Privacy Policy

This Privacy Policy describes how Webel, Inc. ("Webel," "we," "us," or "our") collects, uses, retains, and shares information when you use our products and websites:

• Grow (grow.webel.ai) — our startup-management application;
• Webel AI (app.webel.ai) — our AI engineering-team application;
• the Dragon platform (dragon.webel.ai) — the platform and APIs that power Webel AI and that customers may build on;
• Beacon, when you use an instance of Beacon that Webel hosts (self-hosted Beacon deployments are operated by whoever deploys them, not by us); and
• our websites, including webel.ai (together, the "Services").

This policy applies wherever it is linked. If a Service or feature has a supplemental privacy notice, that notice governs for that feature to the extent it conflicts with this policy.

Privacy at a glance

• We don't sell your personal information, we don't "share" it for cross-context behavioral advertising, and we never have. We don't use advertising trackers, third-party analytics SDKs, ad-network pixels, or data brokers — on any of our sites or in any of our products.
• Your content is yours. Conversations, code, documents, cap tables, and business records you put into the Services ("Customer Content") are used to provide the Services to you — never handed to anyone else to build their products, and used beyond serving you only in de-identified or aggregated form (see the next two bullets).
• We do not train AI models on your Customer Content, and our agreements with our model providers don't allow them to either. When our products "learn," that learning lives inside your own workspace as inspectable knowledge you control, and it is deleted when your workspace is deleted (subject to the short recovery and backup windows in Section 7). If you bring your own model-provider key, calls made with it are governed by your agreement with that provider — see Section 4.2.
• We do use de-identified and aggregated data — data that can no longer reasonably be linked to you or your organization — to operate, secure, benchmark, improve, and (only in de-identified form) train our AI systems. We commit not to re-identify it (our only exception: testing that our own de-identification works, as the law permits). Aggregated statistics that identify no one may be used more broadly — see Section 4.3.
• Passwordless by design. You never create a password with us — we authenticate with passkeys and one-time email links, and we store sign-in tokens only as cryptographic hashes.
• Minimal tracking. We set only cookies necessary to sign you in and keep you signed in; our marketing site sets no cookies at all. Product emails may record delivery and open/click events so we and senders can tell whether mail arrived — see Section 5.
• You have real controls: you can see who can access your data in-product, delete conversations and workspaces, revoke sessions and credentials, and exercise the rights described in Your rights and choices.

1. Who we are, and whose data we handle

The Services are provided by Webel, Inc., a Delaware corporation with its principal place of business at 1522 Western Ave STE 95923, Seattle, WA 98101 ("Webel").

A "workspace" is the container in which members, conversations, content, and settings live in our applications; every workspace has an owner — an individual acting on their own behalf, or an organization.

Whose data we handle depends on the context:

• Data we handle for ourselves. We are responsible in our own right (the "business" under U.S. state privacy laws) for: account and profile data; billing data; usage and security telemetry; communications with us (support, feedback, waitlist); data on our websites; and Customer Content in workspaces owned by individual users acting on their own behalf.
• Data we handle for your organization. When you use the Services within a workspace owned by an organization (your employer, your company, or another entity), that organization is responsible for the Customer Content in that workspace, and we process it on the organization's behalf and per its instructions, as its service provider/processor under our Data Processing Addendum ("DPA"). Requests concerning that content should generally be directed to the organization; we will support the organization in responding.
• Dragon platform customers. If a customer builds its own application on the Dragon platform, that customer is responsible for its end users' data (including diagnostic traces the customer's application sends to Dragon), and we process it as the customer's service provider/processor under the DPA.

Organizations can request our DPA, including our list of subprocessors, at privacy@webel.ai.

2. Information we collect

We collect information in three ways: you provide it, we collect it automatically when you use the Services, and we receive it from third-party services you choose to connect.

