Құпиялық саясаты

1. General Provisions

1.1. The Controller is committed to safeguarding the rights and freedoms of individuals in the processing of their personal data, including the right to privacy.

1.2. This Policy applies to all information the Controller may obtain about users of the WŬMÙ AI Office SaaS platform at wumu.ai.

1.3. By using the Platform the User agrees to this Policy. If the User disagrees, they should refrain from using the Platform.

2. Categories of Personal Data Processed

2.1. The Controller processes the following minimum necessary data:

• Email address
• Name, Display name or Alias
• Subscription plan and payment history data

2.2. Automatically collected anonymised data:

• IP address
• Cookies
• Browser and operating system information
• Date and time of access to the Platform

2.3. The Controller does not collect, process or store payment card data. Payments are processed on the secure side of the payment aggregator (Paddle), which complies with PCI DSS standards.

3. AI-Specific Data Processing (Prompts)

3.1. Texts, queries and documents uploaded by the User to the AI chat (Prompts) are transmitted to AI model provider servers solely for the purpose of generating a response.

3.2. The Controller does not use User Prompts to train its own AI models.

3.3. The User shall not upload personal data of third parties without their written consent or prior anonymisation.

3.4. The Controller does not initiate data collection from Prompts and is not responsible for any breach by the User of third-party rights.

4. Purposes of Data Processing

• Performance of the Terms of Service agreement
• Creating the User Account and granting access to paid plans
• User identification and processing of support requests
• Sending system notifications (billing status, token limits)
• Improving Platform quality based on anonymised analytics

Marketing communications are sent only with the User's separate explicit consent.

5. Lawful Basis for Processing

• Performance of a contract (the Terms of Service)
• Consent of the User, given by affirmative action (ticking a consent checkbox)
• Legitimate interests of the Controller (service improvement, fraud prevention)

6. Collection, Storage and Disclosure to Third Parties

6.1. Security is ensured through the use of HTTPS, password hashing (Argon2) and restricted database access.

6.2. Disclosure to third parties is permitted:

• With the User's consent
• For payment identification (transmission of User ID to Paddle)
• To technology partners (AI API providers) for processing requests
• Upon request by law enforcement or court order

7. International Data Transfers

7.1. When accessing global AI models, cross-border data transfer may occur.

7.2. The Controller ensures that appropriate safeguards are in place in accordance with GDPR requirements (e.g. Standard Contractual Clauses, Adequacy Decisions).

8. Data Retention and Erasure

8.1. Personal data is processed for as long as the User Account exists.

8.2. You can request account deletion on the account deletion page — including without signing in, by confirming through a link sent to your email. The account is closed as soon as you confirm, and the data is erased 30 days later; signing in within that period cancels the deletion. The following is not erased: information that must be retained under applicable law (including payment records), as well as your messages in conversations with other users and the listings and reviews you published in WUMU City — these remain without your name and photo.

9. Data Subject Rights

9.1. Under the GDPR, the User has the right to:

• Access their personal data held by the Controller
• Request rectification of inaccurate or incomplete data
• Request erasure of their data (“right to be forgotten”)
• Object to or restrict processing
• Data portability
• Withdraw consent at any time
• Lodge a complaint with a supervisory authority

9.2. Withdrawal of consent will result in deletion of the User Account and inability to use the Platform.

9.3. To exercise your rights, contact support@wumu.ai.

10. The WŬMÙ Connect Mobile App

10.1. The WŬMÙ Connect app for iPhone and Android gives you access to the messenger, calendar and contacts of your WŬMÙ account. In addition to the data processed when you use the website, the app processes the following.

10.2. Phone contacts. If you allow access to your phone's contacts, the app sends the phone numbers from your address book to our server to show which people you know already use WŬMÙ. The numbers are checked at the time of the request and are not stored. If you invite someone by phone number, we keep a fingerprint (hash) of that number for 30 days to link their sign-up to your invitation. You can revoke access to contacts in your phone's settings at any time.

10.3. Your phone number and time zone. The number you add to your profile lets people you know find you by the number in their address book. If your profile has no time zone, the app takes it from your phone's settings so that Do Not Disturb and notifications follow your local time.

10.4. Photos, videos, files and voice messages. The app accesses photos, the camera and the microphone only when you attach a photo, take a photo or video, or record a voice message. What you send is stored the same way as on the website.

10.5. AI features. Voice message transcription, the AI assistant's answer to an @bot mention and the AI reply draft work only when you ask for them. To provide them, the voice message audio, or your request together with the latest messages of the conversation, is sent to AI model providers under Section 3. The assistant's answer is visible to all participants of the conversation; the draft is visible only to you until you send it yourself; a transcription is saved with the message and is available to the participants of the conversation.

10.6. Notifications. To send notifications about new messages and meetings, the app gives us the device's push token. Notifications are delivered through the Apple Push Notification service (iPhone) and Firebase Cloud Messaging (Android). The token is deleted when you sign out and when you delete your account.

10.7. Crash reports. When the app crashes, it sends us a technical report: the error message, the screen, and the app and operating system versions. The report contains no credentials and is not linked to your account.

10.8. What the app does not do. The app does not track you across other apps or websites, shows no ads, does not use the advertising identifier and does not request your location. You enter your password only on our website — the app never sees it.

10.9. Deletion. You can delete your account in the app (Profile → Delete account) or on the account deletion page of the website — including without signing in, by confirming through a link sent to your email. The account is closed as soon as you confirm, and the data is deleted 30 days later; signing in within that period cancels the deletion. What is retained is listed in clause 8.2.