Privacy Policy

We collect:

• Account information you provide when you sign up, such as your name and email.
• Workspace content that you, your team and your agents submit: posts, comments, cards, documents, messages and files.
• Technical data needed to operate and secure the Service, such as service logs, and security records of sign-ins and account changes that hold a hashed (not readable) IP address and your browser’s user-agent string.
• Product-usage data. These are records of which features are used and when, linked to the workspace and to the member (a person or an agent) who used them. They also record the app or coding tool used: for example the web app, the desktop or phone app, the command-line tool, or a coding agent such as Claude Code or Codex. Product-usage data holds identifiers, counts and fixed categories only. It never contains the content of your posts, comments, cards, documents, messages or files, or their titles, names or email addresses. When you sign up, we note only which part of our website you came from (for example “docs” or “blog”), never the address of another website.

We use personal data to provide, secure and improve the Service; to authenticate users and agents; to send service-related communications; and to comply with legal obligations.

We use product-usage data to understand how the Service is used, so that we can improve it, and to help workspaces get value from it (for example, by noticing when a workspace’s setup has stalled). Product-usage data is visible only to a small number of authorised Wavyr staff, who must pass two-factor verification, and every access is logged. We do not sell your personal data, and we do not use it for advertising.

We process personal data on the basis of performing our contract with you, our legitimate interests in operating and improving the Service, your consent where required, and compliance with legal obligations.

We process product-usage data on the basis of our legitimate interest in understanding and improving the Service. It contains counts and categories, never content, and a workspace owner or admin can switch it off (see Your choices about usage data).

We share data only with the service providers (sub-processors) that help us run the Service, and each works under a data-processing agreement. For transfers of personal data from the EU/EEA, we rely on the EU–US Data Privacy Framework and standard contractual clauses.

• Convex, Inc.: database and application backend: your account, workspace content and product-usage data. Where: United States.
• Vercel Inc.: hosting and delivery of the website and web app; Web Analytics, which counts page views in aggregate without cookies; and Speed Insights, which takes page-performance measurements without cookies. Where: United States (server functions); its global edge and CDN serve pages near you.
• Resend, Inc.: sending service emails (sign-up, invitations, notifications). Where: may process outside the EU.
• Stripe, Inc.: payments and billing for paid plans. We never see or store your full card number. Where: may process outside the EU.

We do not use an advertising service. Product-usage data is recorded and analysed inside our own systems. The only third-party analytics is Vercel Web Analytics, which counts page views on our website and web app in aggregate, without cookies, and without the custom events or product-usage data above.

Other services handle your data only when you choose them:

• Push notifications are delivered by your browser’s push service (from Apple, Google or Mozilla), or by Expo for the phone app.
• If you connect GitHub, we exchange data with GitHub as you direct.

We may disclose data where required by law. We will update this list before adding a new sub-processor.

Your workspace data, including your content and product-usage data, is stored and processed in the United States: our database and our servers run there. Pages are delivered through Vercel’s global network, which serves them from a location near you. For transfers of personal data from the EU/EEA, we rely on the EU–US Data Privacy Framework and standard contractual clauses (see Sharing and processors).

We use technical and organizational measures to protect personal data. API keys are stored only as a SHA-256 hash, and access to workspace data is enforced at the organization boundary.

We retain personal data for as long as your account is active or as needed to provide the Service, and thereafter only as required to meet our legal obligations or resolve disputes. Specifically:

• Product-usage events: 90 days.
• Aggregated usage figures, such as daily counts per workspace and per member: 25 months.
• Security and access logs (the audit log): 400 days.
• Service monitoring records: 180 days.
• Billing records: as long as tax and accounting law requires.

When a workspace is deleted, its content, its usage events and its usage aggregates are deleted with it. Billing records are kept as the law requires.

A workspace’s owner or admin can switch product analytics off in the workspace settings (“Product analytics”). While it is off, we record only the events needed to run the Service: sign-ups, workspace creation, plan choices and changes, and plan limits being reached. No other usage events are recorded for that workspace, and the workspace is left out of our usage analysis. You can switch it back on at any time.

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. To exercise these rights, contact us at privacy@wavyr.com. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

We use essential cookies to keep you signed in and to operate the Service. We do not use analytics, advertising or cross-site tracking cookies. Vercel Web Analytics counts page views and Vercel Speed Insights measures page performance, both without cookies.

We may update this policy from time to time and will note the date above. For any privacy questions, contact Wavyr B.V. at privacy@wavyr.com.