Privacy Policy
This policy describes the Service's actual data flows.
1. Controller
WESPEAKCODE LLC, 2810 N Church St - 679359, Wilmington, DE 19802, United States. Contact: hello@unlimiteduser.com. Further details in the legal notice.
2. Principles
UnlimitedUser is a tool for automated website testing: AI personas open a target URL you provide in a browser and produce a report. We process personal data only to the extent required to provide the Service.
3. What Data We Process
- Account data: name and email address for registration and sign-in.
- Waitlist data: if you join the waitlist on the home page, we store your email address and, if voluntarily provided, your name in order to notify you when a spot opens. Joining the waitlist does not create an account. You confirm the entry by email and can delete it at any time through the link in that email or via the contact named in section 9. Unconfirmed entries are deleted after 30 days, rejected or invited entries after 90 days, and confirmed entries after no more than 12 months.
- Usage / run data: the target URLs you enter, test configurations, generated reports and screenshots of the tested pages.
- Aggregated benchmark statistics: the overall scores of runs are aggregated nightly into anonymized benchmark statistics across workspaces (mean, median, percentiles). A statistic is only produced when at least 50 workspaces contribute (k-anonymity) and contains no workspace IDs, URLs or individual values.
- Log / audit data: security-relevant events and the IP address (for abuse prevention and rate limiting).
- Payment data: paid features are billed through our payment service provider; we do not store card data.
Public links: A report can be accessed via a share link without signing in — anyone who knows the link can see the findings and screenshots it contains. Share links can be revoked at any time. The free quick check (/scan.html, German-language page) also produces a result that can be accessed via its link without signing in; these results are stored in our EU database (Supabase), keyed by a hash of the link ID, and discarded after seven days at the latest.
4. Purposes and Legal Bases
Processing takes place to perform the contract of use and to respond to requests (e.g. waitlist sign-ups) (Art. 6(1)(b) GDPR), to safeguard our legitimate interest in secure, abuse-free operation (Art. 6(1)(f) GDPR) and to comply with legal obligations (Art. 6(1)(c) GDPR).
5. Processors & Hosting
We use carefully selected service providers with whom data processing agreements are in place:
- Application hosting: Fly.io — servers operated in the EU region.
- Database & file storage: Supabase — runs, reports and screenshots are stored on infrastructure in the EU.
- Email delivery: Resend — transactional email (e.g. invitations, password resets).
- Payment processing: Stripe — only when paid features are used.
- AI language models: OpenRouter — so that the AI personas can assess the tested site and write the report, truncated text content of the tested pages and screenshots are transmitted to the language model at each step of a run. Depending on the model provider, processing takes place outside the EU (third-country transfer, including the USA). Credentials such as test account passwords are not transmitted.
- Real-user performance data: Google (Chrome UX Report API) — when a run is performed, the address (origin) of the tested site is sent to Google to retrieve publicly available field data. No personal data of our users is transmitted. Google may process the request outside the EU (third-country transfer, including the USA).
- Residential proxy (fallback): ScrapeOps — only if the tested site blocks our automated browser (bot protection), the browser traffic of that run to the tested site is routed through this proxy provider. The proxy forwards the requests of that run to the tested site. The provider may be located outside the EU (third-country transfer, including the USA). For HTTPS sites the connection is passed through the proxy as an encrypted tunnel; for sites reachable only via unencrypted HTTP the proxy provider could technically see the content of the traffic.
- Search ranking check: DataForSEO — only when the paid ranking add-on is used, the keywords entered for that check and the tested domain are sent to retrieve Google search positions. The provider may process this data outside the EU (third-country transfer, including the USA).
The fonts used on our pages are served locally from our own servers — visiting our pages does not establish a connection to third-party font providers such as Google Fonts.
6. Cookies & Tracking
We use only technically necessary storage mechanisms (e.g. for the sign-in session). We set no advertising or analytics cookies and do not embed external tracking services for advertising purposes.
7. Retention
We store personal data only as long as required for the stated purposes or as statutory retention periods demand. A run's report files and screenshots are automatically removed after 90 days, except for a run you have marked as a target's baseline, which is kept until you unpin it or delete the workspace; the run's metrics (e.g. the overall score) are retained for history comparisons. Personal data in security-relevant log entries is removed after 90 days. Deleting your account removes your account and personal data; it does not delete a workspace. If you are the sole owner of a workspace, account deletion is blocked until you transfer ownership or delete that workspace first. Deleting a workspace is a separate action and removes the workspace together with all data and artifacts it contains (reports, screenshots, test accounts).
8. Your Rights
You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). In your account settings you can export your data yourself and delete your account. You also have the right to lodge a complaint with a data protection supervisory authority.
9. Contact for Privacy Questions
For privacy questions, contact us at hello@unlimiteduser.com.