Privacy Policy

This Privacy Policy explains how Wizawiz ("we", "us") handles personal data when you use the Wizawiz website at wizawiz.com and the related applications and services (the "Service"), and when you communicate with us. Wizawiz is the data controller (the business responsible) for this processing. It applies to everyone who uses the Service — visitors, free and paid users, creators and affiliates.

This Policy does not cover third-party services that you use alongside Wizawiz — for example Google when you sign in with Google, Stripe when you pay, or the platforms where you use the prompts you create — which have their own privacy policies. Our Terms of Service govern your use of the Service; capitalised terms not defined here have the meaning given there.

Privacy contact: support@wizawiz.com. We have not appointed a Data Protection Officer because we are not required to; the privacy contact handles all requests.

We collect as little as we can. Here is everything, grouped by where it comes from.

We use personal data for the purposes below. Where the GDPR, UK GDPR or a similar law applies, we rely on the legal bases shown.

What we do not do. We do not sell personal data; we do not share it for cross-context behavioural advertising; we do not show ads; we do not build marketing profiles; we do not use your content to train AI models; and we do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Automated checks do operate for fraud and abuse (for example, an account created with a disposable email address may not receive welcome credits, and self-referrals are not credited) — you can ask for human review of any such outcome by emailing support@wizawiz.com.

Many features work by sending your input to a third-party AI model and returning its output. We want you to understand exactly what that involves.

• What is sent. Only the content needed for the feature you trigger: the prompt text or wizard answers (Mixer, Safe Pass, wizard AI drafting, generation previews, chat), the image or video you upload or the link you paste (Prompt Extractor), and reference images you attach to a generation. We do not send your email, name, payment data or account identifiers to AI providers.
• Which providers. Text features are served by Google (Gemini) or Anthropic (Claude), and — only if we enable them — OpenAI-compatible providers (OpenAI, OpenRouter, DeepSeek, Groq). All image and video analysis is served by Google Gemini. Image and video generation previews are served by fal.ai. Requests go from our servers to the provider over encrypted connections using our accounts; your browser never contacts a provider directly.
• No training. We do not use your content to train or fine-tune AI models. Our providers process your content as our service providers under their business/API terms: Google (paid Gemini API), Anthropic and OpenAI state that they do not use API inputs or outputs to train their models; fal.ai and other providers may use de-identified, aggregated usage data to improve their services as described in their terms. Providers may retain API inputs and outputs for a limited period (typically up to 30 days) for abuse monitoring and legal compliance, under their own policies.
• Uploaded videos are uploaded by your browser directly to a private storage bucket (Cloudflare R2) using a short-lived signed link, streamed from there to Google's file service for analysis, and then deleted from both places once the analysis finishes or fails (with a one-day automatic clean-up as a safety net). Uploaded images are converted in your browser and sent inline with the request; they are not stored on our servers for the Extractor.
• YouTube links are analysed by Google fetching the public video; we send the video's canonical address, and only the first 60 seconds are analysed.
• Results (and the inputs that produced them) are stored in your account's history so you can reuse them without paying again; you can see them in your history and ask us to delete them.
• Output about people. AI output can describe or depict people inaccurately. You are responsible for the lawful use of anything you generate about real people; see the Terms.

We share personal data only in these situations:

• Service providers (processors) that process data on our behalf and on our instructions, listed in the table below. Each is bound by a contract that restricts its use of the data to providing its service to us.
• Other users and the public, at your direction. If you publish a wizard, its name, description, thumbnail and your display name are visible to all users (and the wizard itself becomes public once approved). If you create a share link for a prompt, anyone with the link can see that prompt (without your name, workspace or email). Images you upload for wizard options, covers or page content are stored in a public media bucket and are accessible to anyone who has their address — do not upload images there that you want to keep private.
• Legal reasons. To comply with a law, regulation, legal process or enforceable government request; to enforce our Terms; to detect, prevent or address fraud, security or technical issues; or to protect the rights, property or safety of Wizawiz, our users or the public.
• Business transfers. If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, personal data may be transferred as part of that transaction. We will notify you (for example by email or a notice in the Service) before your data becomes subject to a different privacy policy.
• With your consent, or at your direction, in any other case.

We do not sell personal data and have not done so in the preceding 12 months. We do not share personal data with third parties for their own marketing.

