Privacy policy
Last updated: 18 October 2026
Who is responsible
The controller for personal data processed on this website is WOLFITWAYAGENCY S.R.L., Remetea Mare nr. 41, Timiș County, Romania, VAT RO47341942, trade register J35/5748/2022. Contact us about anything in this policy at dan@wolfitway.com.
What we collect and why
- Contact form, project brief and booking: name, email, company and your message or meeting details, so we can reply and run the call. There is no box to tick: sending the form is your request, and we use the details only to answer it (if you also pick products for early access on the contact form, we start the double opt-in described under Newsletter). Legal basis: steps before a contract (Art. 6(1)(b) GDPR).
- Account and sign-in: email, name and, if you use Google sign-in, your Google profile name and picture. Used to log you in and to keep your course enrolments and progress. Creating an account means you accept our Terms. Legal basis: contract (Art. 6(1)(b)).
- Product updates: if you ask to hear when our products ship (on /products), we keep your email and the date you signed up and confirmed. Nothing is sent until you click the confirmation link; after that we email you when a product ships, nothing else. The newsletter is a separate box, never ticked for you. Never confirmed: deleted after 30 days. Legal basis: your consent (Art. 6(1)(a)); leave any time with the link in our emails.
- Course waitlists: if you join the early access list for a course, we keep your email, that course, where you signed up and whether you also ticked the newsletter box (it is never ticked for you). After you confirm by email, we send one email when the course opens. Legal basis: your consent (Art. 6(1)(a)); leave any time with the link in our emails.
- Hero Analyzer: the website address you submit, screenshots and text of that public page, the report, and your email if you unlock or buy the full audit. Used to produce and deliver the audit (Art. 6(1)(b)).
- Report follow-ups: if you tick the follow-up box on a Hero Analyzer or SEO Audit report (it is never ticked for you), we keep your email, that report's website, score and top finding, and send 3 short emails over about 10 days, then stop. They only start after you confirm by email. We count clicks on the links in those emails (no open tracking) and whether you later order a landing page, to see which email helps. Use the stop link in any of them to end it early. Never confirmed: deleted after 30 days; otherwise a year after the last email, or kept with the order if you buy. Legal basis: your consent (Art. 6(1)(a)).
- Landing page orders: when you start a landing page at /landing we keep your email, the website the page is for, your note, where you came from (for example your report) and the payment status, to deliver the page and invoice you. Checkouts never paid are deleted after 30 days; paid orders are kept as accounting records. Legal basis: the contract (Art. 6(1)(b)) and our accounting duties (Art. 6(1)(c)).
- Wolf Sniff browser extension: the extension reads the tab you click its icon on (scripts, styles, meta tags, response headers, the names of cookies, never their values) and works out the technologies inside your browser. Nothing about the pages you check is sent to us; your scan history stays on your device. If you buy Lifetime we keep your email, the payment status and your licence key to send and check the key, plus a random id per browser the key is active in (max 3; no browser details or IP address). The extension contacts wolfitway.com only to check the key, when you enter it and about once a week. Checkouts never paid are deleted after 30 days; paid licences are kept as accounting records and so your key keeps working. Legal basis: the contract (Art. 6(1)(b)) and our accounting duties (Art. 6(1)(c)).
- Payments: handled by Stripe. We receive the payment status, amount and your email, never your card details (Art. 6(1)(b) and our legal accounting duties, Art. 6(1)(c)).
- Chat assistant and voice navigation: your messages, and voice recordings which are transcribed on our own server and not kept. Used to answer you (Art. 6(1)(f), our interest in helping visitors). Chat messages are deleted automatically after 6 months; if you open a support ticket, your question and email are kept with the ticket so we can follow up.
- Museum room requests: if you request a room in our 3D museum, your name, work email, company, website (optional) and what you'd like the room to be, so we can reply and set up a call. We don't email you until we reply ourselves. Legal basis: steps before a contract (Art. 6(1)(b)).
- Course reminders: if you tick "Email me a reminder" in a course, we keep your email, that course, when you last opened it and your next lesson title, and send one short email when you've been away for 3 days (one per break). Legal basis: your consent (Art. 6(1)(a)). Untick the box or use the link in any reminder to stop; finishing the course stops them too.
- Business outreach: if you run a business, we may note your company name, website, public facts about your homepage (for example whether it works on phones) and a work email address published on your website or given to us, with the page where we found it. We use this to send you a short, relevant offer. Legal basis: our legitimate interest in direct marketing to businesses (Art. 6(1)(f)). Every email has a one-click unsubscribe link; after that, or if you object by email, your address goes on a do-not-contact list and is never used again.
- Wolf Pack tool (X): when you enter an X handle (yours, or a second one for a Pack Battle) we fetch that account's public profile and its latest public posts through FxTwitter, a free public service that relays X data. From those we work out a pack, a rank and a profile score, and send them to your browser. The result is held in our server's memory for up to 30 minutes so repeat lookups don't call X again, and is never written to a database. We keep no handles, results or IP addresses; abuse limits use a salted hash of your IP that is deleted within two days. The share card is drawn in your browser. Legal basis: legitimate interest (Art. 6(1)(f)) in offering a free tool built only on public posts. If your account was looked up and you object, email us and we will block your handle from the tool.
