Last updated: 2026-10-13
1. Вступ
Websta OÜ (“Websta”, “we”, “us”, or “our”) is a private limited company registered in Estonia, operating a local skills marketplace under the slogan “Connecting Communities”. We help service providers publish professional profiles at personal subdomains on websta.bio and help clients discover and book those services.
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and the rights you have under the EU General Data Protection Regulation (“GDPR”) and Estonian data protection law. It applies to our websites, our mobile applications, and all related services (together, the “Services”).
If anything in this policy is unclear, please contact our Data Protection Officer at dpo@websta.ai.
2. Інформація, яку ми збираємо
We only collect data that is necessary to operate the Services, keep them secure, and improve them over time. Depending on how you use Websta, we may collect the following categories of information:
Account information
- Name, email address, and (optionally) phone number.
- Authentication data such as hashed passwords, OAuth identifiers, and session tokens.
- Preferred language, time zone, and notification settings.
Profile and service content
- Profile photos, gallery images, videos, biographies, and service descriptions.
- Service categories, pricing, availability, and booking rules that you configure.
- Location information (city, region, country) that you publish on your profile.
Booking and transaction data
- Booking requests, messages between providers and clients, and booking status.
- Billing details (company name, VAT number, address) needed to issue invoices under Estonian accounting law.
- Payment identifiers handled by Stripe. We never store full card numbers on our servers - Stripe returns only a tokenised reference.
Usage and device data
- IP address, browser type, operating system, device identifiers, and crash logs.
- Pages visited, features used, search queries, and clickstream events.
- Referrer URLs and campaign parameters when you arrive from marketing links.
Communications
- Emails, support tickets, and in-app messages you send us.
- Feedback, survey responses, and testimonials you voluntarily provide.
3. Профілі з комерційного реєстру
Some provider profiles on Websta were not created by the person they describe. We build them from the public records of the Estonian e-Business Register (e-äriregister) so that someone searching for a plumber, a gardener or a hairdresser in their area can find the people who are registered to do that work. If this applies to you, you did not sign up and we want you to know exactly where the entry came from and how to end it. This section is our notice to you under Article 14 of the GDPR.
What we take, and from where
- Source: the public records of the Estonian e-Business Register.
- Fields: registered name, registry code, legal form, field of activity (EMTAK), and the contact email, telephone number, website and address published there.
- We do not buy contact lists, scrape social media for contact details, or guess an address from a name.
- Your street address is never shown publicly. A profile page shows the parish or city only, and the distance used for matching is calculated on our servers and not published.
Why, and on what legal basis
We rely on legitimate interests under Article 6(1)(f) of the GDPR. The interest is a working local marketplace: a registered trade is of no use to anyone if the people who need it cannot find it. Because the data concerns a business activity that is already published for exactly this purpose, and because we use it only to connect that activity with demand for it, we consider this a use you would reasonably expect. You can object at any time, and the links below are how.
When we contact you
If you hold an unclaimed register profile, we may contact you by email, and in future by SMS, in these cases and no others:
- A client is asking for you. Someone sent an enquiry through your profile page. We forward it so you can answer; the reply goes straight to them.
- There is work in your trade near you. A client has posted a job that matches the field of activity in your register entry and is within range of the address published there. We tell you about the job, not about ourselves.
- Once, to introduce the platform and to tell you the profile exists, how to take it over and how to remove it.
We do not send you newsletters, product announcements, promotions, digests or reminders to come back. Those go only to people who signed up and asked for them. Job alerts are limited to one message per recipient per week however many jobs match, because a useful alert that arrives too often stops being useful.
How to stop it
- Every message we send you carries a one-click link that deletes the profile and stops all further contact. The link does not expire.
- You can also write to privacy@websta.ai and we will remove the entry.
- Removal is permanent for the contact data: we keep a record that the address asked to be removed, so that a later import of the register cannot put it back. That record is kept for no other purpose.
- If you would rather keep the profile and use it, you can take it over from the link in the message. It then becomes an ordinary account and this section stops applying to you.
