Pricing
Apps
Log in
Start trial

Privacy Policy

How WEXTL collects, uses, and protects information when you use our website and automation platform.

Effective October 14, 2026

This Privacy Policy describes how MAXMEL Tech ltd. ("we", "us") processes personal information when you visit our websites, create an account, or use WEXTL (the "Service").

This policy does not cover third-party services you connect to your workflows. Those providers have their own privacy practices.

We collect information in three broad categories:

  • Account & profile data — name, email address, organization name, authentication identifiers, and settings you provide.
  • Service data — workflows, run history, credentials metadata, audit events, and content you submit while using the product.
  • Technical data — device/browser type, IP address, log data, cookies, and usage analytics needed to operate and secure the Service.

We use personal information to:

  • Provide, maintain, and improve the Service.
  • Authenticate users, prevent fraud, and enforce our Terms.
  • Bill subscriptions, apply plan limits, and communicate about your account.
  • Measure whether our advertising works — for example, whether a sign-up or purchase came from one of our ads (see "Advertising measurement" below).
  • Respond to support requests and send product notices you cannot opt out of (e.g. security alerts).
  • Send you a few emails to help you get started, and occasional emails about product updates. You can unsubscribe at any time with the link in every email or in Settings → Notifications.
  • Comply with legal obligations and protect our rights.

Where GDPR applies, we rely on contract performance (providing the Service), legitimate interests (security, product improvement, fraud prevention, measuring the effectiveness of our advertising, sending onboarding and product-update emails to people who signed up for the Service), consent (where required for marketing cookies), and legal obligation.

We do not sell your personal information. We share data only with:

  • Infrastructure and subprocessors that help us host, email, bill, or monitor the Service — under contractual confidentiality and security obligations.
  • Connected applications when you configure workflows to send data to them.
  • AI model providers (Anthropic and OpenAI) — when you use our built-in AI features, such as the AI Builder, Fix with AI, Explain this error, or an AI Agent step set to the in-built model, the content you give that feature (your prompt, the workflow data the step processes, error details) is sent to these providers to generate the answer. They process it on our behalf under their commercial API terms, which do not use API data to train their models by default; they may keep it for a limited period for abuse monitoring. If you connect your own AI provider API key instead, that provider processes the data under your own agreement with them.
  • Advertising platforms (Meta and Google) — limited conversion data so they can tell us which ads led to sign-ups and purchases. See "Advertising measurement" below.
  • Authorities when required by law or to protect rights, safety, and security.
  • A successor entity in connection with a merger, acquisition, or asset sale, with notice where required.

When you connect a Google account to WEXTL — for example to use Google Sheets, Google Docs, Google Drive, Gmail, Google Calendar, or other Google products in your workflows — you authorize us through Google OAuth to access specific data in those Google services on your behalf so the automations you configure can run. This section explains how we access, use, store, and share Google user data, and applies in addition to the rest of this Policy.

WEXTL's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

  • What we access — only the scopes you approve on Google's consent screen when you connect an account. We request the minimum scopes needed for the features you enable, such as reading and writing spreadsheets (Google Sheets), reading and creating documents (Google Docs), listing, reading, uploading, and managing files (Google Drive), sending and reading messages (Gmail), or managing events (Google Calendar). The exact scopes are shown to you for approval before any access is granted, and you may connect only the products you intend to use.
  • How we use it — solely to provide the user-facing features you set up in your workflows (for example: read a row, append data, upload or download a file, send an email, create a calendar event) and to show the status of your connections. We do not use Google user data for advertising, and we do not sell it.
  • Artificial intelligence and machine learning — we do not use data obtained through Google Workspace APIs to develop, improve, or train generalized or non-personalized artificial intelligence and/or machine learning models. Google data is used only to run the specific automation you request.
  • How we store it — OAuth access and refresh tokens are encrypted at rest and are used only to make the API calls you initiate or schedule. Google user data passes through the Service to execute a workflow step; any output you choose to save (for example to run history or a downstream app) is stored according to your workflow configuration and retained as described in "Retention". You can delete a stored connection at any time.
  • How we share it — we do not transfer Google user data to third parties except: to the destinations you explicitly configure in your own workflows; to service providers and subprocessors strictly to host and operate the Service under confidentiality and security obligations; when required by law or to protect against imminent harm; or with your consent. Any such transfer is limited to providing or improving the user-facing feature, complying with applicable law, or protecting against security threats.
  • Human access — we do not allow humans to read your Google user data unless: you give explicit consent (for example, to troubleshoot a support issue you raise); it is necessary for security purposes (such as investigating abuse or a security incident); it is required to comply with applicable law; or the data has been aggregated and anonymized and is used only for internal operations.
  • Revoking access — you can disconnect WEXTL at any time from your Google Account permissions page (https://myaccount.google.com/permissions) or by deleting the connection in your WEXTL credential settings. Revoking access stops future API calls, and we delete the associated OAuth tokens.

We retain personal information for as long as your account is active and as needed to provide the Service, comply with law, resolve disputes, and enforce agreements.

Organization owners may export or request deletion of workspace data through in-product controls, subject to legal retention requirements and backup cycles.

