Privacy Policy
- Your Bitrix24 webhook URL is used only during your session and is never stored on our servers.
- We do not sell, rent, or share your personal data with third parties for marketing purposes.
- Audit results are generated in-session and are not retained after you close your browser.
- Payments are handled entirely by Stripe - we never see or store your card details.
- We use minimal functional cookies only - no advertising or cross-site tracking.
Who we are
Money Leak Auditor is a product operated by Webbee Limited, a company registered in New Zealand. We provide a Bitrix24 portal audit service accessible at b24audit.com and healthcheck.b24audit.com.
For the purposes of applicable privacy laws (including the New Zealand Privacy Act 2020 and, where applicable, the EU General Data Protection Regulation), Webbee Limited is the data controller.
What data we collect
2.1 Data you provide directly
| Data | Purpose | Stored? |
|---|---|---|
| Bitrix24 webhook URL | Used to call your portal's REST API and retrieve audit metrics | No - session only |
| Industry selection | Used to apply relevant industry benchmarks to your report | No - session only |
| Email address | Required when purchasing a paid report - used to send your receipt and report access link | Yes - for transaction records |
| Intake form responses | Avg deal size, team size, CPL, conversion rate - used to personalise $ estimates in Custom reports | No - session only |
2.2 Data collected automatically
| Data | Purpose | Stored? |
|---|---|---|
| IP address | Security, abuse prevention, and geographic region detection for tax purposes | Temporarily, in logs (30 days) |
| Browser / device type | Service compatibility and performance monitoring | Aggregated, anonymised |
| Page visit timestamps | Basic analytics (pages visited, session duration) | Aggregated, anonymised |
| Payment metadata | Transaction ID, amount, currency - provided by Stripe after payment | Yes - for accounting records |
2.3 Audit data (your Bitrix24 portal)
When you run an audit, our service calls read-only REST API methods on your Bitrix24 portal using the webhook URL you provide. The data returned - including user counts, CRM records, task lists, storage metrics, and channel configurations - is processed in-memory to generate your report.
How we use your data
We process your personal data only for the following purposes:
- Service delivery - running the audit and generating your report
- Payments - processing one-time or subscription payments for paid report tiers
- Transactional communications - sending receipts, report access links, and Tracker subscription renewal notices
- Security & fraud prevention - detecting and preventing abuse of the service
- Legal obligations - complying with applicable laws, including tax and accounting requirements
- Service improvement - aggregated, anonymised analytics to understand how the service is used
We do not use your data for advertising, profiling, or automated decision-making that produces legal or similarly significant effects.
Data we do NOT collect or store
To be explicit about what we do not do:
- We do not store your Bitrix24 webhook token - it is used in-session and immediately discarded
- We do not store CRM records, deal data, contact information, or any business data from your Bitrix24 portal
- We do not store task lists, user names, or employee records from your portal
- We do not write any data back to your Bitrix24 portal - the webhook is used in read-only mode
- We do not sell or rent your personal data to third parties
- We do not use your data to train machine learning models
- We do not run advertising trackers (Google Ads, Meta Pixel, etc.) on our service pages
Third-party services
Stripe (Payment processing)
All payments are processed by Stripe, Inc. When you purchase a paid report, you are redirected to or interact with Stripe's payment interface. Stripe collects and processes your card details directly - we never see, receive, or store your full card number, CVC, or other sensitive payment credentials. Stripe's privacy policy is available at stripe.com/privacy.
Hosting infrastructure
Our service is hosted on cloud infrastructure. Server logs containing IP addresses are retained for up to 30 days for security monitoring and are then permanently deleted.
Email delivery
Transactional emails (receipts, report links) are sent via a third-party email service provider. Your email address is shared with this provider solely for the purpose of delivering your transaction communications.
Analytics
We use Google Analytics (provided by Google LLC) to understand how visitors use our website. Data collected includes pages viewed, time on site, and approximate location - all in anonymised, aggregated form. No personally identifiable information is sent to Google Analytics. Our legal basis for this processing is our legitimate interest in improving the Service (GDPR Article 6(1)(f)). You may opt out via the Google Analytics Opt-out Add-on or by declining cookies when prompted. See Google's privacy policy.
Cookies
We use a minimal set of strictly necessary cookies required for the service to function. We do not use advertising cookies or cross-site tracking cookies.
| Cookie | Purpose | Duration |
|---|---|---|
| session_id | Maintains your audit session between page loads | Session (deleted on close) |
| lang | Stores your language preference (EN/RU/DE/ES) | 30 days |
| report_access | Validates that you have purchased access to a paid report | 7 days |
| _ga, _ga_* | Google Analytics - distinguishes users and sessions for aggregate traffic analysis | 2 years |
You can disable cookies in your browser settings. Disabling the session cookie will prevent the audit from functioning correctly.
Data retention
- Webhook URLs & portal data - not retained; discarded at session end
- Email addresses - retained for the duration of your paid plan plus 2 years for tax and accounting compliance, then deleted
- Payment records - retained for 7 years as required by New Zealand financial reporting laws
- Server access logs - retained for 30 days for security purposes, then deleted
- Aggregated analytics - retained indefinitely in anonymised form
If you request deletion of your personal data, we will comply within 30 days, except where we are required to retain records by law (e.g. payment records for tax compliance).
Your rights
Depending on your location, you may have the following rights regarding your personal data:
- Right of access - request a copy of the personal data we hold about you
- Right to correction - request correction of inaccurate personal data
- Right to erasure - request deletion of your personal data (subject to legal retention requirements)
- Right to restriction - request that we limit how we use your data
- Right to portability - receive your data in a machine-readable format
- Right to object - object to processing based on legitimate interests
- Right to withdraw consent - where processing is based on consent, withdraw it at any time
To exercise any of these rights, contact us at privacy@webbeegroup.com. We will respond within 30 days. We may need to verify your identity before processing your request.
If you are located in the EU/EEA and believe we have not handled your data lawfully, you have the right to lodge a complaint with your national data protection authority.
International data transfers
Webbee Limited is based in New Zealand. New Zealand has been granted adequacy status by the European Commission, meaning personal data may flow from the EU/EEA to New Zealand without additional safeguards under GDPR.
Where data is processed by third-party service providers (such as Stripe) in other jurisdictions, those transfers are governed by Standard Contractual Clauses or equivalent mechanisms as required by applicable law.
Children's privacy
Our service is directed at business administrators and is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. Where the changes are significant, we will notify users who have provided an email address.
Your continued use of the service after the effective date of an updated policy constitutes your acceptance of the revised terms.
Contact us
For any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact: