Skip to main content
WOLFITWAY

Menu

WOLFITWAY

Wolfitway · Timișoara

Get a price Sign in
Wolf MonthLanding page €999 €2,50010 of 10 spots left · until 30 NovemberClaim a spot

Privacy policy

Last updated: 24 October 2026

Who is responsible

The controller for personal data processed on this website is WOLFITWAYAGENCY S.R.L., Remetea Mare nr. 41, Timiș County, Romania, VAT RO47341942, trade register J35/5748/2022. Contact us about anything in this policy at dan@wolfitway.com.

What we collect and why

  • After Dark nominations: we store the nominated website, category, your name, email, design notes, submission type, creator credit, screenshot permission and the time you agreed to this processing, to review the submission and discuss credits or screenshot permission. Automated screening loads the public homepage, stores a private screenshot and check results, and may send the homepage screenshot and public page text to our configured AI provider to suggest a critique; your contact email is not included in that AI request. A human makes the publication decision. Legal basis: your consent (Art. 6(1)(a) GDPR). Your contact details stay private and are never added to a mailing list. Submissions and nominations are deleted after one year; all private screening screenshots are removed after 30 days, while the approved public screenshot remains with its feature. Owner review payments are processed by Stripe; we store the checkout reference, quoted amount, payment state and accepted review terms to fulfil the review contract (Art. 6(1)(b) GDPR). Stripe keeps payment records under its own policy. We store a hash of your private status-link token; anyone holding that link can see the submission’s status and decision note, but no contact details. you can ask us to delete yours earlier or withdraw consent by emailing us. Published editorial features credit the creator and link to the website, with a recorded image-use review before publication. Editorial screenshots do not imply permission, affiliation or endorsement. Contact us for corrections or removal. Optional “save for later” bookmarks are stored only in your own browser and can be removed with the same button or by clearing site data.
  • Contact form, project brief and booking: name, email, company and your message or meeting details, so we can reply and run the call. On the contact form and the project brief you tick a box to confirm you have read this and agree we store your details to reply (we keep the time you ticked it with your message). We use the details only to answer it (if you also pick products for early access on the contact form, we start the double opt-in described under Newsletter). Legal basis: steps before a contract (Art. 6(1)(b) GDPR).
  • Account and sign-in: email, name and, if you use Google sign-in, your Google profile name and picture. Used to log you in and to keep your course enrolments and progress. Creating an account means you accept our Terms. Legal basis: contract (Art. 6(1)(b)).
  • Newsletter: your email, the date you signed up and the date you confirmed. Nothing is sent until you click the confirmation link we email you. Sent only with your consent, which you can withdraw with the personal unsubscribe link in every email or your mail app's unsubscribe button (Art. 6(1)(a)).
  • Product updates: if you ask to hear when our products ship (on /products), we keep your email and the date you signed up and confirmed. Nothing is sent until you click the confirmation link; after that we email you when a product ships, nothing else. The newsletter is a separate box, never ticked for you. Never confirmed: deleted after 30 days. Legal basis: your consent (Art. 6(1)(a)); leave any time with the link in our emails.
  • Course waitlists: if you join the early access list for a course, we keep your email, that course, where you signed up and whether you also ticked the newsletter box (it is never ticked for you). After you confirm by email, we send one email when the course opens. Legal basis: your consent (Art. 6(1)(a)); leave any time with the link in our emails.
  • Hero Analyzer: the website address you submit, screenshots and text of that public page, the report, and the email you give when you order. Used to produce and deliver the audit (Art. 6(1)(b)).
  • Report follow-ups: if you tick the follow-up box on a Hero Analyzer or SEO Audit report (it is never ticked for you), we keep your email, that report's website, score and top finding, and send 3 short emails over about 10 days, then stop. They only start after you confirm by email. We count clicks on the links in those emails (no open tracking) and whether you later order a landing page, to see which email helps. Use the stop link in any of them to end it early. Never confirmed: deleted after 30 days; otherwise a year after the last email, or kept with the order if you buy. Legal basis: your consent (Art. 6(1)(a)).
