Privacy Policy
Last updated: July 24, 2026
Who we are
WCLAW Lab ("we", "us") provides managed website, SEO, social media, and advertising services for small businesses at wclaw.dev/lab. This policy explains what we collect from clients and how we use it.
What we collect
Account details you provide (name, business name, email, phone, website), billing information processed by our payment provider (Stripe — we never store card numbers), service data needed to do the work you hire us for (website analytics, SEO audit results, social content and metrics, advertising account configuration, campaign data, conversion settings, budget authorizations, and provider-reported spend), and access credentials or OAuth tokens you explicitly grant so we can manage your accounts.
How we protect access you grant
Wherever possible we connect to your accounts via each platform's official OAuth flow, which gives us revocable tokens instead of passwords. Any credential you share directly is encrypted with AES-256-GCM before storage, decrypted only server-side to perform work on your behalf, never logged, and deleted when you remove it or end service. You can review supported connected accounts in your dashboard and revoke OAuth access there or from the platform's own security settings.
How we use data
Solely to deliver the services you contracted: running your website, improving your search presence, creating and publishing social content, planning and managing advertising within the limits you approve, and reporting results back to you. We do not sell your data or use it to advertise WCLAW to you on third-party platforms. AI systems we operate process business information to produce and review work for you. We use business/API offerings and do not intentionally submit client data for public model training.
Third parties
We use Stripe (payments), Supabase (database hosting), Vercel (application hosting), Anthropic and OpenAI (AI-assisted work), and the platforms you connect (including Meta, Google, and X). Each processes data under its own terms and privacy policy. Advertising platforms receive campaign, targeting, conversion, and budget instructions only when needed to provide the managed service you authorize.
Data deletion
Email us at the address below to request deletion of your account and associated data. Connected platform access can be revoked from supported dashboard connections or from the platform's own security settings.
Contact
Questions or deletion requests: support@wclaw.dev