Privacy Policy
- We store your account, the content you give us to build your website, and the enquiries and messages your visitors and customers send you — only to run the Service.
- The websites we publish for you carry no analytics and no tracking, not even ours.
- We don't sell data, show ads, or use your content to train AI models.
- Delete a site yourself in the dashboard, or ask us to delete your whole account: Deleting your data.
1. Who we are
Webyhost is operated by Ibranext Technologies and Consultancy Services FZC-LLC (“Ibranext”, “we”, “us”), the company behind Mukh.one, WriteTone and MetaReply. This policy covers webyhost.mukh1.com, the Webyhost dashboard, the websites and chat widget we serve for our customers, and the messaging channels they connect.
Two roles apply:
- For your account data (your email, billing, settings, the content you give us) we are the controller.
- For the data of your visitors and customers — the people who fill in a form, chat with the assistant on your website, or message your WhatsApp, Instagram or Facebook Page — you are the controller and we process it on your behalf, only to provide the Service. You are responsible for having a lawful basis and for telling them how you use it.
2. What we collect
| Data | Why |
|---|---|
Account: your email, business name, a password hash if you set one, client logins on agency plans, and settings. Passwords are stored only as a salted scrypt hash — we cannot read them. | To run your account and sign you in. |
| Your website content: the description you type or dictate, business details, images, uploaded documents, links you paste, your conversation with the builder, and your site's knowledge base. | To build, host and change your website and its assistant. This is the service. |
| Material you import from a Google Maps, Yelp, Instagram, Facebook or TripAdvisor link, or from your existing website. | To fill in your site with your real business facts instead of inventing them. |
| Your visitors' and customers' enquiries: what they enter in your contact form (name, email, phone, message), their conversations with the assistant on your website or widget, and messages sent to your connected channels with their profile name and ID. Voice notes are transcribed to text. | To answer them as you set up, and to show them to you in your Inbox and Leads. |
| Connected channels: Meta access tokens, app secrets, page, account and phone-number IDs, and the WhatsApp link session. Tokens and secrets are encrypted at rest. | To receive messages and send replies from your accounts. |
| Billing: plan, subscription status, invoices. Card details are handled by Stripe; we store only a customer and subscription reference — never your card number. | To charge for and manage your plan. |
| Usage: how many assistant messages and AI builds you have used, and, only if you switch it on for a channel, how many times a link in a reply was opened. | Your monthly allowance, and your own statistics. |
| Technical: server logs (request path, status, timing, IP address) and cookie-free visit counts on our own pages. | To keep the Service running, prevent abuse and diagnose faults. Secrets are removed from logs before they are written. |
3. How we use it
- To provide the Service: write and host your website, answer your visitors and customers from your knowledge base, deliver their enquiries to you, and show you results.
- To bill you, send sign-in codes, and tell you about problems with your connected channels (for example an expired token).
- To keep the Service secure, prevent abuse, and fix faults.
- To meet legal, tax and accounting obligations.
We do not sell personal data, use it for advertising, or use your or your customers' content to train AI models.
4. Who processes it for us
| Provider | What for |
|---|---|
| Cloud hosting (servers in the United Kingdom) | Running the Service, its database and the websites we host. Building your site also runs on a build machine we operate, reached over a private encrypted network; it does not store what it builds. |
| OpenAI | Answering your visitors and customers, reading the documents and photos you upload, building your site's knowledge base, and transcribing voice notes |
| AI model providers | Writing and editing your website from the material you give us, and standing in for OpenAI when it is unavailable |
| Meta Platforms (WhatsApp, Instagram, Facebook Messenger) | Only if you connect a channel: receiving your customers' messages and sending the replies |
| Stripe | Payments and subscriptions |
| Twilio SendGrid | Sending email: sign-in and password codes, and notices about your channels |
| Google (Places API) and Yelp (Fusion API) | Only the listing link you choose to paste, to read your public business listing |
| Cloudflare | Cookie-free visit statistics on our own pages (section 7) |
| Google Fonts | Serving the fonts on our pages and on the websites we publish |
We may also disclose data if required by law, to protect our rights or users' safety, or to a successor if the business is transferred. Some providers are in other countries, including the United States; where data leaves your country we rely on the provider's contractual safeguards.
5. Who at Ibranext sees your data
Our team does not read your visitors' enquiries, your customers' conversations or your content except when you ask us to (for example in a support request), when needed to investigate a fault, security incident or abuse, or when the law requires it.
6. How long we keep it
- Account, sites, uploaded material, knowledge bases, contact-form enquiries and website assistant conversations: while your account exists, until you delete them or ask us to.