2.1 Information you provide

• Account and profile data. Email address (the basis of your account identity), display name, workspace role, a phone number if you provide one for text-message notifications, and passkey metadata (a passkey's public credential and a name you give it — passkeys never give us your biometrics or device PIN, which stay on your device).
• Customer Content. The substance of your use of the Services, including: conversations with and instructions to our AI systems; messages with teammates; documents, images, and files you upload or import; source code and repository content you connect; knowledge, memories, plans, and other records the Services derive and store in your workspace from that content; and, in Grow, business records such as cap tables (including shareholder and stakeholder names, contact details, and holdings), financial data, fundraising CRM records, investor updates, board materials, data-room documents, and e-signature documents.
• Imported data. Content you deliberately import, such as data exports from other services (for example, a claude.ai data export or development-session transcripts), documents from cloud storage, or cap-table and accounting data from providers you connect. Imported content becomes part of your workspace's Customer Content.
• Credentials you store with us. API keys (for example, model-provider keys you bring), Git access credentials, and other named secrets you ask us to hold so the Services can act for you. These are encrypted at rest and write-only (we display at most the last four characters back to you), and our systems never write them into AI context, logs, or transcripts. Secrets you scope to a sandboxed task are injected only into that sandbox for the duration of the work; avoid instructing agents to print secret values, because command output becomes part of your workspace's transcript.
• Payment data. Payments are handled by our payment processor (Stripe). We receive and store billing contact details, plan and subscription state, and transaction amounts — not your full card number.
• Communications. Support requests, in-product feedback (including optional screenshots you attach), waitlist requests, and emails you send us.

2.2 Information we collect automatically

• Usage and metering data. To operate, secure, and bill the Services we record operational events — for example, per-request records of which AI model was called, token counts, latency, and computed cost, attributed to your workspace and account. These metering records are content-free (they count tokens; they do not store your prompts).
• Diagnostic and security data. Server-side logs, error reports, and bounded client diagnostics. Our client diagnostics are designed to exclude your content: they capture event breadcrumbs, error text, and stack traces, and we build them not to carry message content. We do not use third-party error-tracking or analytics services.
• Session and device data. Session records (creation and last-seen times) that you can view and revoke in your profile. We do not fingerprint devices, and we do not collect precise geolocation.
• IP addresses. We process IP addresses transiently for security (for example, rate-limiting sign-in attempts) and as an inherent part of serving web traffic through our infrastructure providers. Our applications do not build profiles from IP addresses. In Grow, when someone signs a document electronically, we record the signer's IP address and a timestamp as part of the signature's audit trail — this is intentional and disclosed on the signing page, because it is what makes the signature evidentially reliable.
• Email engagement data. Product and notification emails we send may include an open-tracking pixel and tracked links, recording delivery status and open/click counts so we (and, for features like investor updates in Grow, the sending workspace) can tell whether the email worked. See Cookies and similar technologies.

2.3 Information from third parties and integrations

Only when you (or your organization) connect them:

• Code hosting (GitHub). Repository contents, branches, commits, pull requests, CI status, and review comments — including comments written by third-party reviewers on pull requests you ask us to watch. We access repositories through a GitHub App with short-lived, scoped tokens where possible. If your workspace connects a code host, we associate your account with your code-host username (for example, your GitHub handle) so commits, pull requests, and reviews can be attributed to you.
• Google services (Grow). If you connect Gmail, Google Calendar, or Google Drive, we access the data you authorize (for example, matching email metadata and calendar events to CRM contacts and deals, or importing documents you select). Webel's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we use Google user data only to provide the features you enabled, we do not transfer it except as necessary to provide those features or as required by law, we do not use it for advertising, and we do not use Google user data to train generalized AI or machine-learning models — the de-identified-data uses described in Section 4.3 never include data obtained through Google APIs.
• Financial integrations (Grow). If you connect accounting or banking providers (for example, QuickBooks, Xero, or Plaid), we receive the financial records needed for the features you enable.
• Payment processor. Stripe sends us subscription lifecycle events.
• People who interact with you through the Services. We receive personal data about people who are not our users when our users provide it or when those people interact with our users through the Services — see People who are not our customers.

