WebletGPTPrivacy Policy
Effective 2 October 2026 · Applies to https://www.webletgpt.com and all WebletGPT GPT plugins in ChatGPT
1. Who we are
WebletGPT ("we", "us") runs WebletGPT: this website and the GPT plugins that let you use our tools inside ChatGPT. We are the data controller for the personal data described here. We process personal data in line with the Kenya Data Protection Act, 2019 and, where it applies to you, other data protection laws such as the EU/UK GDPR.
2. Information we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Name, email address, password (stored only as a one-way hash), sign-up date | You, when you create an account |
| Subscription & billing | Plan, subscription status and dates, PayPal subscription ID, PayPal payer ID, and the name and email address on your PayPal account | PayPal, when you subscribe or your subscription changes |
| Email preferences | Whether you agreed to receive product and update emails | You, at sign-up or on your dashboard |
| GPT plugin connections | Which GPT plugins you connected, when, and when they were last used | Created when you press Allow on our sign-in screen |
| Usage | How many times you used each tool each month | Recorded when a GPT plugin runs a tool for you |
| Tool inputs | The information a GPT plugin sends to our tools to answer your request (for example an agent name, consignment figures or policy options) | ChatGPT, on your behalf |
| Technical | IP address, browser type and request logs | Your browser or ChatGPT's servers when they contact ours |
We never receive your card or bank details. PayPal collects and holds all payment information.
Please don't enter sensitive personal data (such as health information about identifiable people) into the tools. They are designed for technical, scientific and policy information, not personal records.
3. How we use it and why
| Purpose | Legal basis |
|---|---|
| Create and run your account, and sign you in | Performance of our contract with you |
| Take payments, track your subscription, apply grace periods and cancellations | Performance of contract |
| Decide which tools you can use and apply monthly limits | Performance of contract |
| Run tools and return results to the GPT plugin you're using | Performance of contract |
| Send service emails (receipts, payment problems, security notices, policy changes) | Performance of contract and legal obligation |
| Send product news and updates | Your consent, which you can withdraw at any time on your dashboard |
| Keep the service secure, prevent fraud and abuse, and fix problems | Our legitimate interests |
| Keep financial records and respond to lawful requests | Legal obligation |
We do not sell your personal data, we do not use it for advertising, and we do not use your tool inputs to train AI models.
4. GPT plugins and ChatGPT
Our GPT plugins run inside ChatGPT, which is operated by OpenAI. When you use one:
- Your conversation happens in ChatGPT and is governed by OpenAI's privacy policy. We cannot see your chats.
- When you press Allow, ChatGPT receives an access token that lets the GPT plugin act on your WebletGPT account. It never receives your password or payment details.
- When the GPT plugin calls one of our tools, ChatGPT sends us only the information needed for that request. We send back the result, which ChatGPT shows to you.
- You can disconnect any GPT plugin at any time from My account → Connected ChatGPT sessions.
5. Who we share it with
We share personal data only with service providers who help us run WebletGPT, under contracts that require them to protect it:
- PayPal: payment processing and subscription management.
- OpenAI: tool results are returned to ChatGPT so they can be shown to you.
- Hosting and database providers: to store and run the service.
- Email providers: to send service emails and, if you agreed, product updates.
We may also disclose information if the law requires it, to protect our rights or users' safety, or as part of a merger or sale of the business, in which case this policy continues to apply.
6. International transfers
Some of our providers store or process data outside Kenya, including in the United States and the European Union. When we transfer personal data abroad, we rely on safeguards recognised under the Data Protection Act, 2019, such as contractual protections and providers' security commitments.
7. How long we keep it
- Account data: while your account is open. After you delete it, we remove it within 30 days.
- Billing records: up to 7 years, as required for tax and accounting.
- Usage counts: 24 months.
- Tool inputs: processed to produce your result and not stored afterwards, except in short-lived error logs (up to 30 days).
- Server logs: up to 90 days.
- Connection tokens: sign-in tokens expire after 1 hour; renewal tokens after 90 days, or as soon as you revoke them.
8. How we protect it
All traffic is encrypted with HTTPS. Passwords are stored as salted hashes and connection tokens only as one-way hashes, so they can't be read even from our database. Payment notifications from PayPal are cryptographically verified. Access to production systems is limited to people who need it. No system is perfectly secure; if a breach affects your personal data, we will notify you and the Office of the Data Protection Commissioner as the law requires.
9. Your rights
Under the Data Protection Act, 2019 you have the right to:
- be told how your personal data is used (this policy);
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- object to processing, including withdrawing consent to marketing emails at any time;
- receive your data in a portable format.
To use any of these rights, email incubatorassociation@gmail.com from the address on your account. We reply within 30 days. You can change your email preferences and disconnect GPT plugins yourself on your dashboard. If you're unhappy with how we handle your data, you can complain to the Office of the Data Protection Commissioner (ODPC).
10. Cookies
We use one essential cookie to keep you signed in and to protect forms against misuse. We don't use advertising or third-party tracking cookies. PayPal may set its own cookies when you use its checkout.
11. Children
WebletGPT is a professional service and is not intended for anyone under 18. We do not knowingly collect data from children; if you believe a child has created an account, contact us and we will delete it.
12. Changes to this policy
If we make material changes, we will update the effective date above and email account holders before the changes take effect.
13. Contact us
WebletGPT
Mtwapa, Kilifi County, Kenya
Privacy questions and requests: incubatorassociation@gmail.com
Template: have this policy reviewed by a qualified advisor, and confirm whether you need to register with the ODPC as a data controller, before launch.