Privacy Policy

This notice describes the personal data WebSeed processes in providing the service, the purposes and legal bases of processing, retention periods, and the rights of users concerning their data. WebSeed is a shared sitemap planning tool for teams: a user's projects are sitemaps of websites, with pages, blocks, notes and connections. The notice uses plain language; each section defines the terms used in it. The Provider receives questions about this notice at the address given in “Contact”.

1. Controller details

The WebSeed platform is operated by Galcsik Győző Korlátolt Felelősségű Társaság (registered seat: 1063 Budapest, Szív utca 16. I. em. 17. ajtó, Hungary; company registration number: 01-09-389812; tax number: 27431913-2-42; represented by: Galcsik Győző, managing director; email: [email protected]) (the “Provider”). The Provider is the controller of the personal data described in this notice.

The Provider has not appointed a data protection officer because Article 37 GDPR does not require one. Privacy questions may be sent to the email address above and are handled by the managing director.

In this notice, the user is the natural person using the platform. Where the user acts for an organisation, that organisation is called the user's organisation. A sitemap is the document the user's team edits in a project: pages, subpages, blocks, notes and the connections drawn between them.

2. Applicable laws and principles

The Provider processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR) and 2011. évi CXII. törvény on the Right of Informational Self-Determination and Freedom of Information (Infotv.). This notice provides the information required by Articles 13 and 14 GDPR. The Provider follows these principles when processing data:

• Lawfulness, fairness and transparency: the Provider processes data lawfully, fairly and in a way that is transparent to the data subject.
• Purpose limitation: the Provider collects data only for specified, explicit and legitimate purposes, and does not process it in a way incompatible with those purposes.
• Data minimisation: the Provider processes only data that is necessary and relevant to the purpose of the processing.
• Accuracy: the Provider corrects or erases inaccurate data without delay.
• Storage limitation: the Provider keeps data only for as long as necessary to achieve the purpose.
• Integrity and confidentiality: the Provider protects data through appropriate technical and organisational measures.
• Accountability: the Provider can demonstrate compliance with these principles.

3. Controller and processor roles

The Provider acts as a controller or processor as described below. The distinction determines against whom the user may exercise rights.

The Provider is the controller of data about people who hold WebSeed accounts, including their names, email addresses, credentials, preferences, notifications and service usage data. This notice applies to that data.

The Provider is a processor for content created in WebSeed, including sitemaps (pages, blocks, notes, connections), version history, comments and an uploaded team logo. The user's organisation is the controller of this content. The Provider processes it only on that organisation's instructions under the “Data processing terms (GDPR Article 28)” section of the Terms & Conditions. This notice is not a contract: the Provider's data processing commitments are in the Terms & Conditions, which the user accepts when creating an account.

If the user uses WebSeed on the user's own behalf rather than for an organisation, the user is the controller of that content. In that case, the data processing terms in the Terms & Conditions apply directly between the user and the Provider.

If the user is an employee or client of an organisation that uses WebSeed and wants content removed, the user must contact that organisation. The organisation decides what happens to the content. The Provider helps it carry out that decision, but does not override its decision about its own data.

4. Data processed, purposes, legal bases and retention periods

To create an account, providing the user's name, email address and password, or a Google or Microsoft account instead of a password, is a condition of entering into the contract; an account cannot be created without them. Providing all other data is the user's choice. One category of data does not originate from the user: a WebSeed account is created only by invitation, so the Provider receives the user's email address from the inviter before the user has any relationship with the Provider. The Provider uses it only to deliver and manage that invitation, on the basis of the Provider's legitimate interest in letting teams invite the colleagues and clients they work with (GDPR Art. 6(1)(f)). An invitation expires after the period the inviting team chooses (1, 7 or 30 days) or does not expire, and an expired link cannot be used. A team may also create a single-use invite link that contains no email address: it stops working once it has been used, and the person who accepts it provides their own email address, which the Provider records on the invitation. The inviting team may revoke an invitation at any time, and the Provider deletes it when the team is deleted. This paragraph is the notice required by GDPR Article 14. If the invitee requests this at the address given in “Contact”, the Provider deletes the invitation and the email address in it and stops this processing.

