Privacy Policy

Last updated October 2026

AICOMBase is a service by dudaster.com (“we”). This policy explains what we store when you use it.

1. What we store

Account data (name, email, hashed password, second-factor settings); organization and membership data; per-site connection data (domain, public key, versions, connection state); operational metadata about what AICOM did (sessions, actions, results); monitoring results (availability, response time, SSL); audit results and the evidence needed to explain each finding; and an audit log of control events.

2. What we do not store

We do not receive or store your WordPress password, private keys of your sites, or the content of your database. Passwords, private keys and raw authorization tokens are never written to logs.

3. Audit evidence

Audits fetch public pages of your site and, when you allow it, a limited internal inspection from AICOM. Evidence is kept for the retention period of your plan and then removed.

4. How we use data

To operate the service, show you your sites, send the notifications you choose, protect against abuse and improve reliability. Telemetry choices are available in Settings.

Dudee, the assistant in the corner. In the dashboard he sees which page you are on (the path, never its content or what you type into forms), how long you stay, and a summary of your account (open setup steps, open incidents), so he can help at the right moment; Settings → Data & Privacy says how to pause, hide or reset him. On the public website and the sign-in pages nothing about you reaches him until you open the conversation; from then on a random visitor id is kept in your browser and what you write to him is processed to answer it. To work across pages he keeps a few items in your browser’s storage — his session for the tab, a tutorial in progress, where you moved him, which tips he has already given. No cookies, nothing for analytics or advertising. He runs from our own address (aicombase.com/dudee), with no third-party trackers.

5. AI apps you connect

When you connect an AI app — ChatGPT, Claude, or any other app that uses MCP — by signing it in on our consent screen or with an AI key you make, the app calls AICOMBase’s tools for you. What those tools return (for example the list of your sites, the text of a page the app reads, or what the site checks found) goes to that app and to its provider, such as OpenAI or Anthropic, and is handled there under that provider’s own privacy policy. We don’t send them anything else, and we don’t receive your conversation with the app: only the tool calls it makes, which we record like any other work — the request, the actions, their results and the key used — so you can read and undo them.

When you sign an app in, we keep its registration (the name it gives and the address it returns to), the access you chose (as an AI key: sites, permissions, mode) and its sign-in tokens, stored only as one-way hashes. Access tokens last an hour and are renewed while the app stays connected. Every connected app is listed on the Keys page, where you can change what it may do or disconnect it; access ends at once. Apps that registered but were never approved are deleted after a day.

6. Sharing and processors

Payments. When you buy a plan, Stripe sells it on our behalf through Link, its merchant-of-record service, and processes your payment details and billing address under its own privacy policy. We never see your full card number: we keep the Stripe customer and subscription identifiers, your plan and invoice status, and show the card brand and last four digits in Plan & Usage.

Service providers. We use a small number of providers who process data on our behalf, only to run the service: hosting (our servers are in Romania); email delivery (ZeptoMail, EU region) for account and notification emails; and, only while “Allow AI-assisted interpretation” is on in Settings, an AI provider that receives minimal, redacted facts to classify findings, alerts and tool choices. Dudee, the assistant, runs on our own service. We do not sell personal data and do not use advertising or third-party analytics trackers.

Where a provider processes data outside the European Economic Area, the transfer relies on the safeguards the GDPR provides, such as the European Commission’s standard contractual clauses.

7. Your rights

You have the right to access, correct, export or delete your personal data, to restrict or object to its processing, and to withdraw any consent you gave. The owner of an organization can request removal of the organization and its data in Settings → Data & Privacy; for anything else, write to [email protected]. We answer within one month. You can also complain to the Romanian data protection authority (ANSPDCP, dataprotection.ro) or to the authority where you live.

Why we may process your data. To provide the service you signed up for (your account, sites, monitoring, checks and AI work — performance of a contract, GDPR art. 6(1)(b)); to keep the service and your account secure and prevent abuse (our legitimate interest, art. 6(1)(f)); to keep the records the law requires, such as for billing (legal obligation, art. 6(1)(c)); and, for optional features such as AI-assisted interpretation, your choice in Settings (consent, art. 6(1)(a)), which you can change at any time.

How long we keep it. Account and organization data for as long as the account exists. Operational data, monitoring results and audit evidence for your plan’s history period (30 days on Free, a year on the paid plans). The audit log of control and security events for the life of the organization. After a removal request is confirmed, the organization’s data is deleted, except what the law requires us to keep.

8. Security

Secrets are encrypted at rest, connections use signed requests with short-lived authorizations, and control events are recorded in an immutable audit log.

9. Who is responsible for your data

The controller of the personal data described here is:

LEADPRO SRL · Str. Călugăreni nr. 6, bl. K4, sc. 2, ap. 27, Galați, jud. Galați, Romania
Trade Register no. J17/1164/2005 · EUID ROONRC.J17/1164/2005 · Unique registration code (CUI) 17666870
Email: [email protected]