Legal, Privacy & Compliance

Transparent terms, ephemeral screenshot processing, zero-tracker cookies, and enterprise encryption.

Terms of Service

Last updated: September 23, 2026 • Effective immediately

These Terms of Service ("Terms") constitute a legally binding agreement between you ("User," "you," or "your") and DW Group LLC ("DW Group," "we," "us," or "our"), a limited liability company organized under the laws of the State of Maryland, United States.

These Terms govern your access to and use of isUserFriendly (accessible at https://isuserfriendly.com), as well as any associated software products, APIs, client applications, and Software-as-a-Service (SaaS) platforms operated by DW Group LLC (collectively, the "Services").

Covered Products & Services

These Terms apply to all websites, web applications, client portals, APIs, and SaaS products owned and operated by DW Group LLC, including but not limited to:

DW Group LLC: https://dwgroupllc.com
is UserFriendly: https://isuserfriendly.com
Stargazing Sites: https://stargazingsites.com

1. Agreement to Terms

By accessing, browsing, registering for an account on, or using our Services, you acknowledge that you have read, understood, and agree to be bound by these Terms and our Privacy Policy. If you do not agree with any part of these Terms, you must not use or access our Services.

2. Eligibility & User Accounts

To access certain features of our SaaS products, you may be required to register an account. By registering:

You represent that you are at least 18 years old or the age of majority in your jurisdiction.
You agree to provide accurate, current, and complete registration information.
You are solely responsible for maintaining the confidentiality of your login credentials and for all activities that occur under your account.
You must immediately notify us at support@isuserfriendly.com upon discovering any unauthorized access, compromise of credentials, or other security breach.

3. Third-Party Authentication & Bring Your Own Key (BYOK) Inference

Our Services may allow you to register, log in, or link your account using third-party single sign-on authentication services, specifically Google Sign-In and Google OAuth 2.0, as well as integrate your own third-party API credentials.

Compliance with Google Terms: When using Google OAuth to access our Services, you agree to comply with Google’s Terms of Service and Privacy Policy in addition to these Terms.
Authentication Responsibility: You are responsible for ensuring that the Google Account linked to your profile remains secure and authorized by you.
Revocation of Access: You may disconnect or revoke our access to your Google Account at any time via your Google Account Permissions Manager. Note that revoking authentication tokens may limit or prevent your ability to sign in to certain features of our SaaS applications.
Bring Your Own Key (BYOK) Inference: When configuring or utilizing Bring Your Own Key (BYOK) features within our SaaS applications, APIs, or developer tools (such as Google Gemini, OpenAI, Anthropic, or other third-party provider keys), all inference costs, API calls, and token consumption are billed directly to your respective third-party provider account. Our Services act strictly as an orchestration proxy and do not charge markup fees on your direct third-party token usage. You are solely responsible for managing, securing, and monitoring your third-party API keys and associated usage billing.
Independent Services: Third-party services (such as Google Cloud, AI model providers, database hosts, or email providers) are operated independently. DW Group LLC is not responsible for any downtime, outages, rate limits, or modifications implemented by such third-party providers.

4. Acceptable Use Policy

You agree to use our Services only for lawful purposes and in accordance with these Terms. You agree not to:

Reverse Engineer: Decompile, disassemble, reverse engineer, or attempt to derive the source code or underlying algorithms of our Services.
Vulnerability Testing: Probe, scan, or test the vulnerability of any system, network, or authentication layer without express written authorization from DW Group LLC.
Disrupt Operations: Introduce viruses, worms, Trojan horses, logic bombs, denial-of-service attacks, or other malicious or technologically harmful materials.
Automated Scraping: Use automated scrapers, spiders, or bots to harvest data from our Services without written permission.
Authorized Auditing & Scanning: When utilizing automated audit, diagnostic, evaluation, CLI, or web scanning features (such as on isUserFriendly), you represent and warrant that you only submit URLs and domains that you own, operate, or have express permission to evaluate. You agree not to use our Services for distributed denial-of-service (DDoS), credential scraping, unauthorized vulnerability exploitation, or bypassing robots.txt directives that explicitly prohibit automated auditing.
Unlawful Activities: Violate any applicable federal, state, local, or international law or regulation.

5. Intellectual Property Rights

All rights, title, and interest in and to the Services—including all software, source code, databases, user interfaces, visual design, domain names, logos, and documentation—are and will remain the exclusive property of DW Group LLC and its licensors.

Subject to your compliance with these Terms, DW Group LLC grants you a limited, non-exclusive, non-transferable, revocable license to access and use the Services for your personal or internal business purposes in accordance with your subscription plan or agreement.