2.4 What we deliberately do not collect

No advertising identifiers. No third-party analytics or session-replay tools. No data purchased from data brokers. No device fingerprinting. No precise geolocation. No biometric data (passkeys keep biometrics on your device). We ask you not to submit sensitive information about yourself or others (such as health information, government identifiers, or someone's precise location) to the Services except where a feature clearly calls for it and you are entitled to provide it.

3. How we use information

We use the information described above to:

Some information is required to provide the Services at all — we cannot create or maintain an account without an email address, or bill you without billing details. If you do not provide it, we cannot provide the relevant Services. Other information you provide is optional, and where a use is optional (like marketing email), you can opt out at any time (Section 10).

We do not use your personal information for automated decision-making that produces legal or similarly significant effects about you.

4. AI, learning, and your data

The Services are AI systems, and we want to be precise — more precise than most privacy policies — about what "learning" means for your data.

4.1 Workspace learning is not model training

When our products learn how your business works, that learning takes the form of structured knowledge — memories, plans, decisions, context — stored inside your own workspace as part of your Customer Content. It is:

• scoped to your workspace: knowledge derived from your workspace is used to serve your workspace, not other customers;
• derived only from what you've shared: knowledge that feeds shared workspace context is derived from content shared within the workspace — content in a member's private conversations is excluded from workspace-shared learning;
• inspectable: you can browse what the system knows in-product; and
• deleted with your workspace: when your workspace is deleted, its knowledge is deleted with it (see Section 7).

None of this involves updating the weights of any AI model.

4.2 We do not train models on Customer Content

We do not use your Customer Content — your conversations, code, documents, images, cap tables, financial records, or anything else you put into the Services — to train, fine-tune, or otherwise improve generalized AI models (ours or anyone else's). Our agreements with model providers do not grant them any right to use your content to train their models, and limit their processing of your content to providing model services to us (including related safety, abuse-prevention, and legal-compliance processing).

Section 4.3 describes the only exception on our side: we may use de-identified and aggregated data — data that can no longer reasonably be linked to you or your organization — to evaluate, improve, and train our AI systems. We never train models on raw or merely pseudonymized Customer Content.

If you bring your own model-provider API key, requests made with your key are governed by your own agreement with that provider; we still never grant any provider training rights on our side.

4.3 De-identified and aggregated data

We use de-identified and aggregated data to operate, secure, benchmark, and improve the Services — including evaluating, improving, and training our AI systems for quality, safety, reliability, routing, and performance, and producing statistics about the Services. De-identified data is data from which identifiers have been removed or transformed such that it can no longer reasonably be linked to an identified or identifiable person, household, or customer. De-identified data consists of derived signals, measurements, and statistics — not verbatim conversations, code, or documents; we do not treat merely redacted or pseudonymized Customer Content as de-identified. When we de-identify data, we:

1. take reasonable technical and organizational measures to ensure it cannot reasonably be associated with you or your organization;
2. publicly commit — here — to maintain and use it only in de-identified form and not to attempt to re-identify it, except as permitted by law solely to test whether our de-identification works; and
3. if we ever share de-identified data with a recipient, contractually require the recipient to honor these same commitments — today we disclose only aggregated statistics externally.

Where we act as a service provider/processor for an organization or a Dragon platform customer, we create and use de-identified and aggregated data derived from that customer's Customer Content only as permitted by our agreement with the customer, including the DPA.

Aggregated statistics that identify no one (for example, service-wide feature-reliability rates or model latency distributions) are not personal information, and we may use and disclose them for any lawful purpose.