  • Landing page orders: when you start a landing page at /landing we keep your email, your company name and VAT/tax ID, the website the page is for, your note, the agreement you sign (its text and fingerprint, your typed name, any signature you draw, and the time, IP address and browser of signing as an audit trail), where you came from (for example your report) and the payment status, to deliver the page and invoice you. Once you finish the first step of the order form (email and website) we save those two, and if no order is paid within 24 hours we send you one reminder email, never more; they are deleted after 30 days, or straight away when you pay (Art. 6(1)(b), steps you asked for before a contract). Checkouts never paid are deleted after 30 days; paid orders are kept as accounting records. After delivery we email you a private link to a short case-study form; it is optional, and what you write (with your name and logo only if you tick those boxes) is published only with your consent (Art. 6(1)(a)), which you can withdraw by emailing us. Legal basis: the contract (Art. 6(1)(b)) and our accounting duties (Art. 6(1)(c)).
  • Wolf Sniff browser extension: the extension reads the tab you click its icon on (scripts, styles, meta tags, response headers, the names of cookies, never their values) and works out the technologies inside your browser. Nothing about the pages you check is sent to us; your scan history stays on your device. If you buy Lifetime we keep your email, the payment status and your licence key to send and check the key, plus a random id per browser the key is active in (max 3; no browser details or IP address). The extension contacts wolfitway.com only to check the key, when you enter it and about once a week. Checkouts never paid are deleted after 30 days; paid licences are kept as accounting records and so your key keeps working. Legal basis: the contract (Art. 6(1)(b)) and our accounting duties (Art. 6(1)(c)).
  • Wolf Social desktop app: the app runs on your computer; your lists, posts, settings and AI keys stay there and are never sent to us. Your licence key is checked inside the app, offline. When you buy, we keep your email, the payment status and the purchase date to send the key (it is a signed text containing your email, the purchase date and an order number) and to send it again if you lose it; the key itself is not stored. Checkouts never paid are deleted after 30 days; paid orders are kept as accounting records. Legal basis: the contract (Art. 6(1)(b)) and our accounting duties (Art. 6(1)(c)).
  • wolf-seo (self-hosted SEO engine): wolf-seo runs on your own server; your Search Console data, sites, settings and API keys stay there and are never sent to us. A Pro licence key is checked on your server, offline; once a day it downloads a public list of refunded order numbers from wolfitway.com (the request carries nothing about you or your sites). When you buy Pro, we keep your email, the payment status and the purchase date to send the key (a signed text containing your email, the purchase date and an order number) and to send it again if you lose it; the key itself is not stored. Checkouts never paid are deleted after 30 days; paid orders are kept as accounting records. Legal basis: the contract (Art. 6(1)(b)) and our accounting duties (Art. 6(1)(c)).
  • Affiliate program: if you apply to promote us, we keep your account email, name, chosen code, website, what you told us about your audience and, once approved, your payout details (IBAN or PayPal), to run the program and pay you. Clicks on your link are counted as a daily total per code; we store no IP address, browser or anything else about the people who click (to count each visitor once per hour, a scrambled IP is held in server memory for at most an hour and never written down). For each sale you see the client's company name, package, price and commission in your dashboard. If you name an affiliate in "Who sent you?" on an order or booking, we store what you typed, and that affiliate sees your company name and how far your order or booking got (for example "paid, in progress"); nothing else about you. Checkouts through a link that did not name them and were not paid appear only as a count. If you buy through a link, we note the code on your order so the promoter can be paid. Legal basis: the affiliate agreement (Art. 6(1)(b)), our accounting duties (Art. 6(1)(c)) and, for buyers, our legitimate interest in paying the people who recommend us (Art. 6(1)(f)). Commission and payout records are accounting records; a rejected application is deleted straight away.
  • Payments: handled by Stripe. We receive the payment status, amount and your email, never your card details (Art. 6(1)(b) and our legal accounting duties, Art. 6(1)(c)).
  • Chat assistant and voice search: your messages, and voice recordings (only when you press the mic, max 8 seconds) which are turned into text on our own server and not kept; the text of a voice search is not stored. Used to answer you (Art. 6(1)(f), our interest in helping visitors). Chat messages are deleted automatically after 6 months; if you open a support ticket, your question and email are kept with the ticket so we can follow up.
  • Wolf Shader Kit: when you buy the kit we keep your email, the payment status and your download link to deliver the files and resend the link if you lose it. Each download carries a licence ID worked out from your order, so a copy published without a licence can be traced back to its order. The free demo pages contain a small check: when a copy of a demo runs on another website, it sends us that website's address and the page address, nothing about the person viewing it. We use that only to spot unlicensed copies and do not store it beyond the alert. Legal basis: the contract (Art. 6(1)(b)), our accounting duties (Art. 6(1)(c)) and our legitimate interest in protecting our work (Art. 6(1)(f)).