In comments the user can mention teammates: a mention carries the mentioned person's user identifier, and the mentioned person is notified. A notification is also sent for a reply to the user's comment and for a new comment by a person in the client role. The notification appears in the app and, unless the user has switched it off in the profile, by email as well: unread notifications are grouped after a short wait into a digest email that contains the project name, the acting person's name and a short excerpt of the comment. Before sending a digest, the system re-checks that the recipient still has access to the project. Mentions and notifications use no additional cookie or browser storage entry.

Sitemaps and comments can contain other people's personal data. If the user writes a customer's details, a name or an email address into a note, a page description or a comment, that data is stored in WebSeed, and in a sitemap shared with a share link it is visible to anyone who receives the link. The user's organisation is the controller for it and is responsible for having a lawful basis to record it. Recording more personal data than necessary should be avoided.

5. Live collaboration, share links and version history

Team members can edit a sitemap at the same time. For this the Provider runs a separate collaboration service (at live.webseed.app) that coordinates edits in one “room” per project and saves them regularly to the Provider's database. The user connects to the room with a short-lived, signed access token that the application issues based on the user's permissions; the token carries the user's identifier, name, avatar and role (editor or viewer) and expires after 10 minutes. If the user's team membership ends or is narrowed, the Provider closes the user's open connections.

• Presence. While the user has a sitemap open, the other signed-in participants of the project see the user's name, avatar, cursor, selection, which element the user is editing or moving, and whether the user is following someone's view. The cursor and selection of a read-only viewer are visible too. The dashboard shows on project cards who is working on a sitemap right now. This data is not stored permanently: it lives in the memory of the collaboration service and in the browsers of connected users, and ends when the connection closes.
• Offline editing. An editor's browser keeps a copy of the sitemap in the browser's IndexedDB storage, so that changes made while the internet connection is down are synchronised when it returns. This copy exists only on the user's device; signing out does not remove it, clearing the browser's storage does.
• Share link. A user with edit rights can create a public, read-only link to the sitemap, with or without an expiry, and can revoke it at any time. Anyone who receives the link can view the project name and the sitemap without an account, including notes but not comments, and, if live collaboration is on for the team, follows changes live. The shared page cannot be indexed by search engines and does not pass the link on to other websites. The Provider processes no name or account data about people who open a link; they receive a random, temporary guest identifier that is not stored. A guest does not see the names, avatars or cursors of team members, only how many people are editing; the team likewise sees a guest only as an anonymous count.
• Version history. The Provider saves earlier states of the sitemap: automatically, at most every 10 minutes, and whenever the user saves manually or restores. A snapshot records who made it and with which label. The number of snapshots kept depends on the team's plan; beyond the limit, the oldest snapshot is deleted. A restore makes an earlier state current and first takes a snapshot of the current state.

The user decides whether to issue a share link and to whom; the Provider does not know who received it. If the sitemap contains personal data, the user's organisation is responsible for the lawfulness of passing the link on. After the link is revoked, the shared page cannot be opened.

6. Processing activities not carried out

The Provider does not carry out the following processing activities:

• No third-party analytics. There is no Google Analytics, no Plausible, no PostHog, no Mixpanel, no Segment, no Hotjar.
• No advertising or marketing trackers, and no advertising cookies.
• No third-party error-reporting or session-replay service.
• No profiling, and no automated decision-making that produces legal effects under Article 22 GDPR.
• The Provider does not sell personal data, and does not share it for anyone else's marketing.
• The Provider does not use the user's content to train machine-learning models, and does not pass it to any provider of artificial intelligence. AI agents that the user connects to WebSeed with an API key are the user's own tools: the Provider only serves their requests.

7. Cookies and browser storage

The Provider stores data on the user's device only where it is strictly necessary for the service to work: cookies for sign-in and its security, a local copy and clipboard of the user's own sitemap work, and interface settings that the user has expressly chosen. These fall within the exception under 2003. évi C. törvény 155. § (4) on electronic communications and Directive 2002/58/EC Article 5(3), because they are essential to provide a service expressly requested by the user or remember the user's own choice; neither requires consent. The Provider does not use analytics, tracking or advertising cookies at all. The cookie banner therefore provides information rather than requesting consent: it has a single acknowledgement button and no optional categories, because the Provider stores nothing the user could decline while continuing to use the service.