4.4 What our AI features send, and where

• Model providers. When you use an AI feature — and as part of background processing that maintains your workspace (deriving and indexing workspace knowledge, preparing digests, pre-warming model context, screening what our agents may say across sharing boundaries, and, in shared rooms where the feature is enabled, deciding whether our agent should respond) — the relevant conversation window and workspace context (which may include message text, code, documents, and images you've provided) is sent to a model provider for inference, under the restrictions in Section 4.2. Our current model providers are listed in our subprocessor list at webel.ai/subprocessors.
• Agent actions you direct. When you instruct our agents to act, data can flow where the action goes: search queries composed by the agent go to our search provider; a web page the agent fetches is requested from that site; code, commits, pull requests, and comments the agent produces for you are pushed to your connected repository host (including work-in-progress snapshots saved to your own repository); and outbound communications that carry reputational weight (for example, a public comment on a pull request) require explicit human approval in-product before they are sent.
• Sandboxed execution. Agent build-and-test work runs in isolated, single-tenant micro-VM sandboxes operated by our infrastructure subprocessor. Sandboxes hold your repository contents and the secrets you scoped to them for the duration of the work, never store credentials at rest (repository tokens are minted per-operation and revoked on teardown), and are torn down or hibernated when idle.

5. Cookies and similar technologies

We use only what is necessary to sign you in and keep the Services working:

We do not use advertising cookies, third-party analytics cookies, or cross-site tracking of any kind. Our marketing website (webel.ai) sets no cookies at all.

Email pixels. Product and notification emails may contain an open-tracking pixel and tracked links (see Section 2.2). You can opt out of non-essential email via the unsubscribe link in any such email; transactional email required to operate your account (such as sign-in links and receipts) cannot be unsubscribed from while you hold an account. Blocking remote images in your email client prevents the open pixel from firing in any of our email.

Do Not Track and Global Privacy Control. Because we do not sell personal information or "share" it for cross-context behavioral advertising (as U.S. state privacy laws define those terms), there is nothing for these signals to opt you out of; we treat browser privacy signals such as GPC as an opt-out of sale/sharing, which is our default state for everyone.

6. How we share information

We share personal information only as described here. We do not sell personal information and we do not "share" it for cross-context behavioral advertising, and we have done neither in the preceding 12 months.

• Subprocessors and service providers. Vendors that process data on our behalf, under contracts that limit their use of the data to providing their service to us. Our current subprocessors are listed in our subprocessor list at webel.ai/subprocessors and include: cloud hosting (Amazon Web Services, United States); AI model inference (Anthropic; Crusoe; Meta); isolated execution sandboxes (E2B); agent web search (Brave); payments (Stripe); transactional email (Resend; Google as SMTP relay); text messaging (Twilio); and code-hosting integration (GitHub). Organizations with a DPA will be notified of subprocessor changes as the DPA provides.
• At your direction. When you connect an integration, invite a guest or teammate, share a link, publish a status page, send an investor update, sign a document, or instruct an agent to act on an external system, we disclose the data that action requires to the party you directed it to. What you share with other people through the Services (for example, messages in a shared room, or content visible to your workspace) is visible to them per the access controls shown in-product.
• Your organization. If your account belongs to an organization's workspace, the organization's owners and administrators can see workspace-shared content and membership, and can manage (including delete) the workspace. They cannot read a member's private conversations by default; where the workspace enables owner break-glass access to member conversations, that access is governed by the workspace's configured policy and is always audited. Certain records are access-restricted by default: your in-product feedback reports are author-private (not visible even to owners or administrators), and per-member spend detail is visible only to owners and administrators, not to other members.
• Webel personnel access. Our operators cannot browse your Customer Content in the ordinary course. Cross-tenant administrative access requires an explicit, human-approved, time-boxed, audited "break-glass" grant — and even then, content fields are redacted for cross-tenant operator access (structure only).
• Legal, safety, and compliance. We may disclose information if we believe in good faith it is required by law or legal process, or necessary to protect the rights, safety, or property of Webel, our users, or the public. Unless legally prohibited, we will notify affected customers of legal demands for their data and, where possible, redirect the demand to the customer.
• Corporate transactions. If Webel is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy's commitments; we will notify you of any change in ownership or in the use of your personal information.
• De-identified and aggregated data. As described in Section 4.3.