4. Як ми використовуємо вашу інформацію
We process personal data only for clearly defined purposes. Specifically, we use your data to:
- Provide the Services - create your account, host your profile, and process bookings.
- Match clients and providers based on search queries, location, and service categories.
- Send transactional communications such as booking confirmations, invoices, and security alerts. These are not marketing messages and you cannot opt out of them while you hold an active account.
- Send marketing communications where you have explicitly opted in. You may unsubscribe at any time via the footer of any such email.
- Measure performance, diagnose bugs, and improve the reliability of the Services.
- Detect fraud, abuse, and violations of our Terms of Service.
- Comply with legal obligations, including Estonian bookkeeping law, tax reporting, and responses to lawful requests from public authorities.
5. Правові підстави для обробки
Under Article 6 of the GDPR we rely on the following legal bases:
- Contract (Art. 6(1)(b)) - processing necessary to provide the Services you request, including hosting your profile and facilitating bookings.
- Consent (Art. 6(1)(a)) - processing where you have given clear opt-in, e.g. marketing emails, analytics cookies, or optional profile features.
- Legitimate interest (Art. 6(1)(f)) - limited processing to secure the platform, prevent fraud, and improve product quality, where those interests are not overridden by your rights.
- Legal obligation (Art. 6(1)(c)) - processing required by Estonian or EU law, such as keeping accounting records for seven years.
7. Міжнародні передачі
Some of our processors are based outside the European Economic Area. Where personal data is transferred to such countries, we rely on the European Commission's Standard Contractual Clauses (“SCCs”) and, where applicable, supplementary safeguards to ensure an essentially equivalent level of protection.
You can request a copy of the relevant transfer mechanism by writing to dpo@websta.ai.
8. Зберігання даних
We keep personal data only as long as we need it:
- Account and profile data: while your account is active, and for up to 30 days after deletion.
- Billing and tax records: seven (7) years after the end of the financial year, as required by the Estonian Accounting Act. Payment transactions themselves are retained by our payment processor (Stripe) per its own retention policy, independent of your Websta account status.
- Security logs: up to 12 months for abuse detection and investigation.
- Marketing consent records: until you unsubscribe, plus three years for proof of consent.
- AI prompt and output logs: up to 30 days, strictly for debugging and abuse prevention.
- Investigation preservation order (“legal hold”).If a competent authority (police, prosecutor, tax authority, data protection inspector) formally requests that we preserve a specific user’s data while an investigation is ongoing, we may suspend the regular 30-day deletion timeline for that user until the investigation is closed. We notify the affected user as soon as we are legally permitted to do so. This applies only to specific accounts under named orders — it is not a blanket retention policy.
9. Ваші права згідно з GDPR
You have strong rights over your personal data. Specifically, you may:
- Request access to the personal data we hold about you.
- Ask us to correct inaccurate or incomplete data.
- Ask us to erase your data where the legal conditions are met (“right to be forgotten”).
- Ask us to restrict or object to certain processing activities.
- Receive a portable copy of your data in a structured, machine-readable format.
- Withdraw consent at any time where processing is based on consent.
- Lodge a complaint with the Estonian Data Protection Inspectorate (“Andmekaitse Inspektsioon”) or your local supervisory authority.
To exercise any of these rights, email dpo@websta.ai. We will respond within one month, as required by Article 12(3) GDPR.
11. Конфіденційність дітей
Websta is not intended for children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a minor, please contact us and we will delete the information promptly.
12. Безпека даних
We take industry-standard technical and organisational measures to protect your data, including TLS encryption in transit, encryption at rest for sensitive fields, role-based access controls, audit logging, and regular backups. No system is perfectly secure, however, and we encourage you to use a strong, unique password and to enable two-factor authentication where available.
13. Зміни до цієї політики
We may update this Privacy Policy from time to time to reflect changes in our Services, our practices, or the law. If we make material changes, we will notify you by email or through an in-app notice at least 14 days before the changes take effect. The “Last updated” date at the top of this page always reflects the latest revision.