- Free SEO Audit: when you enter a URL we fetch that public page (and its robots.txt, sitemap, favicon, llms.txt, the http/www versions of the address and up to 20 of its internal links) once as raw HTML and once in a headless browser that loads only what builds the page, never submits forms and sends no cookies. To measure Core Web Vitals we send the page address (only the address, nothing about you) to Google PageSpeed Insights, which loads the page itself. We store the URL, the score and the findings so you can reopen your report by its private link; reports are deleted after 90 days. To unlock the full report you can give your email: we send one confirmation link and, once you click it, add you to our contacts as a lead (not to the newsletter unless you ticked that box, which starts the double opt-in described under Newsletter). Addresses that are never confirmed are removed after 30 days. Legal basis for the email: your request and consent (Art. 6(1)(a) and (b)). Abuse limits use salted hashes of your IP and email address. Legal basis for the audit itself: legitimate interest (Art. 6(1)(f)) in offering a free tool.
- Spec pages: we may build an example page for your company and send you a private link to it. The link is not listed or indexed and works for 7 days from when we send it. When it is opened we count the visit (first open, number of visits, last visit; no IP address stored) and note it next to your company in our records. The first browser to open the link gets a small necessary cookie with a random code (we keep only a scrambled copy of it) so it can come back. Other browsers are asked for a name and work email: an address on your company's own domain is emailed its own link straight away; any other address is a request we decide on. We note which email opened the page and use it only for that and to email you your link. If you ask for a fresh link, we note that too. The link, its visit counts, browser codes and access requests are deleted 30 days after it closes, or straight away if you unsubscribe or tell us you're not interested. Legal basis: legitimate interest (Art. 6(1)(f)).
- Accessibility reports: we may scan your public homepage for accessibility problems and send you a private report link with screenshots of your own page. The link is not listed or indexed. When it is opened we count the visit (no IP address is stored) and note it next to your company in our records. Reports and screenshots are deleted when the link expires (after 45 days), or straight away if you unsubscribe or tell us you're not interested. Legal basis: legitimate interest (Art. 6(1)(f)). If you run the free checker at /tools/wcag yourself, we keep the page address you entered and the report for 30 days, linked to no name or email; legal basis: providing the tool you asked for (Art. 6(1)(b)).
- Security: a salted hash of your IP address, kept briefly to stop abuse (rate limiting). Legal basis: legitimate interest in protecting the service (Art. 6(1)(f)).
Analytics without cookies
We run our own privacy-friendly analytics. It stores no IP addresses, no browser fingerprints and no cookies. Visits are counted with a hash that changes every day and cannot be linked back to you. If your browser sends Do Not Track or Global Privacy Control, nothing is recorded. Legal basis: our legitimate interest in understanding how the site is used (Art. 6(1)(f)). You can object at any time with the switch below; your choice is remembered in this browser's local storage (key wa_ignore) and nothing is sent from then on.
Cookies
We only set strictly necessary cookies: the session cookie that keeps you logged in, set only after you sign in, and a chat cookie that keeps your conversation with the assistant private to your browser, set only when you send a chat message. Your theme choice and your analytics opt-out are kept in your browser's local storage. None of these is used for tracking, so no consent banner is needed.
Who else processes your data
We use these service providers, under data processing agreements:
- Hetzner Online GmbH (Germany), which hosts our servers and database in the EU.
- Resend, to send emails.
- Stripe, to take payments.
- Google, only if you choose Google sign-in.
- AI model providers (such as Anthropic, OpenAI, DeepSeek or OpenRouter), which receive chat messages and the page content of submitted Hero Analyzer audits so they can generate answers and reports. They do not receive your contact details.
Some of these providers are outside the European Economic Area. Transfers are covered by the European Commission's adequacy decisions (such as the EU-US Data Privacy Framework) or Standard Contractual Clauses.
How long we keep it
- Enquiries, museum room requests and booking details: up to 3 years after our last contact, unless they become part of a contract.
- Invoices and payment records: 10 years, as Romanian accounting law requires.
- Newsletter: until you unsubscribe. Sign-ups that are never confirmed are deleted after 30 days.
- Course waitlists: unconfirmed sign-ups after 30 days; the rest 1 year after the launch email.
- Hero Analyzer audits: until you ask us to delete them, at most 2 years.
- Business outreach records: up to 2 years after our last contact. The do-not-contact list is kept for as long as we do outreach, so we never write to you again.
- Rate-limit records: 2 days.
Your rights
You can ask to see, correct, delete or export your data, restrict or object to processing, and withdraw consent at any time. Email dan@wolfitway.com and we will reply within one month. You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro).
We do not sell your data and we make no automated decisions that have legal effects on you.