Privacy Policy

Weelkit is a content intelligence platform for teams. It is operated by Weelkit Inc., a Delaware corporation in formation (“Weelkit”, “we”, “us”). This policy explains what personal information we handle when you visit weelkit.com, contact us, or use the Weelkit app at app.weelkit.com.

For privacy questions, or to use any right described in this policy, email [email protected]. You can also use our contact page.

For the content a team keeps in its workspace, the organization decides why and how personal information is used, and Weelkit processes it on the organization’s behalf. For accounts, sign-in, security, support and website inquiries, we decide how the information is used. If you use Weelkit through an organization, ask your workspace administrator about the organization’s own practices.

We collect what a feature needs to work. It comes from you, from your teammates, from the services you connect, and from your use of Weelkit.

• Account and organization information. Your name and email address, your password (stored only in hashed form), profile details you choose to add such as job title, location, time zone and photo, your two-factor settings, the organization’s name and type, its members, roles and invitations, and sign-in records: sessions, IP address, the approximate location derived from it, and device and browser details. We use it to create and secure accounts, sign you in, apply organization permissions, send you service emails, and prevent abuse.
• Content you create. Articles and their versions, comments, chats and the answers the AI gives, files and documents you upload, images you upload or generate, logos, editorial guidelines and brand voice, and what the AI remembers about your preferences. We use it to run the workspace, produce the output you ask for, and let your team work together.
• Information from the services you connect. Credentials for those services (stored encrypted), account names, the fields, categories and settings your content management system returns, performance data from Google Analytics and Google Search Console (see section 3), SEO data from your own Ahrefs or Semrush account (see sections 5 and 7), and Slack channel names and, when you ask the assistant to read a channel, its recent messages. We use it to publish where you tell us to, including to your own Custom API endpoint, measure results, and show you how your content performs.
• Search and AI visibility. The prompts you ask Weelkit to track, the answers AI assistants and search engines give to them, speed and quality measurements of your public pages, and the results we derive from them. We use it to produce your visibility reports.
• Usage and diagnostics. AI requests and their token usage, tool activity, notifications, organization audit logs, security events, and short diagnostic events from the editor. We use it to keep the service secure and reliable, apply usage limits, support you, and improve Weelkit. Google user data is used only as described in section 3.
• Website visitors. If you use the contact or request-access form: your name and email address and, on the contact form, your organization, role, use case and message. Our servers and Cloudflare also process IP addresses and request details to deliver the website and protect it from abuse.

Information you give us about other people, such as teammates you invite, should be limited to what is needed. Do not upload sensitive personal information unless you are authorized and have confirmed that Weelkit is suitable for that use.

Where the law requires a legal basis, we rely on performing our agreement with you or your organization, our legitimate interests in running and securing the service and answering inquiries, legal obligations, and your consent where it is required, for example when you connect a Google service.

Weelkit connects to Google in two ways: to sign you in, and to use the Google services you choose to connect. Each connection asks for your permission on Google’s own consent screen, and you decide whether to grant it. This section lists every Google permission (scope) Weelkit requests and what we do with the data it returns.

Weelkit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Our commitments

• We use Google user data only to provide and improve the features described in this section, which you can see and use in Weelkit.
• We do not use Google user data to train or improve generalized AI or machine-learning models.
• We do not sell Google user data, and we do not use or share it for advertising, including retargeting and interest-based advertising.
• People at Weelkit do not read Google user data, except when you give your consent for specific data, when it is necessary for security purposes such as investigating abuse, or when the law requires it.
• We pass Google user data only to the providers listed in section 5 that are needed to deliver the feature you are using, for example the AI model provider that writes an answer you asked for or scores the quality of that answer (section 4), and otherwise only to protect security or to comply with the law.
• We request only the permissions listed below.

