Privacy Policy

1. Who this policy covers

WUWI AI is made by WUWI Ventures LLC (“WUWI”, “we”, “us”). This policy covers the marketing website at wuwiai.com and the WUWI AI application at ai.wuwi.dev.

Three other things are deliberately outside it:

• WUWI ID (id.wuwi.dev) handles sign-in for every WUWI product and holds your credentials. It is its own system with its own privacy policy — see section 3.
• The sibling products — WUWI Creator, WUWI Sites and WUWI Ops — have their own policies. Connecting them to WUWI AI does not put your data under this one.
• Websites you visit that happen to use WUWI AI's visitor analytics are covered by that website's own privacy notice. Section 11 explains our role there.

2. Where the product is today

WUWI AI is in private development and is not open to the public. Access is limited to invited testers. That matters for this policy in two ways: the volume of data involved is small, and the product is still changing — so this document will change with it, and we will date every change.

3. Your account and sign-in

Sign-in is handled entirely by WUWI ID at id.wuwi.dev. WUWI AI never sees, receives or stores your password.

Once you have signed in, WUWI AI stores the identity WUWI ID hands back:

• your WUWI ID user id
• your email address
• your display name and avatar image URL, where WUWI ID provides them
• when you were last active, so the account can be kept tidy

That copy is not the source of truth for who you are — WUWI ID is. Signing out of WUWI AI ends this application's session only; your WUWI ID session is unaffected.

If somebody invites you to their account as a team member, the account owner can see that you are a member and which businesses you have access to.

4. The business and website data you ask us to look at

This is the substance of the product. When you add a business, we store what you tell us about it — its name, website address, the locations it serves, and the keywords you want tracked.

When you run a visibility check or a full crawl, our crawler reads pages of that website and stores what it found there. What gets stored is the derived structure of each page, not a copy of it:

• the URL, the HTTP status, redirects, response time and page size
• the title, meta description, canonical URL, robots directives and language
• the headings, the heading outline, word count and the most-used terms on the page
• links found on the page, images and their alt text, and whether there is a tappable phone number, an email link or a form

We do not keep an archive of the page's HTML, and we do not take screenshots of it. We store the signals the findings are computed from, so that every finding can show its own evidence.

Our crawler identifies itself as WUWIBot. It reads robots.txt before it reads anything else and honours the crawl delay a site declares. If a site's robots.txt asks crawlers not to read a page, we do not read it.

We also store the scores, findings and evidence produced from all this — including the WVGI score, its confidence band and its history — so that trend over time means something. Every figure we store keeps its source and the date it was measured, because a number without those is not evidence.

When you compare yourself to a competitor, we crawl that competitor's public website at the time of the comparison. We do not build or keep a standing profile of other people's businesses.

5. Accounts you connect

You can connect accounts you already own so that WUWI AI can read your own data from them. Connecting is always your choice, and nothing is connected by default.

For each connection we store the access and refresh tokens, the exact scopes you granted, and which property or location you selected. Both tokens are encrypted with AES-256-GCM before they ever reach our database, and they are only ever decrypted on the server. They are never sent to a page, never logged, and never shown in the interface.

You can disconnect any connection from Settings → Connections. Disconnecting revokes the token with the provider and then deletes the stored row outright — we do not keep an encrypted credential you believe you have removed. You can also revoke our access directly from your Google or Microsoft account security settings.

6. Google user data — limited use

WUWI AI's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve the features you connected it for — your own visibility measurements, findings and evidence.
• We do not transfer Google user data to others, except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
• We do not use Google user data for advertising, and we do not sell it.
• We do not allow humans to read Google user data, unless we have your explicit consent for specific data, it is necessary for security purposes such as investigating abuse, to comply with applicable law, or the data has been aggregated and anonymised.

Google user data is not sent to any AI model provider. Section 7 sets out exactly what is.

7. The AI features

Several parts of WUWI AI are built on large language models: the AI Explainer that answers questions about your results, the AI visibility probes that test whether assistants know your business, and the written plans produced when you compare yourself to a competitor.

These run on Anthropic's Claude models, called through Anthropic's API. Anthropic is our processor for those requests. No other AI provider is used anywhere in the product.

What is sent to Anthropic:

• the business context needed to answer — the business name, its location and category, and content derived from its own website
• the findings and evidence currently in view
• what you type into the Explainer

What is never sent: your password (we never have it), your connected-account tokens, your billing details, and the raw Google account data described in section 6.

Anthropic's standard commercial API terms provide that data submitted through the API is not used to train their models. We have not negotiated a separate arrangement beyond those terms, and we would rather say that plainly than imply a guarantee we have not signed.

Explainer transcripts are kept for 90 days by default and then deleted automatically by a scheduled job. On plans where Explainer memory is enabled, the Explainer can also remember facts you tell it about your business; Settings → Memory shows you everything it has remembered and lets you make it forget.

AI visibility probes ask AI assistants questions a customer might ask — the kind that name a category and a place. The business name and website are part of those questions, because measuring whether an assistant knows the business is the point of the test.

AI output can be wrong. Everything the product proposes is presented with its evidence and waits for your approval; nothing acts on your website by itself.