7. Data retention and deletion

We keep personal information only as long as needed for the purposes above, and we design retention to be short by default and legible when it is long:

Notes on how deletion actually works:

• Deleting a conversation permanently deletes it for the workspace (subject to the backup and recovery-archive cycle described above, which applies to deleted conversations as well as deleted workspaces). Hiding a message removes it from display but not from the record; deleting requires deleting the conversation.
• Backups exist so your data survives our failures. Deleted data ages out of backups on the schedule above; backups are not used to resurrect deleted data except in disaster recovery, in which case we re-apply deletions.
• If you ask us to delete your account, we will delete or de-identify the personal information we hold about you, except what we must retain under the schedule above (for example, billing records) or applicable law; where we retain it, we retain the minimum, isolate it, and delete it when the retention period ends.

8. Security

We build security in rather than bolting it on. Measures include:

• Passwordless authentication: passkeys (WebAuthn) and one-time email links; there is no account password to steal. Sign-in tokens are stored only as cryptographic hashes; sessions are server-side, revocable, and visible to you.
• Encryption: TLS for data in transit over public networks, and between our services wherever supported; credentials and secrets you store with us are encrypted at rest with AES-256-GCM and are write-only by design.
• Tenant isolation: every read and write is evaluated against default-deny, fail-closed access policies scoped to your workspace, exercised continuously by adversarial cross-tenant tests. You can run and download a live access attestation ("Verify privacy") in-product.
• Least-privileged operations: no standing operator access to Customer Content; break-glass access is human-approved, time-boxed, audited, and content-redacted across tenants; privileged actions are logged append-only.
• Isolated execution: agent code execution happens in single-tenant micro-VM sandboxes that never store credentials at rest; repository access tokens are minted per-operation, scoped to a single repository, and revoked on teardown, and secrets you scope to a sandbox are injected only for the duration of a command.
• Vendor and supply-chain hygiene: keyless CI/CD (OIDC; no static cloud keys), signed webhook verification for every inbound integration, and blast-radius-isolated cloud accounts.
• Disclosure: we welcome good-faith security research and won't pursue researchers who report responsibly — see webel.ai/security. Report issues to hello@webel.ai.

We are building toward third-party security attestation (SOC 2) and will publish reports as they land. No system is perfectly secure; if we learn of a breach affecting your personal information, we will notify you and regulators as applicable law requires.

9. International use

The Services are operated from the United States, are currently offered to customers in the United States, and are hosted on U.S. infrastructure (primarily AWS us-west-2). If you access the Services from outside the U.S., your information is transferred to and processed in the United States, which may not provide the same level of data protection as your home jurisdiction. Organizations with international data-protection obligations can contact privacy@webel.ai about our DPA and transfer terms.

10. Your rights and choices

10.1 Controls built into the product

Regardless of where you live, you can: view and edit profile data; view and revoke sessions; manage passkeys; delete conversations; delete workspaces you own; revoke stored credentials and integrations; manage guest access; unsubscribe from non-essential email; and inspect, in-product, who can access a given conversation.

10.2 Rights under U.S. state privacy laws

If you live in California, Virginia, Colorado, Connecticut, Texas, or another U.S. state with a comprehensive privacy law, you have (subject to that law's conditions) the rights to: know/access the personal information we hold about you, including the categories collected, sources, purposes, and categories of recipients; correct inaccurate information; delete personal information; portability; and opt out of (i) the sale of personal information, (ii) sharing or processing of personal information for cross-context behavioral advertising or targeted advertising, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects — noting that we do not sell personal information, do not process it for cross-context behavioral or targeted advertising, and do not engage in such profiling, so there is nothing to opt out of. We will not discriminate against you for exercising your rights. We do not offer financial incentives or price or service differences in exchange for the collection, retention, sale, or sharing of personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.