We use only strictly necessary, first-party cookies. There are no advertising cookies, no third-party analytics cookies and no social-media pixels on the Service, and we do not use cookies to track you across other websites. Because none of our cookies require consent under EU/UK ePrivacy rules, we do not show a cookie banner.

• Browser storage. As described above, the app stores previews, drafts and preferences in your browser's IndexedDB, local storage and session storage. This data stays on your device; clearing your browser data removes it.
• Do Not Track and Global Privacy Control. We do not track users across sites or sell or share personal data, so there is nothing for these signals to switch off; we treat a Global Privacy Control signal as a valid request to opt out of any sale or sharing, which we do not perform.
• Embedded media. Admin-authored pages may embed YouTube (privacy-enhanced "nocookie" mode) or Vimeo players; those providers may set cookies only if you interact with the player, under their own policies.

We keep personal data only as long as needed for the purposes described here, then delete or anonymise it. Typical periods:

Backups are overwritten on a rolling basis within a further short period. Content you have published or shared may remain with users who have already run, cloned or exported it.

Wizawiz is a global service. Your data is processed where we and our service providers operate — including the United States (hosting, payments and AI providers), the region of our database provider, and other countries where the providers listed above run their infrastructure — which may be outside the country where you live and may have different data-protection laws.

Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards: principally the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum) in our contracts with providers, and, for providers certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, that framework. You can ask us for more information about these safeguards at support@wizawiz.com.

We use technical and organisational measures appropriate to the risk: encryption in transit (TLS with HTTP Strict Transport Security) and at rest with our hosting, database and storage providers; passwords stored only as salted hashes by our authentication provider; card data handled entirely by a PCI-DSS-compliant payment processor; strict browser security headers (content-security policy, frame denial); administrative access restricted to named, confirmed accounts; redaction of secrets from logs; short-lived signed links for uploads; and deletion of media after processing. No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a breach affecting your personal data, we will notify you and the relevant authorities as the law requires. Help us by using a strong, unique password and keeping your sign-in methods secure.

Depending on where you live you may have some or all of the following rights regarding your personal data. We extend the core rights below to all users, wherever they live:

• Access — to know whether we process your personal data and to receive a copy of it, together with the information in this Policy.
• Correction — to have inaccurate or incomplete data corrected. You can change some data yourself in your settings.
• Deletion — to have your personal data deleted, subject to the exceptions noted in the retention section (for example billing records we must keep). Deleting your account permanently removes your workspace, content, credits and — unless you request a final payout of an eligible balance beforehand — income; published wizards are un-published.
• Portability — to receive the data you provided in a structured, commonly used, machine-readable format (your wizards can also be exported as JSON from the app).
• Objection and restriction — to object to processing based on our legitimate interests, or ask us to restrict processing, in the circumstances allowed by law.
• Withdraw consent — where processing is based on consent, at any time, without affecting earlier processing.
• Complain — to your local data-protection authority (in the EU/EEA, the supervisory authority of your country; in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concern first.

How to exercise your rights. Email support@wizawiz.com from the email address on your account (or include enough information for us to verify that you are the account holder — we will not act on requests we cannot verify, to protect your data). An authorised agent may submit a request on your behalf with proof of authority. We respond within 30 days (45 days for requests under California law), extendable where the law allows if a request is complex; we will tell you if so. We do not charge for requests unless they are manifestly unfounded or excessive, and we will never discriminate against you for exercising your rights.

The Service is not directed to children under 13 and we do not knowingly collect personal data from them. If you are under 13, do not use the Service or give us any information. If we learn that we have collected personal data from a child under 13 (or under the age of digital consent where they live, without verifiable parental consent), we will delete it and close the account. If you believe a child has given us data, contact support@wizawiz.com.

We send service emails that are necessary to run your account — such as confirming your email address, security alerts, notices about billing, payouts or changes to our terms. You cannot opt out of these while you have an account. We do not currently send marketing emails or newsletters; if we introduce them, we will only send them with your consent where the law requires it, and every marketing email will include an unsubscribe link.

We may update this Policy to reflect changes to the Service, our providers or the law. When we do, we will change the "Last updated" date and version above. If a change materially affects how we use your personal data, we will give you at least 30 days' notice by email or a prominent notice in the Service before it takes effect, and where required seek your consent. Previous versions are available on request.

Privacy questions and requests: support@wizawiz.com. General support: support@wizawiz.com. If you are in the EU/EEA or UK and we have appointed a representative under Article 27 GDPR / UK GDPR, their details will be shown here.