Sign in with Google

• Permissions. openid, email and profile, the standard Google sign-in permissions.
• What we read. Your Google account identifier, name, email address, whether Google has verified that address, your profile picture address, and, for Google Workspace accounts, the company domain.
• How we use it. To create your Weelkit account, sign you in, and link your Google account to it. The company domain is used only for organizations that require their members to sign in through their company domain. Weelkit does not keep the access token Google issues at sign-in.
• Where it is stored and for how long. In your Weelkit account in our database, for as long as the account exists.
• How to delete it. Unlink Google in Account settings under Connected Accounts (unless it is your only way to sign in), or delete your account as described in section 7. You can also remove Weelkit at your Google Account permissions.

Google Analytics

• Permission. https://www.googleapis.com/auth/analytics.readonly, read-only. Weelkit never changes your Analytics account or properties.
• What we read. The Analytics accounts and properties you can access, by name and identifier, so you can choose one. For the property you choose, daily aggregated reports: sessions, users, page views, engagement, bounce rate and key events, broken down by traffic channel, source, medium and campaign, page path and title, landing page, country, region and city, and device category. Weelkit does not request identifiers of individual visitors.
• How we use and show it. It appears on your Analytics and Performance pages, matched to the articles you published through Weelkit, and feeds performance alerts. If you ask the assistant about your traffic, the relevant figures are included in the request to the AI model provider that writes the answer, and the answer is saved in your chat.
• Where it is stored. In our database in Nuremberg, Germany. The access and refresh tokens are encrypted before they are stored. The figures are visible to the members of your organization according to their roles.
• How long we keep it. The imported daily figures stay in your workspace for as long as the organization exists, including after you disconnect, so your history is not lost. Raw report rows kept for troubleshooting are trimmed to the most recent 90 days each time the property is imported. After you disconnect, nothing more is imported.
• How to stop and delete. In Organization settings under Integrations, choose Disconnect. That deletes our copy of the access tokens and stops all further imports. To withdraw the permission at Google as well, remove Weelkit at your Google Account permissions. To delete the imported figures, delete the organization (section 7) or email [email protected] and we will delete the data imported from that property.

Google Search Console

• Permission. https://www.googleapis.com/auth/webmasters.readonly, read-only. Weelkit never submits or changes anything in Search Console.
• What we read. The sites you can access, so you can choose one. For the site you choose: clicks, impressions, click-through rate and average position by date, search query, page, country, device and search appearance; the sitemaps submitted for the site and their status; and the index status Google reports for your article pages.
• How we use and show it. It appears on your Analytics and Performance pages and on each article’s own performance view, and it feeds alerts. If you ask the assistant about your search performance, the relevant figures are handled as described under Google Analytics.
• Where it is stored, how long we keep it, and how to delete it. The same as for Google Analytics above: our database in Nuremberg, imported figures kept while the organization exists, raw rows trimmed to 90 days, Disconnect in Organization settings under Integrations, and deletion by deleting the organization or by emailing [email protected].

Gmail (sending only)

• Permissions. https://www.googleapis.com/auth/gmail.send, which lets Weelkit send a message you approve from your own Gmail address, plus openid, email and profile to identify which Google account is connected.
• What we read. Your Google account identifier and email address. Weelkit does not read your mailbox.
• How we use it. When you ask the assistant to email something, such as an article summary, to a recipient you name, Weelkit shows you the exact recipient, subject and message. It sends the message from your account only after you review it and click Approve. Each approval covers one message as shown, and Weelkit does not remember approvals for email. If you click Deny, nothing is sent.
• What Weelkit does not do. Weelkit never reads, stores or changes your mailbox. It keeps no copy of your mail and changes or deletes nothing in it. The only thing it does is send the message you approved, which Gmail files in your Sent folder like any message you send.
• Where it is stored and for how long. The connection belongs to you personally, not to your organization. Your Google account identifier and email address are stored with the connection, and the access and refresh tokens are encrypted before they are stored. The text you approved stays in your chat history until you delete the chat, and Weelkit keeps a short-lived record that the message was sent.
• How to stop and delete. In Account settings under AI Preferences and Integrations, choose Disconnect. That deletes our copy of the tokens and prevents any further sending. The record that you connected that address is removed when you delete your account. To withdraw the permission at Google as well, remove Weelkit at your Google Account permissions. Messages already sent remain in the recipients’ and your Gmail accounts.