As a matter of policy, we extend access, correction, and deletion requests to all of our users, whether or not your state's law requires it.

If we decline a request, you may appeal by replying to our decision; we will respond to appeals within 45 days for Colorado residents and within 60 days elsewhere, as your state's law requires, and if we deny your appeal you may contact your state attorney general.

Categories disclosure (California). In the preceding 12 months we collected the categories of personal information described in Section 2 (identifiers; customer-records information; commercial information; internet/electronic activity limited to the Services; professional information; visual information you upload; and inferences confined to your workspace's knowledge), from the sources in Section 2, for the purposes in Section 3, disclosed to the recipient categories in Section 6, and retained per Section 7. This includes the following categories of sensitive personal information: account log-in credentials and similar secrets you choose to store with us (Section 2.1); the contents of mail, email, or messages where we are not the intended recipient (for example, messages you exchange with teammates through the Services, or email content you sync from Google in Grow); and financial-account information from financial integrations you connect (Section 2.3). We collect and use these solely to provide the features you request; we do not use or disclose sensitive personal information for purposes that would require a right to limit under the CPRA, and we do not collect sensitive personal information for the purpose of inferring characteristics about you.

10.3 Exercising your rights

Email privacy@webel.ai from the address associated with your account (or describe your relationship to the Services if you don't have an account — for example, you signed a document or appear in a customer's records). We will verify your identity — usually by confirming control of your email address — and respond within 45 days, extendable as the law allows, in which case we will tell you. You may use an authorized agent where your law provides for one; we will verify the agent's authority. Exercising rights is free except where the law permits a fee for excessive requests.

If your request concerns Customer Content in an organization's workspace, we may refer the request to that organization (which is responsible for that content) and support them in responding.

11. Product-specific disclosures

11.1 Grow

• Cap tables and stakeholder records. Grow workspaces store personal data about shareholders, employees, investors, and advisors — entered by the workspace or imported from providers the workspace connects. The workspace is responsible for these records (see Section 1 for individual-owned workspaces); see Section 12 if you are one of these people.
• Electronic signatures. Public signing pages capture the signature, the signer's IP address, and timestamps, and compute a document hash, to create a reliable audit trail. Signing pages state this at the point of signature.
• Investor updates and data rooms. Senders can see engagement information about recipients and viewers (for example, email opens and per-document view activity in a data room). For engagement data about recipients of workspace-sent communications, the sending workspace is responsible and we act as its service provider; we separately use delivery and engagement records for our own deliverability and security purposes as described in Sections 2.2 and 3. Recipients are told this in the relevant surfaces, and tracked emails carry unsubscribe options where legally required.
• Connected accounts. Google (Gmail/Calendar/Drive — see the Limited Use commitment in Section 2.3), accounting and banking providers, cap-table providers, and document-storage providers are connected only by your choice and can be disconnected in settings; disconnecting stops new collection.

11.2 Webel AI and the Dragon platform

• Workspace collaboration. Conversations are private to their participants by default. If you are added to an existing conversation or room, you can read its prior history — the person adding you is told this at the time. Workspace-shared context is derived only from content shared within the workspace; members' private conversations are excluded from workspace-shared learning.
• Guests. A workspace member can grant an outside guest access to a specific conversation. Guests see that conversation and its participant list — nothing else in the workspace — and their access can be revoked at any time.
• Connected repositories. When you connect a repository, its contents are processed to do the work you ask for; commits, branches, pull requests, and review comments (including comments by outside reviewers on pull requests you ask us to watch) are ingested into your workspace; and work products — including work-in-progress snapshots — are pushed to your repository on your repository host.
• Bring your own keys. You may supply your own model-provider keys; calls made with your keys are governed by your provider agreement (see Section 4.2). Where you use Webel's platform keys, usage is metered as described in Section 2.2; pricing terms are described in your agreement.
• Building on Dragon. If your organization builds an application on the Dragon platform, your application's end-user data (including client diagnostic traces your app ships to Dragon) is your organization's data; Webel processes it as your service provider under the DPA, and your organization is responsible for its own end-user privacy notice.

