Privacy Policy

1. Data controller

WebLingo is provided by Bredis SAS. You can reach us at:

• 44 Rue Victor Hugo, 29200 Brest, France
• contact@weblingo.app

2. Data we collect

We only collect the information required to operate, secure, improve, and bill the service:

• Email address for account access, billing notifications, and preview links you request.
• Name, email address, and message details submitted through the contact form or the waitlist.
• Website URLs and language selections submitted to perform translation and localization.
• Payment data processed by Stripe (never stored by WebLingo).
• Product analytics identifiers and metadata, including internal user and account IDs, plan/status, workspace audience, event names, device/session metadata, and privacy-protected replay events.
• Technical data required to secure the service, such as IP addresses used for rate limiting and, for waitlist signups, the browser user agent and referring page.

3. Analytics

WebLingo uses PostHog EU Cloud for privacy-limited product analytics, error and reliability signals, and optional masked session replay. Explicit events may include sanitized campaign fields, the referring hostname, and whether an advertising click identifier was present; raw click identifiers, full referring URLs, query strings, and payment card data are not sent to PostHog. PostHog requests are routed through the WebLingo-controlled metrics.weblingo.app endpoint using Cloudflare.

With your consent, WebLingo may keep a pseudonymous PostHog identifier in a first-party cookie for up to 90 days so visits and conversions can be connected. WebLingo also loads a WebLingo-specific Google Tag Manager container and Google Analytics 4 property. Google tags remain blocked before consent. Advertising storage, advertising user data, and ad personalization remain disabled; no advertising campaign is activated by this preference. Organic search queries are obtained from aggregated, privacy-filtered Google Search Console reports rather than individual browser sessions.

Before consent, PostHog identity remains in page memory only. PostHog browser capture stays configured without autocapture, automatic pageview/pageleave capture, heatmaps, console logs, performance capture, or network request payloads. Known bot user agents remain blocked from human analytics. Optional replay is sampled, masks all inputs and page text, disables canvas recording, and drops captured network requests. You can change or withdraw measurement and replay choices below; withdrawal clears the PostHog identifier.

4. Data storage & processors

WebLingo relies on the following processors to operate the service, each bound by a data processing agreement:

• Vercel Inc. (USA) — website hosting and serverless infrastructure.
• Cloudflare Inc. (global) — content delivery, security, Turnstile bot protection, and restricted aggregate analytics storage.
• Supabase — account authentication and database, including contact and waitlist submissions (hosted in Singapore).
• Upstash — short-lived rate-limiting counters derived from IP addresses.
• PostHog EU Cloud (EU) — product analytics and privacy-protected session replay.
• Google — consented website analytics and aggregated Search Console performance reports.
• Stripe — payment processing.
• Resend — transactional email such as preview access links.

5. International transfers

Some of the processors listed above store data outside the European Economic Area, including in the United States and Singapore. These transfers are covered by the European Commission's Standard Contractual Clauses and by the processors' data processing agreements. You can request a copy of the applicable safeguards at contact@weblingo.app.

6. Data stored in your browser

The Try-Now preview flow stores your preview requests in your browser's local storage, including the submitted page URL, the selected languages, the email you optionally attach, and the access tokens used to reopen your preview. This data stays on your device, is never used for advertising, and can be removed at any time by clearing your browser's site data. Measurement and session-replay consent choices are also stored locally. Sanitized first-touch campaign attribution may be kept in session storage until the browser session ends. If you allow optional measurement, a first-party PostHog cookie keeps a pseudonymous identifier for up to 90 days and is cleared when you withdraw consent.

7. Your rights (GDPR)

Under the GDPR you have the right to access, rectify, and erase your personal data, to restrict or object to its processing, to data portability, and to withdraw consent at any time (including persistent measurement and session replay, via the controls below). To exercise these rights, email contact@weblingo.app. You also have the right to lodge a complaint with the French supervisory authority, the CNIL (www.cnil.fr), or with your local supervisory authority.

8. Legal basis

Processing is based on contract performance for registered users and preview requests, on WebLingo's legitimate interest in securing the service and producing privacy-limited product analytics, and on your consent for persistent measurement, Google Analytics, and session replay, which you can withdraw at any time.

9. Data retention

We retain account data while your account remains active or as required by applicable law. Contact-form messages and waitlist signups are deleted no later than 24 months after our last exchange with you. PostHog product events are retained for 12 months, session replays for 30 days, consented PostHog identifiers for up to 90 days in the browser, and restricted aggregate acquisition reports for up to 400 days.

10. Updates

We may update this Privacy Policy at any time. The latest version is always available at https://weblingo.app/legal/privacy.