Privacy Policy

1. Data we collect

• Automatic technical data from hosting: IP address, user agent, pages visited, timestamps, and security logs. Purpose is security and reliability.
• Email correspondence: email address, name (if you include one), and message contents when you contact hello@wanory.com.
• Inwit beta content: prompts, uploads, feedback, and session metadata you send while using the Inwit demo and experiments.
• What we do NOT collect today: accounts and passwords, payment data, newsletter lists, cross-site advertising tracking. If this changes, this policy is updated and consent is requested again where required.

2. Purposes and legal bases for processing

We process data only to: provide and secure the service; respond to messages; run and evaluate the beta; meet legal obligations; and prevent abuse. The legal bases map across jurisdictions:

• Indonesia PDP Law (Law 27/2022): consent, contract performance, legal obligation, legitimate interests, vital interests and public interests.
• GDPR Art. 6 (EEA and UK): consent, contract, legal obligation, vital interests, public interest, legitimate interests (security, reliability, beta research that does not override your rights).
• Sensitive data (GDPR Art. 9 and specific data under the PDP Law): only if you provide it explicitly and, where asked, with separate explicit consent. Please do not send sensitive data.

3. Data sharing and international transfers

• Infrastructure providers (hosting and CDN) and email providers, as processors acting only on our instructions.
• No data sales. No sharing for targeted advertising. No disclosure to third parties except to operate the service, comply with the law, or protect security.
• Servers and processors may sit outside Indonesia and the EEA. Where cross-border transfer happens, we apply reasonable safeguards (processing contracts, encryption in transit and at rest, data minimization). Formal mechanisms such as SCCs will be added once a legal entity exists.

4. Retention and security

• Technical logs: generally 12 months or less, then deleted or aggregated, except where needed for a security investigation.
• Email and subject-rights requests: kept as long as needed to respond, plus reasonable archiving for accountability.
• Inwit beta content: kept while the session and research run; feedback stored for evaluation is stripped of direct identifiers where possible.
• Security: HTTPS, need-to-know access controls, regular updates. No system is fully secure, so never send information that must not leak.

5. Your rights (worldwide)

Your data belongs to you. Send requests to hello@wanory.com with the subject “Data Request”. We generally reply within 30 days (PDP Law: up to 72 hours for certain initial stages where applicable; GDPR: one month).

• Indonesia PDP Law: rights of access, correction, deletion, restriction, portability, consent withdrawal, objection to automated processing, and complaints to the PDP authority.
• GDPR (EEA and UK): rights of access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), freedom from solely automated decisions (22), withdrawal of consent at any time, and complaints to a supervisory authority.
• CCPA and CPRA (California): rights to know, delete, correct, opt out of sales and sharing (we do not sell), limit sensitive data use, and non-discrimination. At least two contact methods: the email above plus a form or postal address once a legal entity exists.
• LGPD (Brazil): rights of confirmation, access, correction, anonymization, blocking and deletion of excessive data, portability, information about sharing, and consent revocation.

To verify identity, we may ask for the minimum information needed so data does not reach the wrong person. Authorized agents must attach valid authorization.

6. Children

The service is not directed at children under 13. We do not knowingly collect child data. If you are a parent or guardian and find child data was sent, contact us for deletion.

7. Cookies

Today we use only strictly necessary cookies and technologies for security and load balancing (see the Cookie Policy). No analytics or advertising cookies. If analytics is added as the beta grows, we ship a granular consent banner and update the cookie table before any non-essential tracking starts.

8. Changes and contact

This policy will be updated when a legal entity is formed, when account, payment, or analytics features are added, or when the law changes. Material changes are announced on the site with a new date. Contact: hello@wanory.com. Also read the Terms of Service and the Cookie Policy.