מדיניות הפרטיות

1. General Provisions

1.1. The Controller is committed to safeguarding the rights and freedoms of individuals in the processing of their personal data, including the right to privacy.

1.2. This Policy applies to all information the Controller may obtain about users of the WŬMÙ AI Office SaaS platform at wumu.ai.

1.3. By using the Platform the User agrees to this Policy. If the User disagrees, they should refrain from using the Platform.

2. Categories of Personal Data Processed

2.1. The Controller processes the following minimum necessary data:

• Email address
• Name, Display name or Alias
• Subscription plan and payment history data

2.2. Automatically collected anonymised data:

• IP address
• Cookies
• Browser and operating system information
• Date and time of access to the Platform

2.3. The Controller does not collect, process or store payment card data. Payments are processed on the secure side of the payment aggregator (Paddle), which complies with PCI DSS standards. Purchases in the mobile app are paid for through the App Store or Google Play (clause 10.10).

3. AI-Specific Data Processing (Prompts)

3.1. Texts, queries and documents uploaded by the User to the AI chat (Prompts) are transmitted to AI model provider servers solely for the purpose of generating a response.

3.2. The Controller does not use User Prompts to train its own AI models.

3.3. The User shall not upload personal data of third parties without their written consent or prior anonymisation.

3.4. The Controller does not initiate data collection from Prompts and is not responsible for any breach by the User of third-party rights.

4. Purposes of Data Processing

• Performance of the Terms of Service agreement
• Creating the User Account and granting access to paid plans
• User identification and processing of support requests
• Sending system notifications (billing status, token limits)
• Improving Platform quality based on anonymised analytics

Marketing communications are sent only with the User's separate explicit consent.

5. Lawful Basis for Processing

• Performance of a contract (the Terms of Service)
• Consent of the User, given by affirmative action (ticking a consent checkbox)
• Legitimate interests of the Controller (service improvement, fraud prevention)

6. Collection, Storage and Disclosure to Third Parties

6.1. Security is ensured through the use of HTTPS, password hashing (Argon2) and restricted database access.

6.2. Disclosure to third parties is permitted:

• With the User's consent
• For payment identification (transmission of User ID to Paddle)
• Apple Inc. and Google LLC for purchases in the WŬMÙ Connect mobile app (clause 10.10): the store takes the payment as an independent controller, receives the account tag and sends us the purchase details
• To technology partners (AI API providers) for processing requests
• To providers of technical services for the mobile apps, who process data on the Controller's behalf: Apple Inc. and Google LLC for delivering notifications (Sections 10 and 11) and showing maps (Section 11); Sentry (Functional Software, Inc.) for crash reports and Expo (650 Industries, Inc.) for delivering notifications of the WUMU City app (Section 11)
• To the Google Analytics 4 web analytics service (Google LLC): cookies, IP address, browser and device data, and the pages viewed on wumu.ai. The tag loads only after the visitor accepts cookies in the cookie banner; declining or withdrawing consent switches it off
• Upon request by law enforcement or court order

7. International Data Transfers

7.1. When accessing global AI models, cross-border data transfer may occur.

7.2. When you use the mobile apps, notification tokens are transferred to Apple and Google (Sections 10 and 11); the WUMU City app also sends map tile requests to Apple and Google, crash reports to Sentry and notification tokens to Expo (Section 11). This data is processed on these companies' servers, including in the United States. For purchases in the WŬMÙ Connect app, the account tag and the purchase details are processed by Apple and Google (clause 10.10), including in the United States.

7.3. Google Analytics data (Section 6) is processed on the servers of Google LLC, including in the United States.

7.4. The Controller ensures that appropriate safeguards are in place in accordance with GDPR requirements (e.g. Standard Contractual Clauses, Adequacy Decisions).

8. Data Retention and Erasure

8.1. Personal data is processed for as long as the User Account exists.

8.2. You can request account deletion on the account deletion page — including without signing in, by confirming through a link sent to your email. The account is closed as soon as you confirm, and the data is erased 30 days later; signing in within that period cancels the deletion. The following is not erased: information that must be retained under applicable law (including payment records), as well as your messages in conversations with other users and the listings and reviews you published in WUMU City — these remain without your name and photo.

9. Data Subject Rights

9.1. Under the GDPR, the User has the right to:

• Access their personal data held by the Controller
• Request rectification of inaccurate or incomplete data
• Request erasure of their data (“right to be forgotten”)
• Object to or restrict processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

9.2. Withdrawal of consent will result in deletion of the User Account and inability to use the Platform.

9.3. To exercise your rights, contact support@wumu.ai.

10. The WŬMÙ Connect Mobile App

10.1. The WŬMÙ Connect app for iPhone and Android gives you access to the messenger, calendar and contacts of your WŬMÙ account. In addition to the data processed when you use the website, the app processes the following.