  • Museum room requests: if you request a room in our 3D museum, your name, work email, company, website (optional) and what you'd like the room to be, so we can reply and set up a call. We don't email you until we reply ourselves. Legal basis: steps before a contract (Art. 6(1)(b)).
  • Course reminders: if you tick "Email me a reminder" in a course, we keep your email, that course, when you last opened it and your next lesson title, and send one short email when you've been away for 3 days (one per break). Legal basis: your consent (Art. 6(1)(a)). Untick the box or use the link in any reminder to stop; finishing the course stops them too.
  • Business outreach: if you run a business, we may note your company name, website, public facts about your homepage (for example whether it works on phones) and a work email address published on your website or given to us, with the page where we found it. We use this to send you a short, relevant offer. Legal basis: our legitimate interest in direct marketing to businesses (Art. 6(1)(f)). Every email has a one-click unsubscribe link; after that, or if you object by email, your address goes on a do-not-contact list and is never used again.
  • Free SEO Audit: when you enter a URL we fetch that public page (and its robots.txt, sitemap, favicon, llms.txt, the http/www versions of the address and up to 20 of its internal links) once as raw HTML and once in a headless browser that loads only what builds the page, never submits forms and sends no cookies. To measure Core Web Vitals we send the page address (only the address, nothing about you) to Google PageSpeed Insights, which loads the page itself. We store the URL, the score and the findings so you can reopen your report by its private link; reports are deleted after 90 days. To unlock the full report you can give your email: we send one confirmation link and, once you click it, add you to our contacts as a lead (not to the newsletter unless you ticked that box, which starts the double opt-in described under Newsletter). Addresses that are never confirmed are removed after 30 days. Legal basis for the email: your request and consent (Art. 6(1)(a) and (b)). Abuse limits use salted hashes of your IP and email address. Legal basis for the audit itself: legitimate interest (Art. 6(1)(f)) in offering a free tool.
  • Spec pages and videos: we may design an example page or hero section for your company and send you a private link to it, usually as a short video with our voice explaining it. The link is not listed or indexed and works for 3 days from when we send it (7 days for older page links). When it is opened we count the visit (first open, number of visits, last visit; no IP address stored), and for a video how far it was played, and note it next to your company in our records. The design itself is our work: if you don't take it, we may show it publicly as a concept, with your logo and name replaced and nothing that identifies your company. The first browser to open the link gets a small necessary cookie with a random code (we keep only a scrambled copy of it) so it can come back. Other browsers are asked for a name and work email: an address on your company's own domain is emailed its own link straight away; any other address is a request we decide on. We note which email opened the page and use it only for that and to email you your link. If you ask for a fresh link, we note that too. The link, its visit counts, browser codes and access requests are deleted 30 days after it closes, or straight away if you unsubscribe or tell us you're not interested; the video with your logo is deleted then too. Legal basis: legitimate interest (Art. 6(1)(f)).
  • Accessibility reports: we may scan your public homepage for accessibility problems and send you a private report link with screenshots of your own page. The link is not listed or indexed. When it is opened we count the visit (no IP address is stored) and note it next to your company in our records. Reports and screenshots are deleted when the link expires (after 45 days), or straight away if you unsubscribe or tell us you're not interested. Legal basis: legitimate interest (Art. 6(1)(f)). If you run the free checker at /tools/wcag yourself, we keep the page address you entered and the report for 30 days, linked to no name or email; legal basis: providing the tool you asked for (Art. 6(1)(b)).
  • Accessibility Hall of Fame: when our scan of a company homepage finds no critical or serious automated accessibility failures, we may list the company name, its domain, a screenshot of its public homepage, the score and the scan date at /museum/hall. We never publish sites that did not pass. We keep the rank of every scanned site privately, to tell a company where it stands. A listing goes when a later scan no longer passes, after 180 days without a new scan, or straight away when the company asks (email us). Legal basis: legitimate interest (Art. 6(1)(f)). If you type an email address when you press "Re-scan my page", we use it for one email with the result and delete it as soon as that email is sent (or the scan fails). Legal basis: your request (Art. 6(1)(b)).
  • Security: a salted hash of your IP address, kept briefly to stop abuse (rate limiting). Legal basis: legitimate interest in protecting the service (Art. 6(1)(f)).