We use administrative, technical, and organizational measures designed to protect personal information, including encryption in transit and access controls.

Data may be processed in the region you select for your organization where the product offers regional storage, and otherwise in facilities operated by our subprocessors.

Content you send to our built-in AI features is processed by our AI model providers (Anthropic and OpenAI) in the United States, whatever region your organization uses.

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal information, and to object to certain processing.

You can object to onboarding and product-update emails at any time, and we will stop: use the unsubscribe link in any of these emails or the Product emails switch in Settings → Notifications. Account, billing and security emails are part of the Service and still arrive.

EEA/UK users may lodge a complaint with a supervisory authority. To exercise rights, contact [email protected] or use the data controls in organization settings.

Cookies are small text files stored on your device when you visit our website or use the Service. We use cookies and similar technologies (such as localStorage mirrors) to keep the product secure, remember your preferences, and — only with your consent — understand how the Service is used.

When you first visit our marketing pages, a cookie banner lets you choose Essential only or Accept all. Essential cookies are always set because the Service cannot function without them. Analytics cookies are placed only if you choose Accept all or equivalent consent where required by law.

You can reopen the cookie banner at any time via the cookie icon at the bottom-left of the page to review or change your choice (unless you previously chose Accept all and dismissed the banner entirely).

  • Essential — session & authentication: Better Auth session cookies that keep you signed in across requests. Duration: session or as configured by your browser. Legal basis: contract / legitimate interest (security).
  • Essential — wextl-theme: remembers light or dark theme (wextl-theme cookie and matching localStorage). Duration: 1 year. Legal basis: legitimate interest (preference storage).
  • Essential — wextl-cookie-consent: records whether you chose essential-only or accept-all (wextl-cookie-consent cookie and matching localStorage). Duration: 1 year. Legal basis: legitimate interest (demonstrate consent).
  • Essential — blueprint intent: short-lived cookie used when deploying a workflow from a public share or library link after sign-up (wextl-blueprint-intent). Duration: until consumed or expired. Legal basis: contract (complete your requested action).
  • Advertising measurement — _fbc: stores the Meta ad click identifier (fbclid) when you arrive on our site from a Meta ad, so a later sign-up or purchase can be matched to that ad. Duration: 90 days. Legal basis: legitimate interest (measuring our advertising). See "Advertising measurement" below.
  • Analytics (optional) - Google Analytics 4: set only if you select Accept all on the cookie banner. Used to measure aggregate product usage (e.g. page views, feature adoption). We do not use analytics cookies for advertising. See "Google Analytics" below for details, or withdraw consent by clearing site data or contacting [email protected].

In addition to the in-product cookie banner, most browsers let you block or delete cookies through their settings. Blocking essential cookies may prevent sign-in, break theme persistence, or cause the cookie notice to reappear.

To reset your choice, clear cookies for our domain or use the cookie preferences icon on our public pages, then make a new selection.

We use Google Analytics 4 ("Google Analytics"), a service provided by Google, to understand how visitors use our public website - for example pages visited, approximate location derived from IP address, device and browser type, and referral source - so we can improve it.

Google Analytics is consent-gated: it only runs if you select Accept all in our cookie banner. If you choose Essential only, or take no action, Google Analytics is initialized with analytics storage denied (Google Consent Mode) and does not set analytics cookies or collect identifiable analytics data. We enable IP anonymization and do not use Google Analytics for advertising or ad personalization.

Google processes this data on our behalf, and it may be transferred to and stored by Google. See Google's Privacy Policy (https://policies.google.com/privacy) and "How Google uses information from sites that use our services" (https://policies.google.com/technologies/partner-sites).

  • Change your choice at any time using the cookie banner, or the cookie preferences icon at the bottom-left of the page.
  • Install the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout) to prevent Google Analytics from collecting data in that browser.
  • Use your browser's Do Not Track or cookie control settings. Where you have chosen Essential only, analytics storage stays denied regardless of browser settings.

We advertise WEXTL on Meta (Facebook, Instagram) and Google. To learn which ads lead to real sign-ups and purchases, we tell these platforms when a conversion happens.

When you create an account or start a subscription, our servers send the event to Meta (Conversions API) and Google. The event includes the event type (for example "registration" or "purchase"), the subscription value and currency, a hashed (SHA-256) copy of your email address and account ID, the ad click identifier if you arrived from an ad, your IP address, and your browser user agent. We never send your workflows, credentials, or workflow data.

Meta and Google use this data to match the conversion to an ad and report aggregate results back to us. They process it under their own terms: Meta Business Tools Terms (https://www.facebook.com/legal/businesstech) and Google Ads data processing terms (https://business.safety.google/adsprocessorterms/). See also Meta's Privacy Policy (https://www.facebook.com/privacy/policy) and Google's Privacy Policy (https://policies.google.com/privacy).

You can object to this processing at any time by emailing [email protected]. You can also control how Meta uses off-site activity in your Meta account settings (Off-Facebook activity / Your activity off Meta technologies).

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

We may update this policy from time to time. We will post changes on this page and update the effective date.

Questions: [email protected].