Privacy policy

1. Who we are

AdCruise (Webbai) (“we”) operates Duelpilot, a service that lets a customer's own AI agent run A/B tests on the customer's website. This policy explains what we process for two groups of people: our customers (people who use the Duelpilot app) and the visitors of our customers' websites.

2. Customers: what we process and why

• Account: your email address, name (if you give it), the organisations and sites you belong to and your role. To let you sign in and to work together.
• Sign-in: one-time sign-in links and a session cookie. We store no passwords.
• Your tests: ideas, variants, comments, approvals and an audit log of who did what. To run the service and keep a record of decisions.
• Connections: if you connect Google Analytics, an encrypted access token and the property you chose, to set up and read your test results. Tokens for your AI agent are stored as a hash only.
• Page snapshots: when your agent inspects or checks your pages, we keep page outlines and screenshots of your own site to show you the variants.

We process this to perform our contract with you and, for security logs, for our legitimate interest in keeping the service safe.

3. Website visitors: what the script does

On your website we act as your processor; you decide whether and when the script runs (for example after cookie consent). The script:

• creates a random visitor id and remembers which variant the visitor was shown, in the browser's own storage (no cookies), so they see the same variant again;
• sends at most a few counting pings per test: “shown variant B”, “converted on goal X”, with the device type and new/returning. These are added to daily totals; we keep no visitor-level records, profiles or session recordings;
• for about 1% of pageviews sends a health ping: the page path, device type, which analytics/consent tools were found and how fast the page was ready;
• passes the variant to the analytics tools you already use (for example Google Analytics), where your own settings apply.

IP addresses are used only briefly: as a salted, shortened hash for rate limiting, and, when a test targets countries, to let our edge provider determine the country. They are not stored with the counts.

4. AI

Duelpilot does not run AI models on your data. Your agents run in your own AI service (for example Claude) and use Duelpilot through its MCP connection; that provider's terms and privacy policy apply to what you share with it. We do not train models on your data. See the AI disclosure.

5. Who we share data with

• Cloudflare: serves the script and previews and keeps the counting totals.
• Google: only if you connect Google Analytics, to set up dimensions and read results.
• Our hosting, database and email providers, under data processing agreements.

We don't sell personal data and don't share it for advertising.

6. How long we keep it

Account and test data for as long as your account exists, then up to 30 days in backups. Counting totals and page snapshots are deleted with the site. Visitors can clear the browser storage at any time; nothing then links them to earlier visits.

7. Your rights

You can ask for access, correction, deletion, restriction, portability or object to processing, and complain to your data protection authority. Visitors of a customer's website should contact that website first; we help our customers answer. Contact: [contact address to be confirmed].