nothing else. Resend delivers what you send through the contact form to our inbox as an email. Google provides Analytics 4 and Google Ads and receives data about your visit only after you allow cookies. Our fonts load from our own domain, so nothing is requested from Google Fonts.

The page-view count (section 3) goes from your browser straight to our customer-records system (CRM) at webway-crm.vercel.app, with no other service in between. The script that sends it is a file of this website and loads the same way as its pages. Vercel hosts the CRM too, so Vercel’s logs record these requests in the same way. We give the count to nobody for their own use.

What you send through the contact form goes to two places: the inbox where we read and answer enquiries, and our customer-records system (CRM). Both receive your name, email address, phone number, company name and message, plus the language of the page you wrote from and the coded tag of your IP address (a salted hash), not the address itself. The inbox copy is an email that Resend delivers for us. If your email address has a plain, standard format, it is set as the address our reply goes to; otherwise it still reaches us in the text of the email. Nothing is sent to you automatically. The CRM copy also includes your browser’s user-agent, and it is signed, so the receiving side can tell our message from a forgery. The website keeps no copy of either. The last step of the delivery to the CRM may go through an automation service. Such a service acts only on our instructions, and it keeps its record of the transfer for as long as its own rules say. Apart from the providers named in this section, nobody is sent what you wrote.

We may also disclose data when the law requires it or to protect our legal rights.

8. International data transfers

Several of the recipients above are US companies. Anthropic PBC processes the chat in the United States, so anything you type into the AI chat leaves the European Economic Area (EEA). That is why the chat is optional and why we ask you not to type anything personal into it. Google is also a US company, and once you allow analytics and advertising cookies, data about your visit may be processed there. Resend, which delivers the contact form’s email to our inbox, is a US company and processes it in the United States, so what you send through the form leaves the EEA on its way to us. For Vercel and Upstash, where the data is physically stored depends on the server regions set up for our projects. Whenever data leaves the EEA, we rely on the safeguards the provider offers for EU data: usually the European Commission’s Standard Contractual Clauses (model contract terms for protecting data) or an adequacy decision (an EU decision that a country protects data well enough). To find out which of these applies to a particular provider, write to info@webway.ee.

9. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it for. We keep enquiries and correspondence for as long as our relationship lasts and for a reasonable period afterwards. We keep data tied to accounting documents for 7 years, as the Estonian Accounting Act (Raamatupidamise seadus) requires.

The website itself keeps nothing the contact form collects: your message is passed on as it arrives, and no copy of it is written to this site’s storage or logs. Resend, which delivers the email to our inbox, keeps its own record of it under its own rules.

The counters that stop one visitor from flooding us with requests delete themselves. There are two sets. The AI chat has a per-minute counter, deleted after 70 seconds, and a per-day counter, deleted at the next midnight UTC. The contact form has one counter covering ten minutes and one covering twenty-four hours. Both are rolling: each expires that long after the request that started it, without waiting for a fixed hour. All counters use the salted hash, never your IP address.

We keep no copy of AI chat conversations anywhere: a conversation exists only in your browser and is gone when you reload the page, and the text of your messages is never written to our logs. Our hosting provider keeps its own logs under its own rules.

Each page view from the cookieless count is kept in our CRM as one record: the page address, the domain of the linking website, the country, the device type (desktop or mobile), the daily visitor tag and the time it arrived. It is also added to a daily total of views and visitors. These records have no automatic deletion date at present: they stay until we delete them. None of them holds your IP address or user-agent, and because the tag changes every day, visits on different days are not linked. The CRM also keeps a one-minute counter for the count, tied to a hash of your IP address, that stops one address from flooding it; the counter expires when its minute is up and is removed in a later clean-up.

Everything else is deleted or anonymised once it is no longer needed.

10. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy of it.
• Have inaccurate data corrected and incomplete data completed.
• Have your data erased (“right to be forgotten”) where the law allows.
• Restrict or object to processing, and receive your data in a form you can take to another provider (data portability).
• Withdraw your consent at any time. Processing done before you withdraw it stays lawful.

11. How to exercise your rights and complain

To use any of these rights, email info@webway.ee. We will reply within the time the law sets. If you believe we process your data unlawfully, you can complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

12. How we protect your data

We use appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. The whole site uses an encrypted connection (HTTPS). Every response carries the Strict-Transport-Security header, so browsers refuse to load the site without encryption. Every response also carries these security instructions for your browser (headers): Referrer-Policy set to strict-origin-when-cross-origin, X-Content-Type-Options set to nosniff, X-Frame-Options set to SAMEORIGIN, and a Permissions-Policy that turns off the site’s access to the camera, microphone, location, payments and USB. We limit requests by a hashed IP, so the address itself never has to be stored. We do not yet send a Content-Security-Policy header. No way of sending data over the internet is completely secure, but we work to keep your data safe.

13. Links to other websites and the embedded demo

Our site links to other websites. One case study, the Noble Needle page, can also load a working 3D configurator that runs on the client’s own domain, nobleneedle.vercel.app. Nothing is requested from that domain until you press the button that loads it. Once you press it, that domain and the analytics and font services the client’s site uses receive your IP address and see your browser’s request, exactly as if you had opened their page yourself. We are not responsible for the content or privacy practices of these sites, and we recommend reading their privacy policies.

14. Changes to this policy

We may update this policy from time to time. The current version, with its “last updated” date, is always on this page. We will point out significant changes on the site.

15. Direct B2B outreach — if we emailed your business first

This section applies if your business received a one-time introduction email from us. We did not get your details from you. We use business contact details that are publicly available, taken from these public sources:

• Public business registers (for example äriregister, teatmik.ee, inforegister.ee and similar registers in Finland, Latvia and Lithuania).
• Your company website and its public contact pages.
• Public maps and business directories (for example Google Maps).

In practice this is business contact data only: company name, a work email address, a phone number, website, line of business, city and public registry data. We do not collect special categories of personal data (such as health, religion or political views), and we do not build profiles of private individuals.

Why we used it: to send your business one personal message offering our web-design services, for example a free mock-up of a modern website. That is the only purpose: we do not sell your data or use it for anything else.

Our legal basis is legitimate interest (Article 6(1)(f) GDPR): contacting businesses whose contact details are public, directly and in a limited, relevant way that has little impact on them. Because we did not get the data from you, we inform you as Article 14 GDPR requires, through the notice in our email and on this page. You can object at any time (see the next section), and we stop immediately.

For this outreach, only WebWay and the service providers that work for us on our instructions see the data: Google (Gmail), which sends and stores our emails, and our hosting and database providers (EU region), which store the contact list securely. We never sell your data or share it for anyone else’s marketing.

We keep this data only as long as the outreach is relevant. If you object or ask us to erase your data, we delete it and add your address to a do-not-contact list (suppression list). That list is a minimal record, kept only to make sure we never contact you again.

Besides the rights listed in section 10, you have an absolute right to object to direct marketing. If you believe we handled your data wrongly, we would like to hear from you first. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the data protection authority in your own country.

For this section, the English version prevails; the Estonian and Russian versions are provided for convenience.

Contact

For any question about this policy or your personal data, please contact us:

WebWay OÜ · Reg. code 17529905 · Sõpruse pst 209-23, 13419 Tallinn, Estonia
info@webway.ee