6. Subscriptions, Fees & Billing

Certain SaaS products and software features are offered on a paid subscription or fee-per-use basis:

Billing: Fees are billed in advance on a recurring monthly or annual schedule as specified during checkout.
Payment Processors: We use reputable third-party payment processors (e.g., Stripe). By submitting payment details, you authorize us and our processors to charge all applicable fees.
Cancellations: You may cancel your subscription at any time through your account dashboard. Cancellation takes effect at the end of the current billing cycle. Unless otherwise specified in a written agreement, fees paid are non-refundable.

7. Suspension & Termination

We reserve the right, in our sole discretion and without prior notice or liability, to suspend, terminate, or restrict your access to all or part of our Services if we determine that you have violated these Terms, engaged in fraudulent or abusive activities, or posed a security risk to other users or our infrastructure.

Upon termination, all licenses granted to you under these Terms will immediately cease, and you must discontinue all use of the Services.

8. Disclaimer of Warranties ("AS IS")

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, THE SERVICES ARE PROVIDED ON AN "AS IS" AND "AS AVAILABLE" BASIS, WITH ALL FAULTS AND WITHOUT WARRANTIES OF ANY KIND, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE. DW GROUP LLC EXPRESSLY DISCLAIMS ALL WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, QUIET ENJOYMENT, AND NON-INFRINGEMENT. WE DO NOT WARRANT THAT THE SERVICES WILL BE UNINTERRUPTED, TIMELY, SECURE, OR ERROR-FREE, OR THAT ANY DEFECTS WILL BE CORRECTED.

Diagnostic Assistance & Non-Certification Disclaimer

Certain Services provide heuristic usability scores, performance metrics, and automated accessibility evaluations (such as WCAG checks). These scorecards, diagnostic metrics, and automated recommendations serve strictly as diagnostic assistance and educational guidance on an "as-is" basis. THEY DO NOT CONSTITUTE FORMAL LEGAL, REGULATORY, OR ACCESSIBILITY COMPLIANCE CERTIFICATION (INCLUDING UNDER ADA TITLE III, WCAG 2.1/2.2 AA, SECTION 508, OR THE EUROPEAN ACCESSIBILITY ACT). DW Group LLC makes no representation or warranty that implementing recommendations will ensure regulatory compliance or protect your organization against litigation or enforcement actions.

9. Limitation of Liability

TO THE FULLEST EXTENT PERMITTED BY APPLICABLE LAW, IN NO EVENT SHALL DW GROUP LLC, ITS MEMBERS, MANAGERS, OFFICERS, EMPLOYEES, AFFILIATES, OR LICENSORS BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, PUNITIVE, OR EXEMPLARY DAMAGES, INCLUDING LOSS OF PROFITS, DATA, USE, GOODWILL, OR BUSINESS INTERRUPTION, ARISING OUT OF OR IN CONNECTION WITH YOUR USE OF OR INABILITY TO USE THE SERVICES.

IN NO EVENT SHALL OUR TOTAL CUMULATIVE LIABILITY EXCEED THE GREATER OF ONE HUNDRED UNITED STATES DOLLARS ($100.00 USD) OR THE AMOUNT ACTUALLY PAID BY YOU TO DW GROUP LLC IN THE TWELVE (12) MONTHS PRECEDING THE EVENT GIVING RISE TO LIABILITY.

10. Indemnification

You agree to defend, indemnify, and hold harmless DW Group LLC, its officers, directors, members, employees, contractors, and agents from and against any and all claims, liabilities, damages, losses, costs, or expenses (including reasonable attorneys' fees) arising out of or related to your breach of these Terms, your use or misuse of the Services, or your violation of any rights of a third party.

11. Governing Law & Jurisdiction

These Terms and any disputes arising out of or related to them shall be governed by and construed in accordance with the laws of the State of Maryland, United States, without giving effect to any principles of conflicts of law.

You irrevocably consent and submit to the exclusive personal jurisdiction and venue of the state and federal courts located within the State of Maryland for the resolution of any dispute or lawsuit arising under these Terms.

12. Contact Information

If you have any questions or comments regarding these Terms of Service, please contact us:

DW Group LLC
State of Maryland, United States Email: legal@dwgroupllc.com Website: https://dwgroupllc.com

Privacy Policy

Last updated: September 23, 2026 • Effective immediately

This Privacy Policy applies to DW Group LLC ("DW Group," "we," "us," or "our"), a Maryland limited liability company, and covers our websites, software tools, client portals, and Software-as-a-Service (SaaS) applications, including isUserFriendly (accessible at https://isuserfriendly.com).

We respect your privacy and are committed to protecting your personal information. This policy explains what information we collect when you visit our sites, use our software, or authenticate via third-party identity providers such as Google OAuth, how that data is used and protected, and your rights regarding your personal data.