When you ask the AI to research, write, edit or answer a question, Weelkit sends the relevant prompt, workspace context and attachments to the AI model provider that runs the request (section 5). What is sent depends on the request, and it includes data from the services you connect when your question needs it, for example keyword research from your Ahrefs or Semrush account. Answers and related records are stored in your workspace. Each provider’s own terms and privacy policy govern how it handles a request it receives.

Weelkit does not train or fine-tune AI models on your content. A sample of AI answers and written pieces is scored automatically by an AI model so we can find answers that need to be better. The scores are kept with short notes, and the material used for scoring is deleted after 7 days.

If you use voice input, the recording is sent to Deepgram to be turned into text. The recording is not saved in your workspace, and Deepgram is told not to keep it to improve its own models.

Connecting a service lets information pass between Weelkit and that service according to your permissions and instructions. Publishing can make content public. Disconnecting an integration does not delete information the other service already holds.

These providers help us run Weelkit. Each receives only the information it needs for the task described. Which AI model handles a request depends on how Weelkit is configured at the time.

Hosting, storage and delivery

• Hetzner Online GmbH, Nuremberg, Germany: hosts the application servers and the database.
• Cloudflare: DNS and a network proxy in front of weelkit.com and our apps. It sees visitors’ IP addresses and request details.
• Vercel: hosts secondary copies of the marketing site and the web apps.
• Cloudinary: stores images and files you upload or generate, organization logos, profile photos and chat attachments.
• Sanity: manages the articles and guides published on weelkit.com and delivers their images. It holds no workspace data.

Email and sign-in

• Resend: sends our service emails, such as verification, password reset, invitations, security alerts and notifications. It receives the recipient’s address and the message.
• Google, GitHub and Microsoft: the sign-in options you can choose. Each tells us your name, email address and picture when you sign in with it.
• Have I Been Pwned (Pwned Passwords): when you set a password, it receives the first five characters of a one-way hash of that password to check whether it has appeared in a known breach. The password itself is never sent.

AI models and related services

• OpenRouter and, directly, OpenAI, Anthropic, Google (Gemini), DeepSeek and Moonshot AI (Kimi): AI model access. They receive the prompt, workspace context and attachments for a request. OpenRouter passes the request on to the model developer that runs it.
• TypeSafe: a classification and ranking service. It receives the text of your chat request and recent context so we can interpret it, the query and candidate titles when you search your workspace, and the claims and source text used to check citations.
• Deepgram: turns voice input into text.
• Replicate: generates images. It receives your image prompt and style, and the addresses of any source or reference images you chose.
• Firecrawl: reads uploaded PDF, Word, Excel, PowerPoint and CSV files to extract their text, and reads public web pages for research.

Web research and visibility tracking

• Exa, TinyFish and Firecrawl: web search and page reading for research requests. They receive the search queries the AI writes and the public addresses of the pages to read.
• Brave Search, Perplexity, Exa, TinyFish, Firecrawl, Tavily, Parallel, Linkup, You.com and Serper: search-ranking checks. They receive the prompts you ask Weelkit to track, with a country and language.
• DataImpulse: a proxy network used by our own browser when Weelkit asks AI assistants and search engines, signed out, the prompts you track.
• The AI assistants and search engines you track, such as ChatGPT, Gemini, Google AI Mode, Brave and DuckDuckGo: Weelkit submits your tracked prompts to them without your account and records the answers.
• Google PageSpeed Insights and Chrome UX Report: receive the public addresses of your pages to measure their speed and experience.

