Privacy policy.

Zillusion Private Limited is the data controller.

Webault is a product of YBM Labs, a studio operated by Zillusion Private Limited (“Webault”, “we”, “us”). We decide how and why personal data is processed when you use the website or the app. Questions about this policy go to privacy@webault.com.

Less than you might expect.

On the website (webault.com)

The website is static, and it carries two measurement tags. Google Analytics 4 counts page views and records where a visit came from. Microsoft Clarity records session replays and heatmaps — a reconstruction of the clicks, scrolls, and mouse movement on a page. Both receive your IP address, browser and device type, and the pages you open, and both set their own cookies in your browser. Google’s advertising and ad-personalisation signals are switched off, so this data is not used to build an advertising profile of you, and Clarity masks the contents of input boxes and drop-down menus in every mode, so what you type is never uploaded to it. Our hosting provider also records standard server logs (IP address, user agent, requested URL, timestamp) to serve the site and keep it secure. We do not use any of this to identify you.

In the app (app.webault.com)

• Account details. The email address you sign in with, and a display name if you give one.
• Briefs. The sentences you type describing what you are naming.
• Hunts. The names Webault writes for you, the registry answers for each, the prices returned, and which names you mark or open.
• Support messages. Anything you send us by email.
• Technical data. IP address, browser type, device type, and the pages and actions you use in the app, recorded in server logs.

We do not collect payment card details. If we introduce paid plans, payments will be handled by a payment processor and we will update this policy before that happens.

To run the hunt, and to keep the service working.

• To provide the service. Your brief is used to write names. Each name is sent to the registry for its extension to check availability. Results are stored so you can return to a hunt.
• To improve name quality. Which shapes came back taken in one round informs the next round of the same hunt. We may also analyse hunts in aggregate, without identifying you, to improve how Webault writes names.
• To keep the service secure. Logs are used to detect abuse, rate-limit lookups, and diagnose faults.
• To communicate. We email you about your account and material changes to the service. We do not send marketing email unless you opt in.

Where the law requires a legal basis, we rely on performance of our contract with you (to run the service), our legitimate interests (security, improvement), and your consent (marketing, if any).

Candidate names leave Webault. Your identity does not.

To check availability, Webault sends each candidate domain name to the registry or registry data service that operates its extension. The query contains the domain name only. It does not include your email, your brief, or anything that identifies you. Registries may log queries under their own policies.

When you follow a Buy link, you leave Webault and go to a registrar. The registrar has its own privacy policy and terms. What you enter there is between you and the registrar; Webault does not see it.

Measurement on the website, essentials in the app.

The website sets the cookies used by Google Analytics and Microsoft Clarity, described in section 02. They measure how the site is used; they do not follow you to other sites. The app sets strictly necessary cookies to keep you signed in and to protect forms against forgery. There are no advertising cookies anywhere in Webault. You can refuse all of them by blocking third-party scripts or cookies in your browser.

We do not sell personal data. We share it with the providers who help us run Webault.

• Hosting and infrastructure providers that store data and serve the website and app.
• Email providers that deliver account emails.
• Analytics providers — Google (Analytics) and Microsoft (Clarity) — which receive website usage data as described in section 02.
• Registries and registry data services, which receive candidate domain names only, as described above.
• Authorities, if we are required to by law or to protect the rights and safety of users or the public.
• A successor, if Zillusion Private Limited is acquired or merges, in which case this policy continues to apply to your data.

Providers act on our instructions and may only use data to provide their service to us.

The companies that process data on our behalf.

These providers handle personal data for us under contract. They act only on our instructions and may not use the data for their own purposes.

We update this list before a new sub-processor begins processing personal data. Providers may store and process data outside your country, as described in section 12.

Kept while you have an account, then removed.

Account details, briefs and hunts are kept while your account is active so you can return to them. When you delete your account, or ask us to, we delete them within 30 days, except where we must keep a record to meet a legal obligation or resolve a dispute. Server logs are kept for up to 90 days.

Website analytics

Google Analytics holds event-level data for the period set on our property; Google’s longest option for that setting is 14 months. Microsoft Clarity keeps session recordings for 30 days, except recordings we mark as favourites and a randomly sampled subset, which it keeps for up to 9 months; heat maps stay available for up to 9 months. We do not export either set of data into our own systems.

Encrypted in transit, access limited.

All traffic to the website and app uses HTTPS. Data at rest is stored with providers that encrypt it. Access to production data is limited to people who need it to run the service. No system is perfectly secure; if we learn of a breach affecting your data, we will tell you without undue delay.

Access, correct, export, delete, object.

Depending on where you live, you may have the right to access the personal data we hold about you, correct it, receive a copy in a portable form, ask us to delete it, restrict or object to how we process it, and withdraw consent where we rely on it. This includes rights under India’s Digital Personal Data Protection Act, the EU and UK GDPR, and similar laws.

To exercise any of these, email privacy@webault.com from the address on your account. We respond within 30 days. If you are unhappy with our response, you may complain to your local data protection authority.

Webault is for adults.

The service is not directed at anyone under 18, and we do not knowingly collect data from them. If you believe a child has created an account, tell us and we will remove it.

Data may be processed outside your country.

Zillusion Private Limited is based in India. Our providers may store and process data in other countries, including the United States. Where the law requires safeguards for such transfers, we use recognised mechanisms such as standard contractual clauses.

When this policy changes, the date at the top changes.

We may update this policy as the service or the law changes. Material changes will be announced in the app or by email before they take effect. The effective date at the top of this page tells you which version applies.

Write to us.

Zillusion Private Limited, trading as YBM Labs.
Email: privacy@webault.com

See also the terms and conditions.