Last updated: April 11, 2026
This policy describes how DiffiWeb collects, uses, and protects your personal information. We are committed to transparency and your right to privacy.
DiffiWeb ("we", "our", or "us") operates the website diffiweb.com and provides an agentic intelligence platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you access or use our Service.
Please read this policy carefully. By using DiffiWeb you agree to the practices described here. If you do not agree, please discontinue use of the Service.
Account Information
When you register, we collect your email address and a hashed version of your password. We never store your password in plain text. We do not collect your full name, phone number, or payment details unless explicitly required for a feature.
Usage Data
We automatically collect information about how you interact with the Service, including: pages visited, features used, agent run configurations (target URLs and queries), items extracted and saved, and timestamps of activity. This data is associated with your user account.
Intelligence Data You Create
When you run agents, the extracted data (tender records, stock signals, research papers, vulnerability findings, etc.) is stored in our vector database under your unique user ID. This data is fully isolated — no other user can view or query it.
Cookies & Session Tokens
We use a single HTTP-only session cookie ("auth_session") to keep you logged in. This cookie is encrypted, scoped to diffiweb.com, and expires after 7 days of inactivity. We do not use third-party advertising cookies.
Analytics
We use Vercel Speed Insights (a first-party analytics tool) to collect aggregated, anonymised performance metrics. No personally identifiable information is sent to Vercel via this tool.
We use the information we collect to:
We do not sell your personal data to third parties. We do not use your data to train AI models without your explicit consent.
Storage Infrastructure All user data is stored in: • Upstash Redis — session tokens, watchlist data, and key-value cache. Data is encrypted at rest and in transit. • Upstash Vector — intelligence items extracted by your agents, indexed by semantic embedding for search. Data is partitioned by user ID.
Both services are SOC 2 compliant and host data in secure cloud infrastructure.
Retention
Account data is retained as long as your account is active. Intelligence items in your Vault are retained indefinitely until you delete them or close your account. Session tokens expire after 7 days of inactivity.
Security Measures We implement the following security controls: • HTTP-only, Secure cookies with CSRF synchronisation tokens • HTTPS enforced across all routes (HSTS with 1-year max-age) • Content Security Policy (CSP) headers on all responses • SSRF protection on all agent stream endpoints • X-Frame-Options and X-Content-Type-Options headers • All API endpoints require authentication where applicable
Despite these measures, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.
DiffiWeb integrates with the following third-party services to operate the platform:
| Service | Purpose | Data Shared |
|---|---|---|
| Upstash | Vector database and Redis cache | User ID, extracted intelligence data |
| Vercel | Hosting and edge deployment | Server logs, anonymised analytics |
| Resend | Transactional email delivery | Email address (for password resets only) |
| Yahoo Finance API | Real-time stock quote data | No personal data sent |
Each of these providers has their own privacy policy and security practices. We encourage you to review them if you have concerns about data handling.
DiffiWeb agents may visit third-party websites on your behalf to extract publicly available information. We do not share your personal information with the websites our agents visit.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, email us at swapwarick@diffiweb.com. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.
GDPR (EU/EEA Users): We process personal data on the legal basis of contract performance (operating the Service for registered users) and legitimate interests (security and fraud prevention).
CCPA (California Residents): You have the right to know, delete, and opt out of the sale of personal information. We do not sell personal information.
DiffiWeb is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us at swapwarick@diffiweb.com and we will delete the information promptly.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last Updated" date at the top of this page and, where appropriate, notify registered users by email.
Your continued use of the Service after any changes constitutes your acceptance of the updated policy. We encourage you to review this page periodically.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: swapwarick@diffiweb.com Support: swapwarick@diffiweb.com Website: https://www.diffiweb.com
We aim to respond to all privacy-related enquiries within 5 business days.
We are happy to clarify anything in this policy or assist with data requests.