Covered Products & Services

This Privacy Policy applies to all websites, web applications, client portals, APIs, and SaaS products owned and operated by DW Group LLC, including but not limited to:

DW Group LLC: https://dwgroupllc.com
is UserFriendly: https://isuserfriendly.com
Stargazing Sites: https://stargazingsites.com

1. Introduction & Scope

This Privacy Policy governs the collection, use, retention, and disclosure of information gathered through DW Group LLC digital products and services. By accessing or using our Services, you consent to the practices described in this Privacy Policy.

2. Google OAuth & Authentication Services

Some of our SaaS products and digital platforms utilize Google Sign-In and Google OAuth 2.0 to provide seamless, secure account registration and single sign-on (SSO). When you choose to authenticate using your Google Account, we request access only to the minimal necessary scopes required to verify your identity and manage your product session.

Data Received from Google

Basic Profile Information: Your unique Google User ID, full name, and profile avatar URL (used to identify you within the application interface).
Primary Email Address: Used for account creation, critical system notices, transactional emails, and authentication validation.
Authentication Tokens: Secure OAuth access and refresh tokens used solely to validate active sessions and communicate with authorized endpoints.

Google API Services User Data Policy Compliance (Limited Use)

DW Group LLC's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements:

We do not sell, rent, or trade Google user data to third parties.
We do not allow human review of your private Google user data unless required to resolve security incidents, comply with applicable law, or when explicitly requested by you for technical troubleshooting.

3. Information We Collect

In addition to authentication data, we may collect the following categories of information:

User-Provided Data: Form submissions, project inquiries, support requests, and billing information (processed securely through PCI-DSS compliant third-party payment gateways such as Stripe; we do not store raw credit card numbers).
Diagnostic & Audit Inputs: Target URLs submitted for automated analysis, evaluation logs, and structured diagnostic scorecards.
Ephemeral In-Memory Visual Processing: During automated visual audits (such as on isUserFriendly), our headless browser engine captures in-memory viewport snapshots exclusively to execute visual AI evaluation. These image buffers are held strictly in volatile RAM within edge workers (e.g., Cloudflare Workers) and are immediately discarded and garbage-collected upon audit completion. We do not save, store, sell, or retain any audited website screenshots.
Technical & Log Data: Internet Protocol (IP) addresses, browser type, operating system, referring URLs, timestamps, and page request metadata collected automatically for security monitoring, fraud prevention, and performance diagnostics.
Application Usage Data: Feature interactions and error traces within our SaaS applications to troubleshoot bugs and optimize user workflows.

4. How We Use Your Information

We collect and process personal information strictly for legitimate business and operational purposes, including:

Provisioning, maintaining, and improving our software, SaaS tools, and consultancy services.
Authenticating user credentials and verifying authorized access to protected features.
Sending transactional communications, such as security alerts, billing invoices, system updates, and responses to support inquiries.
Detecting, preventing, and mitigating security threats, abuse, spam, fraud, or violations of our Terms of Service.
Complying with applicable legal and regulatory obligations.

5. Data Sharing & Infrastructure Sub-processors

We do not sell, rent, or monetize your personal information under any circumstances. We disclose data only in the following limited situations:

Trusted Infrastructure Providers (Sub-processors): Sub-processors who host our applications and databases under strict data protection and confidentiality agreements:
- Cloudflare: Global edge network, DDoS mitigation, DNS routing, compute workers, and headless browser rendering.
- Neon Postgres & Supabase: Encrypted relational database storage and backend infrastructure.
- Google Cloud Platform: Cloud compute, identity verification (Google Sign-In), and storage infrastructure.
- Stripe: PCI-DSS Level 1 certified payment processing (we never store raw payment card data).
Legal & Regulatory Compliance: When compelled by valid legal processes (such as court orders, subpoenas, or statutory mandates) or to defend our legal rights.
Business Transfers: In the event of a merger, acquisition, reorganization, or sale of company assets, user data may be transferred as an operational asset subject to the protections of this Privacy Policy.

6. Data Security & Retention

We apply defensive security engineering practices to protect your data against unauthorized access, disclosure, alteration, and destruction. All data in transit is encrypted using modern TLS (Transport Layer Security) protocols, and sensitive data at rest is encrypted using industry-standard AES-256 encryption. We enforce least-privilege access controls across all infrastructure.

API Key & Secret Cryptography

For services supporting user-supplied credentials or Bring Your Own Key (BYOK) integrations, all provider API keys are encrypted at rest using authenticated AES-256-GCM encryption with unique per-key initialization vectors (IVs). Encryption keys reside exclusively in secure runtime environment secrets and are never exposed to client browsers or third-party log aggregators.

Retention & Purging Protocols

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy, provide our services, maintain auditable records, and comply with statutory obligations. When an account is terminated, data is securely purged or anonymized in accordance with our deletion protocols.

7. Your Rights, Data Deletion & Revoking Google Access

You retain full control over your personal data. Depending on your jurisdiction (including the European Economic Area, United Kingdom, California, and Maryland), you may have the right to request access to your data, request corrections to inaccurate information, or request full deletion of your account and personal records.

