Privacy Policy
Effective date:
This policy explains how BigData Boutique ("WarpSearch", "we", "us") handles personal information when you visit warpsearch.io, contact us, or use our hosted search service, console, APIs and MCP integration. Contact us at hello@warpsearch.io with "Privacy" in the subject line.
#Our role and your organization's role
We determine how account administration, website operations, security and business communications work. For that information, we act as the data controller where that concept applies.
Customers decide which documents, vectors, queries and other content to put into their collections ("Customer Data"). When we process personal information in Customer Data on their instructions, we act as a processor or service provider. The customer's policies and any agreed data processing agreement govern that processing. If your information was uploaded by a customer, direct your request to that organization first; we assist it as required by our agreement and applicable law. Your organization may manage your access, see your membership details and revoke your credentials.
#Information we handle
| Information | Sources and purposes |
|---|---|
| Account and organization information | You, your organization administrator or an invitation provide names, work email addresses, organization details, memberships and roles. We use them to create and administer accounts and provide support. |
| Authentication and security information | Password hashes, session records, API-key hashes, verification/reset tokens, sign-in events and IP addresses help authenticate users, enforce access restrictions, investigate abuse and protect the service. Full API keys are shown when issued; protect your copy. |
| Single sign-on information | If you choose an available identity provider, it supplies identifiers, profile information, email addresses and verification information needed for sign-in. We do not receive your provider password. |
| Communications and commercial records | Contact-form fields, correspondence, support requests, plan choices, usage records and, where applicable, invoices and billing contact information help us respond, administer the relationship and charge for services. |
| Service content and usage | Documents, embeddings, queries, results, collection metadata and operational measurements are processed to store, index and search your data, enforce limits, troubleshoot and measure usage. |
| Website and device information | Our infrastructure receives network and request information such as IP address, browser information, requested paths and timestamps. Optional analytics and business visitor identification collect additional visit information only after your choice, as described below. |
An AI agent may send your name and email address to request access on your behalf. We send an approval message, and the person controlling the account must approve the agent's access before it can claim an API key. You can revoke issued keys in the console. If you connect an external agent or coding tool, the information it receives is also governed by its provider and your settings.
We may use your work email's domain and your organization's public website to suggest an organization name. Public demos process the queries you enter; some vector and hybrid demos send query text to an embedding provider through Amazon Bedrock. Do not enter confidential information or personal data into public demos.
Providing information is voluntary, not a legal obligation merely because you visit this site. Without the account details, credentials or information needed for a request, we may be unable to provide the account or respond. Optional tracking is not a condition of using the site or buying the service.
#Why we process information
Where GDPR or similar rules require a legal basis, we rely on the basis appropriate to the activity:
- Contract or requested pre-contract steps: providing an account and subscribed services, responding to a sales request, administering usage and billing.
- Legitimate interests: securing the service, preventing fraud, troubleshooting, managing business contacts and supporting an organization's users, after considering the impact on individuals. You may object where this basis applies.
- Consent: optional website analytics, business visitor identification and any communications that require consent. You can withdraw consent without affecting processing that was lawful before withdrawal.
- Legal obligations: complying with applicable accounting, tax, legal-process and other statutory requirements.
Customer Data is processed to provide and secure the requested service, in accordance with the customer's instructions and agreement. Uploading Customer Data does not grant us a right to sell it or use it to train a general-purpose AI model. We do not use website tracking to make decisions with legal or similarly significant effects about individuals.
#Cookies and your choices
The public website offers equally accessible Reject optional, Accept optional and granular settings. Analytics and business visitor identification are separate choices and start off. We do not load those vendors' tracking scripts, including analytics cookieless pings, before the corresponding choice. Use Cookie settings in the footer at any time to change or withdraw it. Withdrawal reloads the page to stop loaded trackers and removes known accessible first-party tracking identifiers. It does not retroactively erase records already received by a provider; contact us about those records.