The table below lists cookies set on webseed.app and the application's localStorage and IndexedDB entries. The Provider writes browser entries only when the user performs the relevant action or changes the relevant setting; none are sent to the Provider's servers. Entries with the remarque- prefix, from the service's earlier name, are renamed once by the application, which then removes the old name. The collaboration service (live.webseed.app) sets no cookies.

For a person opening the public shared page (webseed.app/s/…), the Provider stores, of the cookies above, only the acknowledgement of the cookie notice and the light or dark mode choice, if that person sets them. The Payload administration interface is used only by the Provider's administrators; its entries do not affect the user.

8. Recipients and international transfers

To operate the service, the Provider currently engages three sub-processors: Railway Corp. (United States) hosts the application and database on servers in the European Union; Cloudflare, Inc. (United States) provides DNS, CDN and DDoS protection, stores uploaded files in the European Union and runs the live collaboration service in data centres placed under the jurisdiction of the European Union; and Resend (Plus Five Five, Inc., United States) delivers invitation, password reset and notification emails. No provider processes personal data on the Provider's behalf without a data processing agreement under GDPR Article 28, and not every provider processes data for every account. Google Workspace (Google Ireland Ltd, Ireland) hosts the Provider's own legal, privacy and customer support correspondence, including the [email protected] mailbox; in that capacity, Google is the processor of the Provider as controller and has no access to content created in the service. The providers' roles, locations and transfer safeguards are listed individually in the “Annex: sub-processors” section of the Terms & Conditions. That annex also lists providers announced in advance but not currently engaged; they receive no personal data until activated, and activation is preceded by an email notice to account holders under “Data processing terms (GDPR Article 28)” in the Terms & Conditions, with a right to object.

Sub-processors process personal data only on the Provider's instructions. They do not decide independently how to use it, and the Provider is responsible for their activities. Apart from them, the Provider does not disclose personal data to third parties unless required by law. Even when a court, public prosecutor, investigating authority or other authority requests data, the Provider discloses only what is strictly necessary for the purpose of the request.

Service data is stored primarily on servers in the European Union. The providers engaged are established in the United States or belong to a group established there, and access from there counts as a transfer even when the servers are in the EU. For certified providers, transfers rely on the European Commission's adequacy decision under the EU-US Data Privacy Framework. Otherwise they rely on the European Commission's Standard Contractual Clauses, together with the supplementary measures those clauses require. The annex referenced above identifies the safeguard that applies to each provider. The Provider will send a copy of the applicable terms on request.

Recipients the user chooses are not the Provider's sub-processors. If the user hands a share link to someone, exports a sitemap and forwards it, or connects an AI agent or script to WebSeed with an API key, the data goes to a recipient of the user's choice, by the user's decision. Exports are produced in the user's browser and do not touch the Provider's servers. An agent or script connecting with an API key uses the provider the user chose (for example a company operating an artificial intelligence); the user has its own agreement with that provider and is responsible for the lawfulness of the data that reaches it. Google and Microsoft, as sign-in providers, are independent controllers.

9. Data security

In accordance with Article 32 GDPR, the Provider applies technical and organisational measures proportionate to the risks. Only authorised persons bound by confidentiality may access personal data. In particular:

• All traffic is served over HTTPS, and over encrypted WebSocket connections to the collaboration service.
• Passwords are stored only as salted hashes. The Provider limits the number of failed sign-in attempts and temporarily locks the account when they are exceeded.
• The tokens of share links and invitations are stored only as hashes; the raw token is not in the database. The shared page does not pass the link on to other websites and cannot be indexed by search engines.
• Only a signed access token valid for 10 minutes opens a connection to a live collaboration room; the room enforces the role carried in the token, rejects changes from a read-only viewer, and closes open connections when a membership ends.
• The service is multi-tenant by team: every read and write is scoped to the teams and projects the user has been given access to, enforced in the database access layer rather than only in the interface.
• The Provider checks the type and size of uploaded files on the server and does not accept SVG files. Files are stored under random names and served only after an access check.
• Access to production systems is limited to the managing director.

No system is perfectly secure. If the Provider becomes aware of a personal data breach that is likely to result in a risk to the rights of data subjects, the Provider will notify the supervisory authority within 72 hours and inform affected customers without undue delay, and in any event no later than 72 hours after becoming aware of it.