SEO data from your own accounts

• Ahrefs and Semrush: you connect your own account with an API key you create in the service (Semrush also needs its v3 key). Weelkit sends requests to the service with that key. They receive your site’s domain, the public addresses of your articles, and the keyword you ask about when you use keyword research. They return SEO data for your account: organic traffic estimates, backlinks and referring domains, each article’s ranking keywords, competitors and keyword ideas, and, from Ahrefs, site authority, a site audit and AI-answer visibility. What they return counts against your own plan units, under your own account and the service’s own terms. Weelkit keeps its use inside a budget and shows a usage meter.

The CMS, analytics, messaging and Google accounts you connect are destinations you direct information to. They are not our service providers, and they handle information under their own terms. A Custom API destination is your own HTTPS endpoint: Weelkit sends published content to the endpoint you configure and to no other, authenticated with the key and header you set. That key is stored encrypted.

Information is shared with the members and administrators of your workspace according to their roles, with the destinations you connect, and with the providers in section 5.

We do not sell personal information, and we do not share it for advertising.

We may also disclose information when the law requires it, to address fraud or security risks, or as part of a business transfer, with appropriate protections and any notice the law requires.

We keep information for as long as it is needed for the purposes in this policy. The periods below are the ones the service applies today.

Your account

• Your account and profile stay until you delete the account. To delete it, use Account settings under Data & Privacy. You have 14 days to change your mind: your account is closed during that time and signing in offers only the option to cancel. After that we permanently delete your sessions, AI memory, chats, activity records, invitations you sent, personal connections such as Gmail and Slack, sign-in links and profile details. You cannot delete your account while you own an organization, so transfer ownership first.
• Content your organization holds, such as articles and comments, stays with the organization, and your account is shown as a deleted account. Usage records lose your user identifier. Security events (sign-in, IP address, device, country) are kept for 365 days. Ended sign-in sessions and the log of service emails sent to you are removed after 30 days.
• In Account settings you can also delete your activity history, under Data & Privacy, or clear everything the AI remembers about you, under AI Preferences.

Your organization

• An organization’s owner can delete it in Organization settings under Danger Zone. Members lose access straight away, and 24 hours later we permanently delete the organization’s data: articles, versions and comments, collaborative documents, chats, AI memory, the knowledge base, members and invitations, settings, integrations and their stored credentials, analytics and AI visibility data, and uploaded logos. Billing records, support tickets and records of export and deletion requests are kept for legal and support reasons.
• Organization audit logs are kept for 90 days unless the organization sets a period between 30 and 3,650 days.
• Archived articles stay in the workspace until the organization is deleted or you ask us to delete them. Comments, chats and images can be deleted directly. Deleting a chat removes its messages; the AI engine’s working copy of a conversation is removed after 7 days without use.

AI and measurement records

• Material used to score AI answers is deleted after 7 days, and the rest of the scoring trace after 30 days.
• Answers collected for AI visibility tracking are kept for 30 days, the findings derived from them for 90 days, and aggregated results for 365 days.
• Speed measurements of your pages are kept for 400 days.
• Google Analytics and Search Console data is kept as described in section 3.

SEO data from Ahrefs and Semrush

• The API key you paste is stored encrypted, and only its last four characters are ever shown. Disconnecting deletes the stored key.
• Data pulled from your account is cached so pages load quickly and repeated views do not use your plan units. Ahrefs data from scheduled pulls is kept for 7 days, the results of research you ask for in Ahrefs for 24 hours, and Semrush data for up to 28 days. The cache includes the keywords you researched. Expired data is deleted daily.
• Cached data is deleted when you disconnect, when you replace the key, and when Ahrefs or Semrush stops accepting the key.

Website forms and backups

• Contact and request-access submissions are kept until you ask us to delete them.
• Database backups are point-in-time copies. They are not edited to remove individual records; deleted information disappears from a backup when that backup is replaced.

Weelkit’s servers and database are in Nuremberg, Germany, in the European Union, and your information is stored and processed there. Some of the providers in section 5 process information elsewhere, including in the United States.