| Category | Technology and purpose | Duration / control |
|---|---|---|
| Essential | The __Host-ws_session sign-in cookie authenticates the console. Short-lived sign-in or security state may support identity-provider redirects and anti-abuse checks. | Session cookies are normally valid for up to 7 days, with earlier expiry after inactivity or revocation. Actual sign-in settings may shorten this. |
| Preferences | ws_privacy_v1 in local storage records category choices, their version and the time chosen. Docs navigation uses session storage to remember collapsed sections. | Privacy choices are recognized for 180 days; docs preferences last for the browser tab's session. Clear browser storage to remove them sooner. |
| Optional analytics | Google Analytics 4 receives page-visit, device and interaction information, including signup attempts, rejection categories and completed signups; demo datasets, operation types, timings and result counts; contact-form outcomes and topic categories; and navigation, documentation filtering and example-copy activity. Our explicit event payloads exclude email addresses, names, passwords, raw search text and contact messages. It uses identifiers such as _ga and _ga_*. The page URL supplied by our bootstrap keeps only ad click identifiers (gclid, dclid, gbraid, wbraid) and campaign parameters (utm_source, utm_medium, utm_campaign, utm_id, utm_term, utm_content, utm_adgroup); other query fields and fragments are removed. This lets us measure which campaigns lead to signups. Google Signals and ad-personalization signals are disabled, and the Google tag receives denied advertising consent. Completed signup measurement runs on a public completion page. Signup attempts and failures use a blank public measurement frame; vendor scripts do not load in the console document. | Our tag requests a 90-day, non-renewing cookie lifetime; browsers may shorten it. Enable or withdraw Analytics in Cookie settings. Cookie lifetime is distinct from server-side analytics retention. |
| Optional business visitor identification | Leadfeeder, a Dealfront service, uses network, device and visit information to associate visits with organizations and help us understand business interest. Its identifiers can include _lfa cookies and local storage. It is not loaded on our contact page or in the console. | Controlled by the separate business visitor identification choice. Provider identifier lifetimes depend on its settings; see Leadfeeder's current disclosure. |
| Form security | When configured, Google reCAPTCHA Enterprise evaluates device/browser information and interactions to help distinguish legitimate requests from abuse. It is independent of optional analytics. | Used on protected forms; governed by Google's Privacy Policy and Terms. |
We treat Global Privacy Control and a browser Do Not Track value of 1 as instructions to keep both optional tracking categories off. Settings are specific to a browser; make your choice again on another browser or device. If local storage is unavailable, optional tracking remains off unless you enable it for the current visit. Blocking essential cookies may prevent sign-in. Our public pages use locally hosted fonts; the console currently requests Google Fonts, which sends the usual request information to Google.
#Providers and disclosures
We use providers as needed for hosting, databases, storage, transactional email, security and support. The current implementation uses Amazon Web Services, including SES for email and Bedrock for supported public-demo embeddings; Google for optional Analytics, configured reCAPTCHA and console fonts; and Dealfront for optional business visitor identification. Available Google, Microsoft or GitHub sign-in options involve the provider you select. Those providers' own services are also subject to their privacy notices. A signed deployment agreement may specify different infrastructure or a bring-your-own-cloud arrangement.
We may disclose information to personnel and professional advisers who need it, to comply with a binding legal request, to protect rights or investigate security incidents, or as part of a proposed corporate transaction subject to appropriate safeguards. Organization administrators and third-party integrations receive information as described above or as you authorize.
We do not sell Customer Data. Optional visitor-identification or analytics disclosures can be treated differently under regional definitions of "sale", "sharing" or targeted advertising. Both categories are opt-in and can be refused through Cookie settings, and we honor the privacy signals described above. Contact us to exercise any additional applicable opt-out rights.
#Locations and international transfers
We and our providers may process information outside your country, including in Israel, the United States and other locations where the selected services operate. Your deployment location does not necessarily determine the location of account administration, support or third-party website processing. Contact us before sending data subject to a residency requirement.
Where a transfer is restricted by applicable law, an appropriate transfer mechanism must be in place, such as an applicable adequacy decision or contractual safeguards. Ask us about the mechanism and safeguards relevant to your deployment. This notice is not a data processing agreement or a claim that a particular certification or transfer agreement covers every service. Customers that require a DPA or specific international-transfer terms should arrange them with us before uploading regulated personal data.
#Retention and security
We keep information for the purposes described above, taking account of the account or contract's duration, active support needs, security investigations, deletion requests and applicable legal recordkeeping or dispute requirements. Customer content follows the customer's instructions, plan lifecycle and agreed deletion terms. The pricing documentation explains free-tier inactivity deletion; keep an independent copy of important data.
Closing an account does not necessarily erase invoices, records required by law, security records needed to protect others or backup copies immediately. Where backup or archived copies must remain temporarily, access and use remain limited to the reason for keeping them. Contact us for the retention and deletion terms relevant to a specific dataset or contract; we do not represent one universal retention period for all records.
Our safeguards include encrypted HTTPS connections, password hashing, scoped credentials, access controls and measures against abuse. No system is completely secure. Please report suspected incidents to hello@warpsearch.io, without including passwords, API keys or unnecessary personal information. We handle legally required incident notifications under applicable law and agreements; this page is not a security certification.
#Your rights
Depending on the law that applies and its exceptions, you may request access, a copy, correction or deletion of personal information, restriction or objection to processing, portability, withdrawal of consent or an opt-out from certain disclosures. Israeli law provides rights of access and correction in applicable circumstances. EEA and UK residents may also complain to their local data protection authority. California residents, where applicable law covers the processing, may exercise rights to know, access, correct, delete and opt out of sale/sharing, without unlawful discrimination. We honor applicable requests regardless of the label used in your message.
Email hello@warpsearch.io with the account address and enough detail to identify the request. We may ask for proportionate verification or evidence that an agent is authorized; do not send identification documents unless requested. We respond within the period required by applicable law and explain any lawful exception. Where we act for a customer, we refer or assist the request through that customer. If a marketing message is unwanted, use its unsubscribe method or contact us; essential service and security messages may still be needed.
#Children and changes
WarpSearch is intended for business and professional use by adults, not directed to children. Do not knowingly provide children's information through account registration or public demos. Contact us if you believe such information was supplied improperly.
We may update this notice to reflect changes in the service or requirements. The effective date identifies the current version. For material changes, we provide additional notice where required, and seek fresh consent where necessary rather than treating continued browsing as consent to optional tracking. The Terms of Service govern use of the service.