10. Keeping and deleting data

Retention periods for each category are in the table in “Data processed, purposes, legal bases and retention periods”. In addition:

• Archiving a project keeps its content and only removes it from the active list. Permanently deleting a project deletes the sitemap, the version history, the comments and read marks, and the project's share links; the Provider closes open collaboration connections.
• When a comment is deleted, its text is removed at once; deleting the last comment of a thread removes the thread too.
• For as long as the account is open, the user can export the sitemap at any time from the browser: as JSON, CSV, PNG, SVG and PDF, and as a build brief for developers in JSON and Markdown. The available formats depend on the team's plan; the JSON export is always available.
• The user may request closure of the account at the address given in “Contact”. The user can ask the Provider to export the data for 15 days after closure. The Provider deletes the data within 30 days of closure, except records the Provider must keep to satisfy accounting and tax obligations under 2000. évi C. törvény 169. § (the Hungarian Accounting Act), which the Provider retains for 8 years, and the record of acceptance of the terms, which the Provider retains until the end of the general civil limitation period, namely a further 5 years. Comments written by the user remain as the team's content without an author, because the team's conversations cannot be left incomplete by the user's departure; the user's organisation decides about them as controller.

11. User rights and remedies

Under Chapter III of the GDPR the user has the right to:

• Access the user's personal data: learn whether the Provider processes it, and if so under what conditions, and obtain a copy (Art. 15);
• Have inaccurate data corrected and incomplete data completed (Art. 16);
• Have the user's data erased (the “right to be forgotten”) where the conditions of Art. 17 are met;
• Request restriction of processing (Art. 18), in particular if the user contests the accuracy of the data, the processing is unlawful but the user opposes erasure, or the user has objected to the processing;
• Receive data processed by automated means on the basis of consent or a contract in a structured, commonly used, machine-readable format, and transmit it to another controller (Art. 20);
• Object to processing based on the Provider's legitimate interest (Art. 21);
• Withdraw consent at any time where processing was based on it. Withdrawal does not affect the lawfulness of processing carried out before it (Art. 7(3)).

To exercise these rights, the user may write to [email protected]. The Provider will fulfil or answer the user's request without undue delay and no later than one month after receiving it. For complex or multiple requests, the Provider may extend that period by up to two further months under Art. 12(3) GDPR; the Provider will tell the user within the first month and explain why. The Provider informs every recipient to whom the Provider disclosed the data of any correction, erasure or restriction of processing, unless this proves impossible or requires disproportionate effort (Art. 19).

If a person's data appears in content created by a customer, such as a note or page description in a sitemap or a comment, the Provider processes it as a processor on the customer's behalf. The controller is the organisation whose team created the content, and the data subject should submit the request to that organisation. If the data subject cannot identify the organisation, the data subject may write to [email protected]. Where possible, the Provider forwards the request to the customer. The Provider does not decide the request independently and assists with the response on the customer's instructions.

The user may submit a complaint directly to the Provider; the Provider investigates it and informs the user of the outcome. The user may also complain to the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), registered seat: 1055 Budapest, Falk Miksa utca 9-11., Hungary; postal address: 1363 Budapest, Pf. 9.; telephone: +36 (1) 391-1400; [email protected], naih.hu. If the user lives in another EU country, the user may also contact the authority there.

Independently of a complaint to an authority, the user may also go to court. In Hungary, data protection cases fall within the jurisdiction of the törvényszék (regional court); at the user's choice, the user may also bring proceedings before the court for the user's own domicile or place of residence.

If a breach of data protection rules causes the user financial or non-financial damage, the user is entitled to compensation from the controller or processor for that damage. If the user's personality rights are infringed, the user is entitled to compensation for non-material harm under Polgári Törvénykönyv 2:52. §. A processor is liable only if it has failed to comply with obligations specifically directed to processors or has acted contrary to the controller's lawful instructions.

12. Minors' data

WebSeed is intended for professional teams, not children. The Provider does not knowingly collect personal data from people under 16. If a report sent to the address in “Contact”, or other information, shows that a child has provided the Provider with personal data, the Provider deletes it.

13. Amendment of this notice

The Provider may update this notice. If a change materially affects the users' rights, the Provider will tell account holders by email at least 30 days before it takes effect. The date at the top of the page always reflects the current version.

14. Contact

Questions about this notice or the user's data may be sent to [email protected], or by post to the Provider at the registered seat given in “Controller details”.