Privacy Policy

Who processes information

Trolly Ecommerce Pvt. Ltd. operates WebMins.com from Avantinagar, Tisk Usgao, Ponda, Goa, India. This policy explains platform processing for account authentication, AI-assisted website creation, project management, digital purchases and hosted services. It also distinguishes WebMins storage from independent processing by providers you connect.

Registration, profile and authentication

Registration uses name, email, mobile number and password, and may include a domain. Profile and billing records can contain company, address, country, state, city, postal code, timezone and preferences. Passwords are stored as hashes. Configured Google authentication verifies identity; WebMins maintains its own access and refresh sessions.

ChatGPT identity connection

The configured website OAuth flow requests openid and profile scopes for an existing WebMins user. Signed identity claims are checked to establish the connection. The application stores a hashed identity association and link timestamps, and discards returned OAuth tokens. Temporary browser-bound transactions contain encrypted PKCE and nonce information and expire after ten minutes. Local disconnect removes the association and pending transactions; it does not revoke other OpenAI sessions.

Projects, prompts and uploads

Saved website projects, generated source, prompt messages and related job records may be stored for editing, history and generation workflows. Figma files and imported or uploaded images and other assets are processed when you use the corresponding import or editing workflow. A request to generate or edit can send relevant prompts, selected project content and supported assets to a selected provider. Avoid submitting unnecessary sensitive information or material you lack permission to use.

Connected AI providers and transfers

OpenAI and Anthropic API keys are separate from ChatGPT identity sign-in. Saved keys are encrypted server-side and used for provider requests; ordinary connection responses contain metadata and masked hints. Removing a key locally does not revoke it at the provider. Provider processing and any international transfer are described in the approved disclosure: AI website generation/editing sends relevant prompts, selected project/source context and supported assets to the configured OpenAI or Anthropic API service using separately connected credentials and account-available models. Provider, hosting and infrastructure processing may occur outside India, including the United States; no India-only residency is promised. The provider agreement, service and account controls determine retention and any training use; WebMins does not promise zero retention or universally excluded training. Review the selected provider's current privacy/data controls before submitting personal or confidential content. Saved API credentials are encrypted; local removal deletes the saved key/preference but does not revoke the provider key or recall sent data. ChatGPT identity linking uses openid/profile, discards returned OAuth tokens and grants no inference credits. Customers must have a lawful basis for submitted data and review generated claims, rights, accessibility and security before publishing.. We do not promise that providers never retain requests or use them for training.

Payments, subscriptions and service records

Orders, invoices, amounts, currency, discounts, tax, payment status, provider references, subscription duration and renewal information support fulfilment and accounting. Payment providers handle their own payment interfaces. The integration records transaction metadata rather than claiming to store customers’ card details. Delivery, license, domain and download records support product access.

Logs, storage and purposes

Authentication, operational logs, analytics if enabled, cookies, local browser storage and security events may support sessions, preferences, troubleshooting and abuse prevention. The reviewed inventory and optional tracking controls are Essential storage includes scoped WebMins browser-session cookies (HttpOnly, SameSite=Lax; Secure in production), account display metadata in sessionStorage, checkout/currency state where used, and the temporary ChatGPT linking cookie. Session cookies expire with their server-side sessions; sign-out revokes the relevant session. Interface/PWA preferences and service-worker caches persist until cleared or updated. webmins_cookie_preferences localStorage and signed-in cookie_preferences records hold essential/analytics/marketing choices, version and timestamp for a maximum validity of 180 days. Optional first-party kit-view and AI-click counters require Analytics consent; webmins_referral attribution requires Marketing consent and uses the configured campaign lifetime. Optional categories start disabled and can be rejected or withdrawn through Cookie Settings in the footer/account screen. No global GA/GTM, Meta, Clarity or Hotjar loader was found in the reviewed application. Google sign-in and payment scripts serve requested authentication/payment functions; external providers publish their own storage notices. Clearing browser storage does not erase server records.. Processing purposes include providing requested services, maintaining accounts, fulfilling purchases, resolving support requests, securing the platform and meeting applicable recordkeeping obligations.

