Get Started

Privacy Policy

Webror — AI chat assistants for business websites

Last updated: 11 October 2026

This Privacy Policy explains how Webror, a sole proprietorship owned by Mehak Mansuri, with its principal place of business at Second Floor, 144, Near Gupta Oil Shop, Nehru Kutia, Malka Ganj, Delhi 110007, India (“Webror”, “we”, “us”, “our”), collects, uses, shares and protects personal data when you visit https://webror.com, use our customer portal at https://app.webror.com (the “Portal”), or chat with the AI chat assistant that our customers place on their own websites (the “Chat Widget”). Together these are the “Services”.

By using the Services you agree to this Policy. If you do not agree, please do not use the Services.

1. Who is responsible for your data

Webror provides software to businesses (“Customers”). Depending on the situation, we act in one of two roles:

  • Responsible party (Data Fiduciary / controller) for the personal data of people who visit webror.com, contact us, or create and manage a Webror account. This is covered in Sections 2.1 and 2.2.
  • Service provider (Data Processor) for the personal data of people who chat with a Customer’s Chat Widget. This is covered in Section 2.3. The Customer decides why and how that data is used, and the Customer’s own privacy policy applies. We process it only on the Customer’s instructions, to run the chatbot.

If you chatted with an assistant on another company’s website and want to see, correct or delete your messages, please contact that company first. We will help them respond to you.

2. Information we collect

2.1 Visitors to webror.com

  • Details you give us through forms or email, such as your name, email address, phone number and message.
  • Technical data in server logs, such as IP address, browser type, pages viewed, date and time, and the referring page.
  • Cookie data, as described in Section 7.

2.2 Customers using the Portal

  • Account details: first and last name, email address, phone number (optional), and the website domain where you will use the chatbot. Your password is stored only as a secure hash; we cannot read it.
  • Sign in with Google: if you choose this option, we receive your Google account’s name, email address, email-verification status and a unique Google account identifier. We do not receive your Google password.
  • Content you add: your business description, knowledge-base text, uploaded documents, web pages you import, chatbot appearance and behaviour settings, lead-form settings, tracked URL parameters and webhook addresses.
  • Plan and billing information: your plan, trial dates, invoices, payment status and transaction identifiers from our payment gateway. We do not see or store your full card number, UPI PIN or net-banking credentials; the payment gateway handles those.
  • Usage and support information: sign-in times, usage counts (such as messages and processing volume) and your communications with us.

2.3 People who chat with a Customer’s assistant

When you use a Chat Widget on a Customer’s website, the following may be collected on the Customer’s behalf:

  • The messages you type and the assistant’s replies, with timestamps.
  • Contact details you choose to enter in a lead form (for example name, email address, phone number).
  • Your IP address, which the Customer’s dashboard may show and which we use to prevent abuse.
  • Campaign or URL parameters from the page you were on, if the Customer chose to track them.
  • A random conversation identifier kept in your browser so the conversation stays together.

Please do not type sensitive information into a chat, such as passwords, card or bank details, government ID numbers or health records.

3. How we use information

  • To provide, operate, secure and improve the Services, including creating and managing accounts and signing you in.
  • To generate the assistant’s answers: your question and the relevant parts of the Customer’s knowledge content are sent to AI model providers (see Section 5).
  • To send service emails such as account confirmation, password reset and notifications you enable.
  • To process payments, invoices and refunds, and to meet tax and accounting duties.
  • To detect and prevent abuse, enforce usage limits and domain restrictions, and keep the Services safe.
  • To provide support and to tell you about important changes to the Services or our policies.
  • To produce aggregated usage statistics that do not identify individuals.
  • To comply with legal obligations and to establish or defend legal claims.

We do not sell personal data. We do not use Customer content or chat messages to advertise to anyone, and we do not use them to train our own AI models.

4. Legal basis and consent

We process personal data on the basis of your consent and for other purposes the law permits, such as providing a service you asked for, security, and legal compliance. We handle personal data in line with the Information Technology Act, 2000 and the Reasonable Security Practices and Sensitive Personal Data or Information Rules, 2011, and we are preparing for the Digital Personal Data Protection Act, 2023 as its provisions come into force.

Where the EU or UK GDPR applies to you, our legal bases are performance of a contract, your consent, our legitimate interests (securing and improving the Services) and legal obligation.

You can withdraw consent at any time (see Section 10). Withdrawing consent may mean we can no longer provide some or all of the Services.

