Privacy Policy — WiiFlo
Effective: July 27, 2026 · Last updated: October 30, 2026
1. Overview
WiiFlo is an AI analytics platform. When you use WiiFlo — at app.wiiflo.ai or wiiflo.ai — we process some personal data to provide the service.
This policy covers: GDPR (EU), CCPA/CPRA (US), UAE PDPL, Saudi PDPL, India DPDPA and Singapore PDPA.
We are the Data Controller for the account data you give us. For the data your organisation connects or uploads (files, databases, APIs, documents), your organisation is the Data Controller and we process it on its behalf.
2. What We Collect
- Account data — name, email address, organisation and workspace memberships, role.
- Data you connect or upload — files (CSV, Excel), database and API connections, Google Sheets, Airtable and Analytics data, and documents. It may contain personal data depending on what you connect; your organisation is responsible for having the right to use it.
- What you ask and create — questions in Thinking Space, answers, artifacts (dashboards, reports, decks), schedules, business knowledge you add, and findings WiiFlo remembers to answer better.
- Chat apps — if you link Telegram, Slack or Microsoft Teams: your account ID in that app and the messages you send WiiFlo there. Voice notes are turned into text.
- Usage and audit records — which features are used and when, and who changed what in your organisation (for security and your admins' audit log).
- Error reports — when something breaks we record the error, the page or request path and your account ID; never what you typed, your data or the request content.
Passwords are stored only in hashed form by our authentication provider. We do not collect payment card numbers or biometric data, and WiiFlo is not intended for children under 16.
3. How We Use It
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the service (answers, artifacts, schedules) | Connected data, questions, knowledge | Contract |
| Deliver what you schedule (email, chat apps, inbox) | Account data, chat-app IDs, the content sent | Contract |
| Keep accounts and data secure | Usage and audit records, error reports | Legitimate interest |
| Improve the product | Usage records | Legitimate interest |
| Meet legal obligations | Account data, audit records | Legal obligation |
| Answer early-access sign-ups and demo requests | Email address; for a demo, also name, company, team size and your message | Steps you ask us to take |
| Product updates (optional) | Email address | Consent |
We never sell personal data, never use it for advertising, and your data is never used to train AI models.
4. What the AI Receives
To answer a question, WiiFlo's AI receives the question, the names of the tables and columns involved, the results of the queries it runs on your data (up to 50 rows per query), and business knowledge and document passages related to the question.
- Columns your admins hide are never sent; masked columns are sent only as [MASKED].
- Each person only ever gets answers from the rows they are allowed to see.
- When web research is used, only search terms go to the search service. Your admins can turn web research off, or stop it from using your data to shape searches.
5. How Long We Keep It
| Data | Kept until |
|---|---|
| Account | You delete your account (immediate). In a team, shared work passes to the organisation owner. |
| Connected and uploaded data | Your organisation removes the source, or deletes its account |
| Thinking Space conversations | Deleted by you, or after the period your admins set (90 days or 1 year) |
| Remembered findings | Deleted, or after the period your admins set (30 or 90 days); also removed with their data source |
| Documents and business knowledge | Deleted by your organisation |
| Schedule run details | Step outputs are cleared after 30 days |
| Audit records | While your organisation’s account exists |
| Waitlist email and demo requests | You ask us to remove them |
6. Who We Share It With
We share data only with the service providers below, and only what each needs to do its job. We never share it with advertisers or data brokers.
| Provider | Purpose | What it receives |
|---|---|---|
| Anthropic | AI answers and artifacts | Questions, table and column names, query results (see section 4) |
| OpenAI | Search index for documents and findings; voice-note transcription | Document text, remembered findings, questions; voice notes |
| Supabase | Database, file storage and sign-in | All stored data |
| Railway | Application hosting | Data passing through our servers |
| Upstash | Caching and rate limits | Short-lived cached results and counters |
| Resend | Email delivery | Recipient email address and the content sent |
| Tavily, SerpApi | Web research | Search terms only |
| Sentry | Error reports | Error details and account ID (see section 2) |
| Telegram, Slack, Microsoft, Google | Only if you connect them | What you send or receive through that service |
| Vercel | Hosting of wiiflo.ai | Website visits, waitlist sign-ups and demo requests |
7. Where Data Is Stored
Our database and file storage are in India (Mumbai). Some service providers above process data in the United States and other countries. Transfers are protected with contractual safeguards such as Standard Contractual Clauses where the law requires them. Data is encrypted in transit (TLS) and at rest.
8. Security
- Encryption in transit (TLS) and at rest; connection passwords and app tokens are additionally encrypted (AES-256-GCM)
- Workspace roles, column access and row access decide who sees which data — enforced on our servers, including for AI answers
- Columns that look personal are flagged for your admins to review
- Isolated query engine: questions cannot read other organisations’ data or files on our servers
- Audit log of changes and AI activity (who and when, not the questions themselves) for your admins
- Rate limits and input checks on every API
Breach notification timelines: 72 hours for EU, UAE and Saudi Arabia · 3 business days for Singapore · 6 hours for India (CERT-In).
9. Your Rights
Wherever you are, you can access, correct, download or delete your data. You can delete your account in Settings and download data sources from WiiFlo; for a full copy of your data, email hello@wiiflo.ai. We respond within 30 days.
- EU (GDPR): access, rectification, erasure, restriction, portability, objection, withdrawing consent, and complaining to your national data protection authority.
- US / California (CCPA/CPRA): know, delete, correct, opt out of sale (we don't sell data), non-discrimination.
- UAE (PDPL): access, correction, deletion, withdrawing consent.
- Saudi Arabia (PDPL): access, correction, deletion, withdrawing consent, knowing the purpose before consenting.
- India (DPDPA): access, correction, erasure, grievance redressal, nominating a representative, withdrawing consent.
- Singapore (PDPA): access, correction, withdrawing consent, data portability.
10. Contact
Regulatory authorities:
- EU: your national Data Protection Authority
- UAE: UAE Data Office
- Saudi Arabia: SDAIA
- India: Data Protection Board of India
- Singapore: PDPC (pdpc.gov.sg)
- California: CPPA