When we send personal information to a provider outside the European Economic Area or the United Kingdom, we send only what the feature needs. Where data protection law requires a safeguard for that transfer, we rely on the transfer mechanism the provider makes available, such as standard contractual clauses. To ask which mechanism applies to a particular provider, email [email protected].

Access and refresh tokens for connected services are encrypted before they are stored. Sign-in and the requests our servers make to providers use HTTPS. Access to workspace data follows organization roles, and sensitive actions such as deleting an account or exporting an organization’s data need a recent sign-in. You can turn on two-factor authentication, and new passwords are checked against known breaches.

No online service or storage system can guarantee complete security.

Depending on where you live, you may have the right to access your personal information, correct it, delete it, receive a copy, object to or restrict certain processing, and withdraw consent you gave. You may also complain to your local data protection authority.

• Access and export. In Account settings under Data & Privacy, download a copy of your personal data as a JSON file. An organization’s owner can download the organization’s records as a ZIP file in Organization settings under Data Management; the file is available for 24 hours.
• Correction. Edit your profile in Account settings. For anything else, email us or ask your workspace administrator.
• Deletion. Delete your account, your activity history or the AI’s memory of you in Account settings, or delete an organization in Organization settings, as described in section 7.
• Personalization. In Account settings, turn off Allow Personalization under Data & Privacy, and view, edit or clear what the AI remembers under AI Preferences.
• Withdrawing a connection or consent. Disconnect a service in Weelkit, and remove Weelkit from your Google Account permissions to withdraw a Google permission.
• Anything else. Email [email protected] and describe your request.

We may need to verify your identity and authority before acting, and we respond within the time the law allows. If your request concerns an organization’s workspace, we may refer it to that organization or help it respond.

The Weelkit app

• Sign-in cookie. __Secure-weelkit-refresh is a first-party cookie that is only sent to our sign-in service and is not readable by page scripts. It keeps you signed in. By default it ends when you close the browser. If you choose Remember me, it lasts for the period your organization allows, 30 days by default and at most 90, and is removed when you sign out.
• Social sign-in cookies. While you sign in with Google, GitHub or Microsoft, a temporary cookie (weelkit.external.auth, 10 minutes) and a short-lived security cookie carry the state of the sign-in between the redirects.
• Browser storage. The app keeps your access token in memory only. It uses your browser’s local and session storage for your display settings, a copy of your profile for display, unsent chat messages, the article you last had open in a chat, and the state of a sign-in or connection that is in progress, so work is not lost and you return to the right place. Most of it is removed when you sign out, and clearing your browser’s site data removes the rest.
• Embeds. An article that contains a YouTube video or an X post loads it from YouTube or X, and the sources panel shows site icons loaded from Google. Those services receive your browser’s details when they load.

The app sets only the cookies it needs to sign you in, and uses no analytics or advertising cookies, so it shows no cookie banner.

This website

• weelkit.com sets no cookies of its own and runs no analytics, advertising or tracking tools. You can manage cookies in your browser, although blocking essential storage may affect the app.
• When you open the product walkthrough, the site loads a YouTube player from YouTube’s privacy-enhanced domain. Your browser connects to Google/YouTube, which receives technical information and handles it under its own privacy practices. This does not make playback anonymous.
• Brand logos on some pages load from thesvg.org, and the demo video on the home page loads from media.weelkit.com. Article images come from Sanity’s image network. Each of these receives your IP address and browser details when it loads.
• Fonts are served by us. Cloudflare sits in front of the site and processes request details to deliver and protect it.

Weelkit is a service for working adults and is not intended for anyone under 16. Our Terms require users to be at least 18. If you believe a child has given us personal information, email us so we can investigate and delete it.

We update this policy when our practices change, and the date at the top shows when it last changed. We will tell you about material changes as the law requires. If new processing needs your consent, we will ask for it separately, and we will ask again before we use Google user data for anything not described in section 3.