- Messages on a connected channel: the most recent 1,000 per person; older ones are removed automatically. Each channel's event log keeps its most recent 500 entries.
- Short-term records used to recognise our own replies on a channel: 24 hours.
- Sign-in codes: 15 minutes. A sign-in lasts 7 days; expired codes and sign-ins are deleted.
- Voice notes: the audio is processed in memory to transcribe it and is not stored; the text transcript is kept like any other message.
- Database backups: one a night, the last 14 kept, then deleted.
- Billing records: as long as tax and accounting law requires.
7. Cookies, local storage and the websites we publish
Webyhost sets no cookies. Signing in stores a session token in your browser's
localStorage so you stay logged in for up to 7 days; clearing your browser data signs
you out. We do not use advertising or tracking cookies, so we don't show a cookie banner.
Our own pages — this website and the dashboard — use Cloudflare Web Analytics to count visits. It sets no cookie, does not fingerprint your device, does not follow you to other websites, and cannot identify you. It records the page address, where you arrived from, your browser and country, and how quickly the page loaded.
The websites we publish for you contain no analytics and no tracking of any kind — not even ours. The only scripts on your site are the optional chat widget and, if you add an Instagram section, Instagram's official embed. The chat widget keeps a random conversation ID in the visitor's browser so a conversation can continue; it is not used to track anyone. Fonts load from Google Fonts. A map section shows a Google Maps embed and a video section a YouTube (privacy-enhanced mode) or Vimeo player; those load from Google, YouTube or Vimeo when a visitor views them. Measuring your visitors on your behalf without your asking is not ours to do.
If you use the microphone button in the dashboard, your browser's own speech recognition turns your speech into text; we receive only the text.
8. Security
All traffic uses HTTPS. Passwords are hashed with scrypt and never stored in readable
form. Meta access tokens and app secrets are encrypted at rest (AES-256-GCM). The application server
is not directly reachable from the internet — it sits behind a reverse proxy — and administrative
access is by SSH key only. Payment notifications from Stripe are verified before we act on them. No
system is perfectly secure; if a breach affects your data we will tell you without undue delay.
9. Your rights
Depending on where you live (for example under the GDPR or the UAE data protection law), you can ask to access, correct, export or delete your personal data, object to or restrict how we use it, and withdraw consent. You can also complain to your data protection authority. Email mukh1@ibranext.com from your account email; we may need to confirm your identity and will answer within 30 days.
If you are one of our customers' visitors or customers (you filled in a form on, chatted with, or messaged a business that uses Webyhost), please contact that business first — it controls your data. We will help it respond.
10. Deleting your data
Delete one website
- Sign in and open the site from your dashboard.
- Open the Publish tab, click Delete this site and confirm.
This takes the page offline and deletes, in one go, the site and its uploaded material, knowledge base, builder conversation, contact-form enquiries, assistant conversations, and every messaging channel connected to it with its stored tokens, contacts and messages.
Remove one messaging channel
- Open the site and its Channels tab.
- Click Remove next to the channel and confirm.
This disconnects it and deletes its stored tokens, its contacts, their messages and its event log.
Delete your whole account
- Email mukh1@ibranext.com from your Webyhost sign-in email with the subject “Delete my Webyhost account”.
We cancel any paid plan first, then delete everything that belongs to the account in one go: your logins (including client logins), every site and its published files, uploaded material, knowledge bases, enquiries, conversations, connected channels and their tokens. We confirm by email within 30 days, usually much sooner. Copies in our database backups disappear as those backups expire (within 14 days). We keep only what tax and accounting law requires, such as invoices.
Remove Webyhost from Meta as well
Instagram and Facebook channels work through a Meta app that you own. To stop all access on Meta's side, also remove the app's access in your Facebook or Instagram settings (Settings → Business integrations, or Apps and websites), or delete the Meta app in the Meta for Developers dashboard. For a WhatsApp QR link, open WhatsApp on your phone → Linked devices and log the device out.
If you contacted a business that uses Webyhost
The enquiries and messages you sent to that business are its data; Webyhost only processes them for it. Please ask the business directly to delete them. If you can't reach it, email mukh1@ibranext.com with the website address (or the business's Instagram, Facebook or WhatsApp name) and the name or email you used, and we will pass your request on and help it act on it.
11. Children
Webyhost is a business tool for people aged 18 or over. We do not knowingly collect data from children for our own purposes. If you believe a child has given us personal data, contact us and we will delete it.
12. Changes
We will post changes here and update the date above. For material changes we will also tell account holders by email or in the dashboard.
13. Contact
Ibranext Technologies and Consultancy Services FZC-LLC — privacy questions and requests: mukh1@ibranext.com