Privacy Policy

1. Introduction

Web Agent Bridge ("WAB", "we", "us", "our") is an open-source middleware platform operated from the Netherlands. We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR — EU 2016/679) and the Dutch Implementation Act (Uitvoeringswet AVG / UAVG).

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website (webagentbridge.com), our services, and our open-source software.

2. Data Controller

The data controller responsible for your personal data is:

3. What Data We Collect

3.1 Account Data

When you register for an account, we collect:

• Name — to personalize your account
• Email address — for authentication and communication
• Password — stored as a bcrypt hash (we never store plain-text passwords)
• Company name (optional) — for billing purposes

3.2 Site & License Data

When you add a site to WAB, we collect:

• Domain name and site name
• Configuration preferences (permissions, restrictions)
• Generated license keys (unique identifiers)
• Subscription tier information

3.3 Analytics Data

When the WAB bridge script is active on your website, we collect anonymous interaction data:

• Action names triggered by AI agents (e.g., "click-signup")
• Agent identifiers (if provided by the agent)
• Trigger type (click, fill, scroll, etc.)
• Success/failure status
• Timestamps

We do not collect personal data from your website's end users. Analytics are about AI agent behavior only.

3.4 Payment Data

Payment processing is handled by Stripe, Inc. We do not store your credit card details. Stripe processes payments in accordance with PCI DSS standards. See Stripe's Privacy Policy.

3.5 Technical Data

Our server automatically collects:

• IP address (used for rate limiting and security only, not stored long-term)
• HTTP request logs (retained for 30 days for security monitoring)

4. Legal Basis for Processing (GDPR Art. 6)

Purpose	Legal Basis
Account creation & service delivery	Contract performance (Art. 6(1)(b))
Payment processing	Contract performance (Art. 6(1)(b))
Security & abuse prevention	Legitimate interest (Art. 6(1)(f))
Analytics (AI agent behavior)	Legitimate interest (Art. 6(1)(f))
Cookies (non-essential)	Consent (Art. 6(1)(a))
Legal obligations (Dutch tax law)	Legal obligation (Art. 6(1)(c))

5. Data Sharing & Transfers

We share personal data only with:

• Stripe, Inc. (USA) — Payment processing, with EU Standard Contractual Clauses (SCCs)
• Server hosting provider — Infrastructure only, no access to application data

We do not sell, rent, or trade your personal data to third parties.

Where data is transferred outside the EEA, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions per GDPR Art. 46).

6. Data Retention

Data Type	Retention Period
Account data	Until account deletion + 30 days
Analytics data	90 days (auto-purged)
Payment records	7 years (Dutch fiscal obligation — Belastingdienst)
Server logs	30 days

7. Your Rights (GDPR Art. 15–22)

As an EU/EEA resident, you have the right to:

• Access — Request a copy of your personal data
• Rectification — Correct inaccurate data
• Erasure ("Right to be forgotten") — Request deletion of your data
• Restriction — Restrict processing of your data
• Data portability — Receive your data in a structured, machine-readable format
• Object — Object to processing based on legitimate interest
• Withdraw consent — At any time, without affecting prior processing

To exercise any of these rights, contact us at privacy@webagentbridge.com. We will respond within 30 days as required by GDPR.

8. Cookies

We use minimal cookies. For full details, see our Cookie Policy.

• Essential cookies — Authentication session (JWT token) — no consent required
• No tracking cookies — We do not use Google Analytics, Facebook Pixel, or similar trackers

9. Open Source & Self-Hosting

WAB is open-source software licensed under the MIT License. If you self-host WAB, you become the data controller for any personal data processed by your instance. This privacy policy applies only to the hosted service at webagentbridge.com.

10. Children's Data

WAB is not directed at children under 16 years of age (per Dutch UAVG Art. 5). We do not knowingly collect personal data from children. If we learn we have collected data from a child, we will delete it promptly.

11. Security Measures

We implement appropriate technical and organizational measures including:

• TLS/SSL encryption for all connections
• Bcrypt password hashing
• Domain-locked session tokens
• Rate limiting and abuse detection
• Regular security updates

12. Supervisory Authority

If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. For significant changes, we will notify registered users via email.

14. Contact

For privacy-related questions or to exercise your data rights:
Email: privacy@webagentbridge.com