Privacy Policy
This policy describes the Service's actual data flows.
1. Controller
WESPEAKCODE LLC, 2810 N Church St - 679359, Wilmington, DE 19802, United States. Contact: hello@unlimiteduser.app. Further details in the legal notice.
2. Principles
UnlimitedUser is a tool for automated website testing: AI personas open a target URL you provide in a browser and produce a report. We process personal data only to the extent required to provide the Service.
3. What Data We Process
- Account data: name and email address for registration and sign-in.
- Waitlist data: if you join the waitlist on the home page, we store your name and email address in order to notify you when a spot opens. Joining the waitlist does not create an account. You can have your waitlist entry deleted at any time via the contact named in section 9.
- Usage / run data: the target URLs you enter, test configurations, generated reports and screenshots of the tested pages.
- Aggregated benchmark statistics: the overall scores of runs are aggregated nightly into anonymized benchmark statistics across workspaces (mean, median, percentiles). A statistic is only produced when at least 50 workspaces contribute (k-anonymity) and contains no workspace IDs, URLs or individual values.
- Log / audit data: security-relevant events and the IP address (for abuse prevention and rate limiting).
- Payment data: paid features are billed through our payment service provider; we do not store card data.
Public links: A report can be accessed via a share link without signing in — anyone who knows the link can see the findings and screenshots it contains. Share links can be revoked at any time. The free quick check on the home page also produces a result that can be accessed via its link without signing in; these results are held in memory only and discarded after seven days at the latest.
4. Purposes and Legal Bases
Processing takes place to perform the contract of use and to respond to requests (e.g. waitlist sign-ups) (Art. 6(1)(b) GDPR), to safeguard our legitimate interest in secure, abuse-free operation (Art. 6(1)(f) GDPR) and to comply with legal obligations (Art. 6(1)(c) GDPR).
5. Processors & Hosting
We use carefully selected service providers with whom data processing agreements are in place:
- Application hosting: Fly.io — servers operated in the EU region.
- Database & file storage: Supabase — runs, reports and screenshots are stored on infrastructure in the EU.
- Email delivery: Resend — transactional email (e.g. invitations, password resets).
- Payment processing: Stripe — only when paid features are used.
- AI language models: OpenRouter — so that the AI personas can assess the tested site and write the report, truncated text content of the tested pages and screenshots are transmitted to the language model at each step of a run. Depending on the model provider, processing takes place outside the EU (third-country transfer, including the USA). Credentials such as test account passwords are not transmitted.
The fonts used on our pages are served locally from our own servers — visiting our pages does not establish a connection to third-party font providers such as Google Fonts.
6. Cookies & Tracking
We use only technically necessary storage mechanisms (e.g. for the sign-in session). We set no advertising or analytics cookies and do not embed external tracking services for advertising purposes.
7. Retention
We store personal data only as long as required for the stated purposes or as statutory retention periods demand. A run's report files and screenshots are automatically removed after 90 days; the run's metrics (e.g. the overall score) are retained for history comparisons. Personal data in security-relevant log entries is removed after 90 days. Deleting your account removes your account and personal data; it does not delete a workspace. If you are the sole owner of a workspace, account deletion is blocked until you transfer ownership or delete that workspace first. Deleting a workspace is a separate action and removes the workspace together with all data and artifacts it contains (reports, screenshots, test accounts).
8. Your Rights
You have the rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21). In your account settings you can export your data yourself and delete your account. You also have the right to lodge a complaint with a data protection supervisory authority.
9. Contact for Privacy Questions
For privacy questions, contact us at hello@unlimiteduser.app.