This page explains what personal data the wyroo.io website collects, why we collect it, and the rights you have. It covers the marketing website only, not the Wyroo application itself.

This statement explains what personal data we handle, why we handle it, and what rights you have. We have written it to be read, not to be scrolled past.

1. Who is responsible

Wyroo is a service of Creative Parrots BV, registered at Ruwbeemd 9, 3755WD Eemnes, NL, company registration 80474624, VAT NL861684722B01. You can reach us about privacy at hello@wyroo.io.

We have not appointed a data protection officer, because we are not required to. Privacy questions go to hello@wyroo.io.

2. Two roles, and why the difference matters

We handle personal data in two different roles. The difference decides who is responsible for what.

We are the controller for the data we decide about ourselves: visitors to our website, people who create an account, and billing contacts. This statement describes what we do with that data.

We are the processor for everything our customers put inside their workspace: projects, cards, comments, files, drawings, annotations, meeting notes, client updates, and the contact details of third parties such as subcontractors, suppliers and clients. We handle that data on the instruction of the customer, who is the controller for it. What we do with it is set out in our Data Processing Agreement, published at wyroo.io/dpa. That agreement applies automatically to every customer as part of our Terms of Service.

If your personal data is in someone's Wyroo project and you want to know why, or want it removed, contact that organisation. They decide. If you do not know who to contact, write to us at hello@wyroo.io and we will point you in the right direction.

3. What we collect, why, and on what basis

Website visitors

What	Why	Legal basis
Contact form: name, email, message and anything you write yourself	To answer your question	Legitimate interest in answering enquiries, and taking steps at your request before entering a contract
Session cookie	To make the website work, for example to keep your language choice and protect forms	Legitimate interest in a working, secure website. This is a functional cookie and does not need consent
Technical logs: IP address, browser, pages requested, timestamps	Security, abuse prevention and troubleshooting	Legitimate interest in a secure and reliable service
Analytics cookies in the application, through Google Tag Manager and Google Analytics: pages visited, approximate location, device and browser	To understand how the application is used and improve it	Your consent, given in the cookie banner and withdrawable at any time

The wyroo.io website itself carries no analytics, advertising trackers or profiling cookies.

The application at app.wyroo.io does use analytics. We load Google Tag Manager, which in turn loads Google Analytics, to understand how the application is used so we can improve it. Nothing is loaded or measured until you allow it: every storage category is set to denied before the tag manager runs, and only changes if you accept in our cookie banner. Analytics cookies are set on the basis of your consent, which you can withdraw at any time through the same banner. We do not currently use advertising or remarketing tags, and we do not build advertising profiles of individuals. If that changes we will update this statement and the cookie banner before it does.

Account holders and users

What	Why	Legal basis
Name, email address, password (hashed), language and notification preferences	To create and secure your account and to deliver the service	Performance of the contract
Two factor secrets, recovery codes, passkey credentials	To secure your account	Performance of the contract, and legitimate interest in account security
Company name and workspace settings	To run your workspace	Performance of the contract
Sign in activity and audit records of privileged actions	Security, and so that customers can see who did what	Legitimate interest in security and accountability
Transactional email: invitations, notifications, digests, service messages	To operate the service	Performance of the contract

We do not send marketing newsletters. All email we send today is transactional. If that ever changes, we will ask for consent first.

Billing contacts

What	Why	Legal basis
Billing name, email, address, VAT number, subscription and invoice data	To bill you and to keep our accounts	Performance of the contract, and legal obligation for tax records
Payment details	Handled by Stripe. We do not see or store full card numbers	Performance of the contract

Customer content (we are the processor)

Everything inside a workspace: projects, cards including additional work, comments and mentions, uploaded files and drawings, PDF annotations, meeting notes and AI drafted minutes, client updates and their share links, roles and the contact details of people who hold them, including people without an account.

Two of our features keep a searchable index derived from this content. Where document search is switched on, the text of uploaded documents and of PDF annotations is converted into a numerical representation by our AI subprocessor so it can be searched. Where the assistant is used, its conversations are indexed in the same way so it can recall earlier context. That index is kept for the life of the account, so the assistant can keep recalling earlier context.

We process this only to run the service for the customer, on their instruction. We do not use it for our own purposes, we do not sell it, and we do not use it to train AI models.

4. Who we share data with

We use a limited number of subprocessors. Each one processes only what it needs.

