Loading
Webocat
Loading
Webocat
A practical overview for operators and larger teams: how your Webocat account handles information with GDPR in mind.
We process account details, contacts, appointments, billing records, notes, reminders and optional integrations (e.g. Zoom, Google Calendar, Stripe). Data stays scoped to your workspace and is logically separated from other customers.
The product runs on secure cloud infrastructure with encrypted transport (HTTPS). Features such as email, telephony or payments may rely on reputable vendors who only receive the minimum data required for that feature. Enable only the integrations you truly need.
How long you keep information is defined by your own policies and statutory obligations (e.g. tax years). The platform does not silently purge history unless you configure it explicitly inside your workspace.
For contact and client records you store, you are typically the controller: you handle access, rectification, restriction and erasure requests in line with GDPR. For your own account, download the CSV exports in Settings or email [email protected] to request deletion.
Processing relies on contract performance for delivering the service, legitimate interests for reliability and security, and—where required—consent for specific communications or integrations. Keep lightweight documentation so you can explain to your clients what happens with their data.
We collect only the fields needed for CRM, scheduling and finance workflows. Access to your workspace is personal or team-based, with roles that limit who can view sensitive attributes.
If processors outside the EU/EEA are used, standard safeguards (such as EU-approved clauses or equivalent measures) help keep protection aligned with GDPR expectations.
`/api/health` confirms the app is live; errors are written to host logs. Where a breach affects personal data, we follow statutory timelines for notifying authorities and individuals as required.
We apply modern security practices: encryption in transit, per-account data isolation, strong passwords and tightly controlled administrative access. Use a strong password and review third-party connections regularly.
We use technical cookies required for authentication and core product behaviour. We do not sell personal data to ad networks; any analytics focus on improving the product and are configured with minimisation in mind.
When you connect Google (Calendar, Gmail or Contacts), Webocat requests access only for features you enable: appointment sync, reading and sending email inside the CRM, and manual contact sync. We do not sell, rent or use Google user data for advertising. Tokens are stored encrypted; you can disconnect Google from Settings. Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy
For privacy or account-deletion requests, email [email protected]. For contacts you manage as a business, keep a clear, reachable privacy contact for your own audience.