5. Who we share information with

  • The Customer whose assistant you used. Chat and lead data appears in the Customer’s dashboard and exports, and in any webhook or integration the Customer sets up.
  • Service providers who help us run the Services, under confidentiality and data-protection commitments and only for our purposes:
    • AI model providers, currently OpenAI and, where used, OpenRouter and the model providers it routes to, to generate answers and to process knowledge content for search;
    • an email delivery provider (currently Resend) to send service emails;
    • cloud hosting and server infrastructure providers;
    • Google, if you use Sign in with Google;
    • a third-party payment gateway, to process payments and refunds.
  • Authorities and other parties when required by law, court order or a lawful government request, or to protect rights, safety and security.
  • A successor if we merge with or are acquired by another business or sell our assets; we will ask that your data stay protected under this Policy.
  • Anyone else with your consent.

6. Transfers outside India

Some of our service providers, including AI and email providers, may process data on servers outside India, including in the United States or the European Union. We take steps, such as contractual commitments, to ensure your data stays protected, and we transfer data only as permitted by Indian law. By using the Services you understand that such transfers may occur.

7. Cookies and similar technologies

  • Portal: we use a strictly necessary session cookie to keep you signed in, and a short-lived security cookie while you sign in with Google. They are not used for advertising or tracking.
  • Chat Widget: the widget does not set cookies. It uses your browser’s session or local storage to keep a random conversation identifier and small preferences (for example whether you have already completed the lead form). This is necessary for the chat to work.
  • webror.com: our website always uses strictly necessary cookies. Where we use analytics or marketing cookies, we load them only after you give your consent.

You can also block or delete cookies in your browser settings, but parts of the Portal may then not work.

8. How long we keep information

  • Account information: while your account is active, and for up to 30 days after you close it, except where tax, accounting or other laws require us to keep specific records longer (for example invoices).
  • Knowledge content and chat records: while the account is active. Customers can delete entries and conversations at any time in the Portal. After an account is closed or a verified deletion request is made, we delete this data within 30 days.
  • Backups: deleted data may remain in backups for up to 35 days before it is overwritten.
  • Server logs: up to 90 days.

9. Security

We use reasonable security practices appropriate to the data we handle, including encrypted connections (HTTPS), hashed passwords, access controls, separation of each Customer’s data, rate limiting and abuse protection, and regular backups. No system is perfectly secure, so we cannot guarantee absolute security. If you believe your account has been compromised or you find a security issue, write to [email protected] right away. If a personal-data breach affects you, we will notify you and the authorities as the law requires.

10. Your rights and how to use them

Depending on the law that applies to you, you may have the right to:

  • access the personal data we hold about you;
  • correct or update inaccurate data;
  • ask us to erase your data;
  • withdraw your consent;
  • nominate another person to exercise your rights if you die or become unable to do so;
  • have your complaint heard and resolved (see Section 14); and, where GDPR applies, receive your data in a portable format, restrict or object to certain processing, and complain to your local data-protection authority.

To make a request, email [email protected] with the subject “Privacy request”, preferably from the email address linked to your account. We may ask you to verify your identity first. We aim to respond within 30 days. Customers can also edit and delete much of their data directly in the Portal. If your request is about a chatbot on another company’s website, please contact that company; if you contact us, we will forward it or help them respond.

11. Children

The Services are meant for businesses and are not directed at children under 18. We do not knowingly collect personal data of children for our own purposes. Customers must not use the Services to target children, or to process a child’s personal data without any verifiable parental consent the law requires. If you believe a child’s data has been provided to us, contact us and we will take appropriate steps, including deletion.

12. Links to other websites

The Services and Customers’ chatbots may link to other websites. We are not responsible for their privacy practices; please read their policies.

13. Changes to this Policy

We may update this Policy from time to time. The “Last updated” date above shows the latest version. If a change is material, we will tell you by email or a notice in the Portal. Continued use of the Services after a change means you accept the updated Policy.

14. Grievance Officer and contact

If you have a question, concern or complaint about this Policy or how we handle your personal data, contact our Grievance Officer. We acknowledge complaints within 2 business days and aim to resolve them within 30 days.

  • Grievance Officer: Md. Nadeem Khan
  • Email: [email protected]
  • Business: Webror (Proprietor: Mehak Mansuri)
  • Address: Second Floor, 144, Near Gupta Oil Shop, Nehru Kutia, Malka Ganj, Delhi 110007, India
  • Website: https://webror.com

2