11.3 Beacon

Beacon is open-source software. If you self-host Beacon, you are the operator and this policy does not apply to your deployment. If Webel hosts Beacon for you: we store your monitor configurations (endpoint names and targets), check results, and incident history. Your organization's status page is publicly readable by default — every non-paused monitor's name, state, uptime, and incident history appear on your organization's public status page without any sign-in — so do not use monitor names or targets you don't want public. Status pages set no cookies, run no analytics, and store no visitor identifiers; like any web page, serving them involves transient processing of visitor IP addresses by our infrastructure (see Section 2.2).

11.4 Our websites

webel.ai is a static site: no cookies, no analytics, no third-party embeds. Its one form — the waitlist — sends the email address you enter to the Webel AI application, where you verify it before any request is stored. Signing up for the waitlist stores your verified email, your optional note, the source surface and route the request came from (for example, our marketing site or the app), and the app version — visible to you and to our operators.

12. People who are not our customers

We process some personal data about people who don't have Webel accounts, for the following purposes:

• Invitees and guests: your email address, provided by the person inviting you, used to deliver and honor the invitation. Invitations and guest grants can be revoked by the workspace at any time, and we retain the invitation record only as long as needed to deliver, honor, and audit it.
• E-signature signers (Grow): identification details, signature, IP address, and timestamps, processed on behalf of the workspace that sent you the document, to execute and evidence the signature.
• Cap-table stakeholders and CRM contacts (Grow): records about shareholders, investors, employees, and fundraising contacts, processed on behalf of the workspace. Where the workspace is owned by an organization, that organization is responsible for these records — contact it to exercise rights over them; we support it in responding. For workspaces owned by an individual acting on their own behalf, Section 1 describes our role and you may contact us directly at privacy@webel.ai.
• Email recipients: if a workspace sends you email through the Services (an invitation, an investor update), we process your address for delivery and, for non-transactional mail, honor unsubscribe. For non-transactional mail such as investor updates, we record delivery, open, and click events and make them available to the workspace that sent the email.
• Data-room viewers and update recipients (Grow): if you view documents shared with you in a data room, we record per-document view activity and make it available to the workspace that shared the materials. We process this engagement information on that workspace's behalf as its service provider; the workspace is responsible for it, and you can direct rights requests to it (we will support the response).
• Public code reviewers: if you comment publicly on a pull request a workspace asked us to watch, your public username and comment are ingested into that workspace so it can respond to your review.

Where we process this data as a service provider, the workspace is responsible for it. Where no workspace relationship exists (for example, waitlist signups), this policy applies directly and you can contact us at privacy@webel.ai.

13. Children

The Services are not directed to children. You must be at least 18 years old (or the age of majority where you live) to create an account. We do not knowingly collect personal information directly from children under 16 as users of the Services; if you believe a child has created an account or provided us personal information directly, contact privacy@webel.ai and we will delete it. Workspace records may reference minors (for example, custodial shareholders on a cap table); those records are controlled by the workspace and are processed on its behalf as described in Section 12.

14. Changes to this policy

We will post any changes to this policy at this location and update the "Last updated" date. For material changes, we will give you reasonable advance notice — by email or in-product — before the changes take effect. Archived versions are available on request.

15. Contact us

Webel, Inc. 1522 Western Ave STE 95923 Seattle, WA 98101 Privacy requests and questions: privacy@webel.ai General contact: hello@webel.ai