8. Data we buy from search data providers

Some of what the product shows you comes from data providers rather than from your own accounts.

9. Billing

Payments are handled by Stripe. Card details are entered on Stripe's own hosted checkout — they never pass through WUWI AI's servers, and we never see or store a card number.

We store your plan, your subscription status, the Stripe identifiers needed to link your account to your subscription, and your credit balance and usage. Section 6 of the Terms explains what those cover.

10. Usage records and logs

We record which metered operations ran on your account and what they cost — crawls, rank lookups, AI calls — so that plan allowances can be enforced and so you can see your own spend rather than take our word for it.

Our servers keep ordinary operational logs and error records. When a member of the WUWI team takes an action on an account, that action is written to an internal audit log, and those log entries are kept as the record that it happened.

WUWI AI runs no product analytics, no session recording and no third-party tracking on itself. There is no Google Analytics, no advertising pixel and no behavioural tracker anywhere in the application.

11. Visitor analytics on your own website

WUWI AI includes first-party website analytics you can add to a website you own. Where you use it, the visitors are yours and the data is yours: you are the controller of it and we process it on your behalf.

It is built not to identify people:

• The visitor identifier rotates every day. It can tell one browser from another within a single day, and cannot connect the same browser across two days.
• We store the page path, the referring website's host only — never the full referring URL, which can contain whatever somebody typed into a search box — any UTM campaign tags, and a coarse device and browser type.
• There is no cross-site tracking, no profile of an individual, and no advertising use of any of it.

If you use it, telling your own visitors about it in your own privacy notice is your responsibility, not ours.

12. This website, and cookies

On wuwiai.com, we record a page view server-side for each page that is loaded: the path, and the browser's user-agent string. That record contains no cookie and no IP address, and requests identified as bots are counted separately so that the numbers mean something.

wuwiai.com sets no analytics cookies, no advertising cookies and no third-party tracking pixels. If that ever changes, we will ask for your consent before loading anything of the kind, and this section will say so first.

You may see a short notice on this site saying it uses cookies to remember your preferences. Dismissing that notice is remembered in your browser's own local storage rather than in a cookie, and nothing else on wuwiai.com stores anything on your device today.

In the WUWI AI application, the cookies are the ones the product cannot work without:

All three are first-party and functional. None of them tracks you anywhere else.

13. Who else sees your data

We do not sell your personal information, and we do not share it for behavioural advertising. We have never done either, and the product has no mechanism for it.

Data does reach the service providers that make the product work. Each of them acts on our instructions and for no other purpose:

Beyond that, we will disclose data if the law requires it, if it is needed to investigate abuse or protect the service or somebody's safety, or as part of a merger or sale of the business — in which case we will tell you before your data moves.

14. How long we keep it

Honest answer first: apart from AI Explainer transcripts, WUWI AI does not currently delete your data on a timer. It stays until you or we delete the account.

After deletion, copies can survive for a limited period in encrypted backups before those backups age out in the normal course.

15. How it is protected, and where it lives

Traffic to WUWI AI is encrypted in transit. The database is not exposed publicly; every query is filtered by the account it belongs to, and row-level security is enabled on every table as a second line of defence behind that.

Connected-account tokens get a layer of their own: they are encrypted with AES-256-GCM in the application before they reach the database, decrypted only on the server at the moment they are used, and never rendered into a page. Stripe webhooks are rejected unless their signature verifies, so nobody can put an account onto a paid plan by inventing a message.

WUWI AI runs on infrastructure operated by Vercel and Supabase, and data is stored and processed wherever those providers host our projects and wherever the providers listed in section 13 operate. If you use the product from another country, your data will be processed in those places.

No system is perfectly secure, and we will not pretend otherwise. If a breach affects your data, we will tell you.

16. Your choices and your rights

Things you can do yourself, today:

• Disconnect any connected account, which revokes and deletes the credential.
• Make the AI Explainer forget what it has remembered, in Settings → Memory.
• Export keywords, pages, findings and your spend ledger as CSV files.
• Change your notification preferences, or unsubscribe from any email we send.

Things you should email us for, at dev@wuwiventures.com:

• A copy of the data we hold about you.
• Correction of anything that is wrong.
• Deletion of your account and its data. Self-service deletion is not built yet — we do it by hand on request, and we will confirm when it is done.

Depending on where you live you may have additional rights — to access, correct, delete, port or object to the processing of your personal data, and to complain to your local data protection authority. We apply these on request regardless of where you are, because running two standards would be harder than running the better one.

For California residents: we do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA.

Because WUWI ID holds your sign-in credentials, requests about the credentials themselves are handled there rather than here.

17. Children

WUWI AI is a tool for businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, email us and we will delete it.

18. Changes to this policy

When this policy changes, we change the date at the top of the page. If a change materially affects how we handle your data, we will tell the people it affects rather than rely on you noticing a new date.

Because WUWI AI is still in private development, expect this document to grow as the product does.

19. Contact

WUWI Ventures LLC is responsible for the data described here. For anything in this policy — a question, a request, or a correction — email dev@wuwiventures.com and a person will read it.