10.2. Phone contacts. If you allow access to your phone's contacts, the app sends the phone numbers from your address book to our server to show which people you know already use WŬMÙ. The numbers are checked at the time of the request and are not stored. If you invite someone by phone number, we keep a fingerprint (hash) of that number for 30 days to link their sign-up to your invitation. You can revoke access to contacts in your phone's settings at any time.

10.3. Your phone number and time zone. The number you add to your profile lets people you know find you by the number in their address book. If your profile has no time zone, the app takes it from your phone's settings so that Do Not Disturb and notifications follow your local time.

10.4. Photos, videos, files and voice messages. The app accesses photos, the camera and the microphone only when you attach a photo, take a photo or video, record a voice or video message, or send content to WŬMÙ from another app through Share. What you send is stored the same way as on the website.

10.5. AI features. Voice message transcription, the AI assistant's answer to an @bot mention, the AI reply draft, message translation and creating a meeting from a phrase or a photo ("Fill in with AI") work only when you ask for them and after you consent in the app. To provide them, the following is sent to AI model providers under Section 3: the voice message audio; your request together with the latest messages of the conversation; the text of the message being translated, including messages written by others; the phrase or photo (a poster, ticket or invitation) the meeting is made from. The assistant's answer is visible to all participants of the conversation; the draft is visible only to you until you send it yourself; a transcription is saved with the message and is available to the participants of the conversation; a translation is saved so that it is not requested again; the phrase and the photo are not stored — they only produce a meeting draft.

10.6. Notifications. To send notifications about new messages and meetings, the app gives us the device's push token. Notifications are delivered through the Apple Push Notification service (iPhone) and Firebase Cloud Messaging (Android). The token is deleted when you sign out and when you delete your account.

10.7. Crash reports. When the app crashes, it sends us a technical report: the error message, the screen, and the app and operating system versions. The report contains no credentials and is not linked to your account.

10.8. What the app does not do. The app does not track you across other apps or websites, shows no ads, does not use the advertising identifier and determines your location only when you share it in a conversation yourself (clause 10.11). You enter your password only on our website — the app never sees it.

10.9. Deletion. You can delete your account in the app (Profile → Delete account) or on the account deletion page of the website — including without signing in, by confirming through a link sent to your email. The account is closed as soon as you confirm, and the data is deleted 30 days later; signing in within that period cancels the deletion. What is retained is listed in clause 8.2.

10.10. In-app purchases. Token packs and subscriptions in the app are paid for through the App Store or Google Play, and only the store receives your payment details. From the store we receive information about the purchase: the product, the transaction and order identifiers, the date, the price and currency, whether it is a test purchase, and what happens to a subscription (renewal, cancellation, refund). We need it to credit the purchase to your account and to account for refunds. Together with the purchase, the store receives an account tag — a string that lets us credit the purchase to you; it contains neither your name nor your email, and the store gets neither from us. Purchase records are kept as payment records (clause 8.2).

10.11. Location. When you share your location in a conversation, the app, with your permission, determines the phone's location once and sends the point (accurate to about a metre) and its caption to the participants of the conversation as a message; it is stored the same way as other messages. At no other time does the app determine your location. You can revoke the permission in your phone's settings.

10.12. Calls and screen sharing. Voice and video calls, including group calls, and screen sharing go through our media server: sound, video and screen content are delivered to the call participants in real time and are not recorded. The app accesses the microphone and the camera when you make or answer a call; screen sharing starts only after you confirm it in your phone's system prompt, and while it is on, participants see everything on the screen, including notifications. To connect the call, the media server receives the device's IP address and technical information about the app and the device (operating system, model). Call details — who called, who was invited, whether it was a video call, the time and the outcome — are kept in the call history and in the conversation. On iPhone, the app gives us a separate push token for incoming calls; it is deleted together with the token in clause 10.6. Calls do not appear in the iPhone's system list of recent calls.

10.13. Devices and sign-ins. With every request, the app tells us its version, the operating system version and the phone model (on iPhone, only "iPhone" or "iPad"). This information, together with the sign-in time and the last activity, is kept in your account's device list, where you can see where you are signed in and end any session, and it is named in the new sign-in notification. The app does not send the device name.

