Legal · updated 2026-10-03
Privacy Policy
Last updated: October 3, 2026
1 Who we are
In plain terms: zitaso is a product of Web Wombats LLC, which is responsible for your data.
zitaso (“zitaso”, “we”, “us”) is a software service for measuring brand visibility in search engines and AI assistants, operated by Web Wombats LLC, a company established in the United States. Web Wombats LLC is the data controller for zitaso.com and all subdomains. For any privacy matter, contact analytics@webwombats.com.
2 Visiting zitaso.com
In plain terms: no tracking, no analytics, no ad pixels.
- We do not use analytics, advertising or tracking cookies on zitaso.com.
- Fonts and assets are self-hosted; your IP address is not disclosed to font or CDN providers for loading a page.
- Our hosting provider, Cloudflare, Inc., processes technical connection data (such as IP address, requested URL, user agent and time) in short-lived logs as technically necessary to deliver the site and protect it against abuse (Art. 6(1)(f) GDPR).
3 Your account and login
In plain terms: we only know what we need to let you in.
- Accounts exist only by invitation. We store your email address, your name (if provided), your role and which workspace(s) you can access.
- Sign in with Google: If you choose “Continue with Google”, Google confirms your email address and shares your Google account identifier with us. We use this only to verify your identity and sign you in.
- Email sign-in link: If you choose to sign in by email, we send a one-time link via our email provider Resend, Inc. (processor). The link expires after 15 minutes; we store only a cryptographic hash of it.
- Session cookie: After sign-in we set one strictly necessary cookie for zitaso.com and its subdomains to keep you signed in. It expires after 14 days. It is not used for tracking.
- Security: To prevent abuse we count failed sign-in attempts per IP address and per email address. These counters are deleted after about one day.
- Legal bases: Art. 6(1)(b) GDPR (providing the service you or your company contracted) and Art. 6(1)(f) (security of the service).
Google user data: zitaso’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request only your email address. We do not use Google user data for advertising, do not sell it and do not use it to train AI models.
3a Access requests
In plain terms: if you ask for access, we use your details only to answer you.
zitaso accounts are not open for self-registration. If you request access, we process your name, business email, company, website, markets and your message to review your request and contact you (Art. 6(1)(b) GDPR, steps prior to a contract). To block spam, the form uses Cloudflare Turnstile, which processes technical data about your browser. Requests that do not lead to a customer relationship are deleted within 12 months.
4 Data in your workspace
In plain terms: your project data is used to run your measurements – nothing else.
To provide the service we process the data you or your administrator enter: brand names, domains, competitors, keywords, markets and the prompts derived from them, plus the results of each measurement run (AI answers, rankings, cited sources) and generated summaries and recommendations. This data generally relates to companies, not individuals. It is visible only to members of your workspace and to us for operating and supporting the service.
5 Service providers
In plain terms: a small set of vetted providers keeps zitaso running.
| Provider | Purpose | Data |
|---|---|---|
| Cloudflare, Inc. (USA) | Hosting, database (D1), AI processing (Workers AI), security | All service data, connection data |
| Google LLC (USA) | Sign in with Google | Email address, Google account ID |
| Resend, Inc. (USA) | Sending sign-in emails | Email address, email content |
| DataForSEO (OÜ, Estonia) | Retrieving answers from AI assistants and search engines for your prompts | Prompts and keywords (no account data) |
We do not sell, trade or rent personal data. We share data with authorities only where legally required.
6 Retention
In plain terms: as long as your account or contract needs it, then we delete.
Account data is kept while your account exists and deleted within 30 days after closure. Measurement results, including the raw answers they are based on, are kept for the duration of the contract. Sign-in links expire after 15 minutes; failed-login counters are deleted after about one day. Statutory retention duties (commercial and tax law) remain unaffected.
7 International transfers
In plain terms: we are US-based and use contractual safeguards.
Web Wombats LLC is established in the United States. Where personal data of individuals in the EEA, the United Kingdom or Switzerland is transferred to us or our providers, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses.
8 Your rights
In plain terms: ask us, and we will show, correct, hand over or delete your data.
You can request access, correction, deletion, restriction, data portability, and object to processing based on legitimate interest. Write to analytics@webwombats.com. If you are in the EEA, UK or Switzerland, you may also lodge a complaint with your supervisory authority. If your workspace is administered by your employer or client, they decide on access to the workspace.
9 Security
We use transport encryption, least-privilege access, strict separation of workspaces, hashed one-time tokens and careful vendor selection. No transmission over the internet is entirely secure; we design for that reality.
10 Changes
The current version lives at this address with its date at the top.
© Web Wombats LLC · zitaso