Recipients and international processing

Selected AI, identity, payment, email, hosting and infrastructure providers process information necessary for their functions. External services may operate in other locations and apply their own policies. We may disclose necessary information for lawful requests, disputes and protection against abuse. Review the selected provider's disclosures before using a workflow with sensitive data.

Retention, deletion and rights

The approved retention schedule is Active account and project data is retained to provide the requested service. On verified closure/deletion, the operational target is removal or anonymisation of eligible account data, projects, stored prompts/job context and saved integration credentials within 30 days; this is a manual workflow, not automatic deletion on submission. Operational logs and backup copies are assessed during that review and should expire or be removed within the same 30-day target where technically and legally possible; any longer retention and reason must be communicated. Isolated backups are not used for ordinary service and approved deletion must be reapplied if restored. Invoices, tax/payment records, consent evidence, fraud/dispute evidence and legal holds may be retained for the applicable legal period, restricted to that purpose. No blanket 30-day erasure claim applies to these exceptions or independently held provider records.. Request access, correction, eligible export or deletion via support@webmins.com; verification may be necessary to protect your account. The implemented procedure and exceptions are Use /dashboard/privacy/ while signed in to request export, deletion or account closure, or email support@webmins.com from the registered address with the request type. Support verifies ownership proportionately, reviews subscription cancellation, supplies eligible data by a secure method, and manually processes the requested action and retention exceptions. Do not send passwords, API keys or identity documents unless a necessary secure verification method is agreed. A queued request or Completed status is not itself a technical erasure operation. Save needed exports before closure; cancel recurring billing separately and request assistance if account access is unavailable. India and US requests are handled under applicable rights and deadlines; receive an explanation of any lawful refusal, exception or extension and use the grievance channel to challenge the result.. Removing a connection or browser session does not automatically erase saved projects, historical job records, invoices or provider-side records.

Security and contact

Access controls and credential protections reduce risk but do not eliminate it. Review the Security Policy for verified controls and reporting channels. Contact support@webmins.com for privacy requests; grievance handling is Grievance officer: Chandan Patil, Trolly Ecommerce Pvt. Ltd., Avantinagar, Tisk Usgao, Ponda, Goa, India. Email support@webmins.com with subject Grievance and your account/order reference, prior support reference and requested resolution. Indian consumer complaints are to be acknowledged within 48 hours and redressed within one month as required by applicable e-commerce rules. Privacy requests follow applicable statutory timelines. The same channel accepts US customer escalations; mandatory local remedies remain available.. Material changes will be reflected in the published version and effective date.

Related policies

Terms · Privacy · Refunds · Digital delivery · AI usage · Contact

Customers in India and the United States

WebMins serves customers in India and the United States from its Indian operating company. The published business address and support channel apply to both regions; no separate US office is represented. Applicable mandatory consumer and privacy rights remain available regardless of the currency or governing-law clause. Features, gateway availability and tax treatment depend on the actual offering and checkout.

India and US privacy requests

Depending on applicable law and eligibility, you may request information/access, correction, deletion, an eligible copy of your data, withdrawal of consent and grievance review. Indian rights and procedures apply as the relevant provisions of the Digital Personal Data Protection framework take effect; this notice does not represent every provision as already in force. US state rights, including California rights where that law applies to this business and request, may additionally cover portability, opt-out of sale/sharing or targeted advertising, restriction of certain sensitive-data uses, authorised agents, appeals and non-discrimination. Submit requests to support@webmins.com or the signed-in privacy controls. Cookie Settings stops optional first-party analytics/marketing; it is not represented as a universal automated state-law opt-out or Global Privacy Control implementation. We assess other applicable opt-out signals and requests through support. Nothing here certifies that a particular state-law business threshold is met.