Subprocessor	Role	Where
Laravel Cloud (on Amazon Web Services)	Application hosting and database	European Union, eu-central-1, Frankfurt
Amazon Web Services S3	File and drawing storage, private buckets	European Union, eu-central-1, Frankfurt
Cloudflare	The edge network our hosting provider puts in front of the application. Every request passes through it, so it processes connection data such as your IP address, and it terminates the encrypted connection	Global edge network, company established in the United States
Stripe	Payments, subscriptions and invoicing	European Union and United States. We contract with Stripe Payments Europe Limited in Ireland, and Stripe transfers under the EU-US Data Privacy Framework together with standard contractual clauses. Stripe offers no payment data residency inside the European Economic Area
OpenAI	AI features, for example drafting meeting minutes	United States. We contract with OpenAI Ireland Limited, and the onward transfer runs under standard contractual clauses. Content submitted through the API is not used to train models
Anthropic	AI features, for example drafting meeting minutes	United States, transfer under standard contractual clauses. Content submitted through the API is not used to train models
Google (Places and Address Validation)	Address suggestions and validation while you type a company or project address	European Union and United States, transfer under the EU-US Data Privacy Framework
Google, Mozilla and Apple (browser push services)	Delivering browser notifications to the device you enabled them on. They receive the notification title and text. Your own browser decides which service is used, and we have no agreement with them and cannot choose another. Leave browser notifications off and you will receive email instead	Decided by the browser you use
Bunny Fonts	Serving the typeface on our pages and in our emails. Receives the IP address of the visitor or the recipient's mail client	European Union
Laravel Nightwatch	Application monitoring: requests, database queries and errors, including source code context and log lines	European Union, eu-central-1, Frankfurt
Google Workspace (Gmail)	Sending transactional email. Google therefore processes the content of the email we send you	European Union and United States, transfer under the EU-US Data Privacy Framework
Google Analytics and Google Tag Manager	Usage analytics in the application, only with your consent	European Union and United States, transfer under the EU-US Data Privacy Framework

We keep this list current. Customers are told before we add or replace a subprocessor, as set out in the Data Processing Agreement.

We also share data when the law requires it, for example on a valid order from an authority. We tell the customer when we are allowed to.

We never sell personal data, to anyone, for any purpose.

5. Transfers outside the European Economic Area

Our hosting, our database and our file storage are in the European Union, in Amazon's Frankfurt region. Requests reach us through a global edge network first, so connection data such as your IP address is handled at the edge location nearest to you.

Several subprocessors process personal data in the United States, or may do so: our AI providers, our payment provider in part, and Google, which we use for transactional email, for analytics in the application, and for address suggestions. Those transfers rest on the EU-US Data Privacy Framework where the provider is certified under it, and on the European Commission's standard contractual clauses where it is not, in both cases alongside additional measures such as encryption in transit. The table in section 4 says which applies to whom.

6. How long we keep data

Data	Retention
Contact form messages	12 months after the conversation ends
Account data	While the account exists, then 30 days after closure
Customer content	While the workspace exists. After closure, 30 days, then deleted from live systems, gone from automated database backups within seven days and from file storage within thirty days. Any manual snapshot holding it is deleted with the request
Invoices and billing records	Seven years, because tax law requires it
Technical and security logs	90 days
Audit records	12 months

If a payment fails and a workspace switches to read only, we do not delete anything. Read only mode protects your data; it does not remove it.

7. How we protect data

These are measures we actually have in place today.

Traffic is encrypted in transit with TLS, and every response tells your browser never to fall back to an unencrypted connection. Passwords are hashed with bcrypt. Two factor authentication and passkeys are available on every account, and we recommend using them. Sign in attempts are rate limited, and a new account must confirm its email address before it can be used.

Your data is also encrypted where it is stored, not only while it travels. Files you upload are encrypted at rest by Amazon S3: every object is encrypted automatically under its own key with 256 bit AES. The application, the database and the database backups are encrypted at rest by our hosting provider by default. That provider holds a SOC 2 Type 2 attestation for security, confidentiality and availability, applies security patches to the platform itself, and filters malicious traffic at the edge before it reaches us.

Documents, drawings and project photographs are stored in buckets that block public access entirely, and are served only through links that expire after five minutes. Display images such as profile pictures are held apart from them, because they are not confidential, and are served from our content delivery network without an expiry. Where you deliberately create a share link for someone outside the project, you choose how long it lasts, including an option for no expiry.

Uploaded files are versioned. If a file is overwritten or deleted, the previous copy stays recoverable for thirty days and is then permanently removed. Project files also sit in a recoverable trash for ninety days before they are destroyed, so an accidental deletion is rarely final.

Access is scoped per company and per project, so a guest sees only the project they were added to, enforced by authorisation rules and company scoped queries and covered by an automated isolation test suite. Actions taken by our own staff, such as support access, suspension or billing changes, are recorded in an audit log that cannot be edited. Within your workspace, file and board activity is recorded in its own activity trail.

No system is perfect. If a data breach affects personal data, we notify the Dutch Data Protection Authority within 72 hours where required, and we inform affected customers without undue delay.

8. Automated decisions and profiling

We do not make automated decisions with legal or similarly significant effects about anyone, and we do not build profiles of users to decide anything about them. We do not currently use personal data for advertising.

The AI features draft text on request. They do not decide anything about a person. Their output is a draft that a person reviews and approves.

9. Your rights

You have the right to access your data, to have it corrected, to have it deleted, to restrict or object to processing, and to receive your data in a portable format. Where we rely on consent, you can withdraw it at any time.

To exercise these rights for data we control, write to hello@wyroo.io. We answer within one month. We may ask you to confirm who you are before we act, so that we do not give your data to someone else.

If your data is inside a customer's workspace, we are the processor and we will pass your request to that customer, who decides.

If you are not satisfied with how we handle your data, you can complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens, at autoriteitpersoonsgegevens.nl. You can also complain to the supervisory authority in the country where you live or work.

10. Changes to this statement

We update this statement when the service or the law changes. The date at the top shows the last update. If a change matters to you, we will tell you by email or in the application.

Contact

Creative Parrots BV, Ruwbeemd 9, 3755WD Eemnes, NL. Privacy questions: hello@wyroo.io.

Privacy policy