Analytics without cookies

We run our own privacy-friendly analytics. It stores no IP addresses, no browser fingerprints and no cookies. Visits are counted with a hash that changes every day and cannot be linked back to you. We work out your country from your IP address on our own server, using an offline database (IP Geolocation by DB-IP), and store only the country code, never the address or your city. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded. Legal basis: our legitimate interest in understanding how the site is used (Art. 6(1)(f)). You can object at any time with the switch below; your choice is remembered in this browser's local storage (key wa_ignore) and nothing is sent from then on.

Cookies

We make money by selling our own work: websites, landing pages, courses and tools. The data we collect helps us do that. We never sell, rent or share your data with anyone so they can market to you, and we run no third-party ad or tracking scripts.

Strictly necessary cookies, set without asking because the site cannot work without them:

  • wolfitway_session: keeps you logged in, set only after you sign in.
  • wolf_chat_sid: keeps your conversation with the assistant private to your browser, set only when you send a chat message.
  • wolf_consent: remembers your cookie choice below for 180 days, so we don't ask again.
  • Small cookies for a single feature you use, such as your currency choice or access to a private page we sent you.

Referral cookie (only with your OK): when you arrive through a link from one of our affiliates (an address with ?via=), a banner asks whether we may store that affiliate's code in a cookie called wolf_via for 90 days. It holds only their code, nothing about you. If you order a landing page within those 90 days, the order is credited to them and they are paid a commission. Why 90 days: businesses rarely buy a website on the first visit; most compare and come back weeks later, and without the cookie the person who recommended us would not get paid for it. Legal basis: your consent (Art. 6(1)(a) GDPR and the ePrivacy rules on cookies). If you say no, no cookie is stored; an order placed straight from the page the link opened can still carry the code, because it is in the address you opened. You can change your mind any time: .

The cookie banner: on your first visit a banner lets you accept all, keep only necessary cookies, or choose per category (anonymous analytics, referral). Your answer is kept in wolf_consent. Saying no to analytics switches our cookieless counter off for this browser, the same as the opt-out in the analytics section.

Your theme choice and your analytics opt-out are kept in your browser's local storage and are not used for tracking.

Who else processes your data

We use these service providers, under data processing agreements:

  • Hetzner Online GmbH (Germany), which hosts our servers and database in the EU.
  • Resend, to send emails.
  • Stripe, to take payments.
  • Google, only if you choose Google sign-in.
  • AI model providers (such as Anthropic, OpenAI, DeepSeek or OpenRouter), which receive chat messages and the page content of submitted Hero Analyzer audits so they can generate answers and reports. They do not receive your contact details.

Some of these providers are outside the European Economic Area. Transfers are covered by the European Commission's adequacy decisions (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses.

How long we keep it

  • Enquiries, museum room requests and booking details: up to 3 years after our last contact, unless they become part of a contract.
  • Invoices and payment records: 10 years, as Romanian accounting law requires.
  • Newsletter: until you unsubscribe. Sign-ups that are never confirmed are deleted after 30 days.
  • Course waitlists: unconfirmed sign-ups after 30 days; the rest 1 year after the launch email.
  • Page audits: until you ask us to delete them, at most 2 years. Checkouts never paid: 30 days.
  • Business outreach records: up to 2 years after our last contact. The do-not-contact list is kept for as long as we do outreach, so we never write to you again.
  • Affiliate applications: until we decide; rejected ones are deleted at once. Commissions and payouts: 10 years, as accounting records. Daily click totals: as long as the affiliate account exists.
  • Rate-limit records: 2 days.

Your rights

You can ask to see, correct, delete or export your data, restrict or object to processing, and withdraw consent at any time. Email dan@wolfitway.com and we will reply within one month. You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro).

We do not sell your data, ever, and we make no automated decisions that have legal effects on you.