Requesting Account & Data Deletion

To delete your account and remove all personal information collected by our SaaS applications, please send an email to privacy@dwgroupllc.com (or support@isuserfriendly.com) with the subject line "Data Deletion Request". We process verified requests within 30 days.

Revoking Google Account Access

You may revoke DW Group LLC's access to your Google Account at any time directly through Google's Account Permissions Manager.

8. Cookies & Client Storage Policy

Under the European Union ePrivacy Directive (Directive 2002/58/EC as amended) and GDPR (Regulation (EU) 2016/679), consent banners are mandatory strictly for non-essential tracking technologies. DW Group LLC platforms exclusively utilize strictly necessary cookies and functional local storage required to provide the services requested by the user:

Identifier / Key	Mechanism	Duration	Classification & Purpose
Authentication Session	HTTP-Only Cookie	Session / 30 Days	Strictly Necessary: Authenticates active user session and protects against CSRF.
UI & Hydration Cache	HTML5 `localStorage`	Persistent / Session	Strictly Necessary: Prevents UI layout shift and provides zero-flash hydration.
Audit / Report Cache	HTML5 `localStorage`	Local Storage	Functional: Stores recent diagnostic reports locally in browser memory for instant retrieval.
Security Tokens (`__cf_bm`, `cf_clearance`)	First-Party Cookie	Up to 30 min	Strictly Necessary: Cloudflare edge bot protection, rate-limit defense, and DDoS mitigation.

Because we operate zero third-party advertising trackers (no Meta Pixel, TikTok, or Google Ads tags), zero cross-site profiling beacons, and zero data-broker synchronization, an intrusive cookie consent banner is neither legally required nor displayed on our platforms.

9. Children's Privacy

Our websites, software, and services are not directed to individuals under the age of 16, and we do not knowingly collect personal information from children. If we become aware that a child under 16 has provided us with personal information without parental consent, we will promptly delete such information.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect modifications in our services, technical infrastructure, or legal obligations. We will notify users of material modifications by updating the "Last Updated" date at the top of this page. We encourage you to periodically review this page.

11. Data Processing Addendum (DPA) Terms

For enterprise customers subject to the European General Data Protection Regulation (GDPR) or California Consumer Privacy Act (CCPA/CPRA), this section outlines our standard technical processing terms:

Data Controller: Customer submitting URLs, user accounts, or proprietary credentials.
Data Processor: DW Group LLC.
Authorized Sub-processors: Cloudflare (Edge compute & Browser Rendering), Neon Postgres / Supabase (Encrypted Relational Storage), Stripe (Payments).
Data Locations: Multi-region edge locations within the United States and European Union.
Security Controls: TLS 1.3 encryption in transit, authenticated AES-256-GCM encryption at rest, strict role-based access control (RBAC), and principle of least privilege.

12. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

DW Group LLC
State of Maryland, United States
Email: privacy@dwgroupllc.com
Website: https://dwgroupllc.com

Cookies & Client Storage Disclosure

Compliant with EU ePrivacy Directive (Directive 2002/58/EC) and GDPR (Regulation (EU) 2016/679).

Under the European Union ePrivacy Directive and GDPR, consent banners are mandatory strictly for non-essential tracking technologies. isUserFriendly exclusively utilizes strictly necessary cookies and functional local storagerequired to provide the service requested by the user. Because we operate zero advertising networks, third-party analytics trackers, or cross-site profiling beacons, an intrusive cookie banner is neither legally required nor displayed.

Identifier	Mechanism	Duration	Classification & Purpose
iiu.session_token	HTTP-Only Cookie	30 Days	Strictly Necessary: Authenticates active user session and protects against CSRF.
uf_session_cache	HTML5 localStorage	Session / Persistent	Strictly Necessary: Eliminates UI flash during client hydration and caches session status locally.
iuf_audits_cache	HTML5 localStorage	Local Cache	Functional: Stores recent audit reports locally in browser memory for instant retrieval.
__cf_bm / cf_clearance	First-Party Cookie	Up to 30 min	Strictly Necessary: Cloudflare edge bot protection, rate-limit defense, and DDoS mitigation.

Architectural Security Guarantees

Ephemeral In-Memory Screenshots

During an audit, our headless browser captures in-memory viewport snapshots exclusively to execute visual AI evaluation. These buffers reside in volatile Cloudflare Worker RAM and are unconditionally discarded upon audit completion. We do not store or sell website screenshots.

AES-256-GCM Key Encryption

All Bring-Your-Own-Key (BYOK) AI provider keys (Gemini, OpenAI, Anthropic) are encrypted at rest using AES-256-GCM authenticated encryption with unique initialization vectors. Decryption occurs only at execution runtime and keys are never exposed in browser payloads.