10.14. Google Calendar. You can connect your Google Calendar from the app: it opens a page of our website, and you grant access on Google's page. Once connected, meetings are synced both ways: we receive from and send to Google Calendar the title, description, location, time and the email addresses of meeting participants. For this we store the access keys issued by Google. You can turn the sync off in the app or on the website, and the access keys are then deleted.

11. The WUMU City Mobile App

11.1. The WUMU City app for iPhone, iPad and Android opens the city section of the website: events, classifieds, jobs, places, routes, getaways, real estate, the city feed and the catalogue. You sign in with your WŬMÙ account on our website — the app never sees your password. In addition to the data processed when you use the website, the app processes the following.

11.2. Location. The app accesses your location only when you ask it to. The “I am here” button while filing a record drops a point where you stand; the point is saved and published with the record only if you keep it. The “Near me” button on the city screen sends your approximate position, accurate to about a kilometre and not linked to your account, to show the closest cities. The app never tracks your location in the background.

11.3. Photos and camera. The app accesses your photo library and camera only when you add a photo to a record or a conversation yourself. Photos are compressed before sending, and their location data is removed.

11.4. Records, conversations and reports. Listings, jobs, CVs, events, reviews, bookings, favourites, conversations with authors, reports, hidden authors and blocked people are stored on the website the same way as when you use a browser.

11.5. Search. Search queries are sent to the website to show results. Searches for cities the service does not cover yet are stored without being linked to your account, to decide which cities to open next. If you leave your email address in an “Open my city” request, we use it to reply to you and to let you know when the city opens.

11.6. Notifications. To notify you about new messages and decisions on your records, the app gives us the device's push token together with its platform and language. Your notification settings are stored with the token: which kinds are turned off, quiet hours, the digest hour and the time zone they are counted in. Notifications are delivered through Expo, the Apple Push Notification service (iPhone, iPad) and Firebase Cloud Messaging (Android). The token is deleted when you sign out and when you delete your account.

11.7. Subscriptions. Subscriptions to new listings and events that you set up in the app are stored on the website under your account: the subscription conditions (for example, section, category, price, district, venue, search words), the label the app composed, the delivery mode and the times the last digest was sent. Based on them, the app notifies you right away or sends a daily digest at the hour you choose; notifications are delivered as described in 11.6 — through Expo, the Apple Push Notification service and Firebase Cloud Messaging — and contain the city name, the subscription labels and the number of new items. A subscription is deleted when you remove it and together with your account.

11.8. Crash reports. To find and fix errors, the app sends crash and error reports and app session data to Sentry (Functional Software, Inc.), which processes them on our behalf: the error message and stack trace, the device model, the operating system and app versions, the last actions in the app and requests to the website before the error, and a random identifier of the app installation. Your account name, email address and account identifier are not included, and the reports are not linked to your account.

11.9. Usage statistics. To understand which sections people use and what to improve, the app sends our server de-identified usage entries that are not linked to your account. They cover: opening the app, choosing a city, opening a section or a listing, applying filters (only their type), searching (only where — in a section or across the city — and whether there were results), starting, sending and failing to file a listing (with a reason code such as “offline”), opening a conversation and sending a message, marking “I'm going” and adding an event to the calendar, subscribing to a section and unsubscribing, opening a notification (only its type), signing in and out, showing the request to rate the app, and choosing interests (only the sections). The entries come with the chosen city, the app version, the platform, the language, the time of the action and whether you are signed in. Search words, the text of listings and messages, coordinates, addresses, contacts and the identifiers of your listings and other records are not sent. The entries carry a random device identifier: it is not linked to your account or your push token and changes every 90 days, and our server stores only its fingerprint (hash). The IP address is not written to the statistics database: it is used to protect the service from overload (the request counter is kept for no longer than a minute) and, as with any request to the website, appears in the web server's technical logs. The entries are kept for 13 months and then deleted; because they are not linked to your account, deleting the account does not affect them. Reports use daily totals per city without device identifiers, which are kept indefinitely. The entries themselves are not shared with third parties or used for advertising; companies that run a city in the service see only aggregate figures for their cities. You can turn the sending off in the app's profile — after that, the app sends no usage entries.

11.10. Maps. Maps in the app are shown by Apple Maps (iPhone, iPad) and Google Maps (Android), which receive requests for the map tiles of the visible area.

11.11. What the app does not do. The app does not track you across other apps or websites, shows no ads, does not use the advertising identifier and does not ask for access to your phone's contacts.

11.12. Deletion. You can delete your account in the app (Profile → Delete account) or on the account deletion page of the website — including without signing in. What is deleted and what is retained is described in Section 8.