Privacy Policy

This policy explains what personal data Wuyud collects, why we collect it, who we share it with and what rights you have. In short, we collect only what we need to run your boards, we don't sell your data, and we don't train AI models on it.

1. Who is responsible

The controller of your personal data is Jakub Bareš, Prague, Czech Republic, operating Wuyud ("we", "us"). For any privacy question or request, email jakub@metamatics.ventures.

When a company uses Wuyud to process its own people's or customers' data on boards, that company is the controller of that board content and we act as its processor.

2. What we collect

Data you give us

• Board content: stickies, cards, documents, uploaded files, prompts and chat messages with the agent, task instructions, and views and versions. This may include personal data about you or others if you add it.
• Meeting data: if you run a live meeting on a board, the transcript lines (the words spoken and who said them) sent to that board's tasks.
• Contact data: your name and email address if you write to us, request a demo or sign up.

Data from sources you connect

• When you connect a source (for example Holotext, a custom MCP server or an upload), we fetch the items you've enabled for that board, such as emails, work sessions, messages or files, and store them as board items with a link back to where they came from.
• When you ask for web research, we store the public pages the agent finds (URL, site name and excerpt).

Data collected automatically

• Technical logs: IP address, browser and device type, the pages and API endpoints requested, timestamps and error messages. Our hosting and CDN (Amazon Web Services) collect these to deliver and protect the service.

We don't use advertising trackers, and we don't buy data about you from third parties.

3. Why we use it & legal basis

• To provide Wuyud, meaning we store your boards, run the agent and meeting tasks, and sync sources. The legal basis is performance of our contract with you (GDPR Art. 6(1)(b)).
• To keep Wuyud secure and working, meaning we prevent abuse, debug errors and monitor capacity. The legal basis is our legitimate interest in running a safe, reliable service (Art. 6(1)(f)).
• To reply to you, for example about support or demo requests. The legal basis is steps you asked for before a contract (Art. 6(1)(b)) or our legitimate interest in answering you (Art. 6(1)(f)).
• To meet legal obligations, such as accounting or responding to lawful requests from authorities (Art. 6(1)(c)).

If you add other people's personal data to a board, or record a meeting, you're responsible for having a lawful basis to do so. That includes telling participants and, where required, getting their consent.

4. AI processing

To answer your prompts and run meeting tasks, we send the relevant board content, source items and transcript lines to our AI provider, Anthropic, which processes them to generate a response. Anthropic does not use data sent through its commercial API to train its models. We don't use your content to train models either.

The agent doesn't make decisions about you that have legal or similarly significant effects. It rearranges and summarises content on your instruction.

5. Who we share it with

We share personal data only with service providers that help us run Wuyud, under contracts that limit what they can do with it:

• Amazon Web Services (EU, Frankfurt region). Hosting, storage, content delivery and DNS.
• Anthropic, PBC (USA). The AI models behind the agent and meeting tasks.
• Google Fonts (Google, USA). Serves the fonts on our pages, so your browser sends your IP address to Google when it loads them.
• Sources you connect yourself, such as Holotext or custom MCP servers. We exchange data with these only because you told us to, and their own privacy policies apply.

We may also disclose data where the law requires it, to protect our rights or users' safety, or to a successor if Wuyud is sold or merged. In the last case, this policy would continue to protect your data. We never sell personal data.

6. International transfers

Some providers (Anthropic and Google) process data in the United States. Where data leaves the EEA, we rely on the EU–US Data Privacy Framework where the recipient is certified, or on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

7. How long we keep it

• Board content, source items and transcripts: for as long as the board exists. When you delete a board or ask us to delete it, it's removed from the live system within 30 days, and from backups when they expire.
• Technical logs: up to 90 days, unless we need them longer to investigate a security incident.
• Emails with us: up to 3 years after our last contact, or longer if the law requires.

Our AI provider may keep inputs and outputs briefly, for trust and safety purposes, under its own retention terms.

8. Cookies & local storage

Wuyud doesn't use advertising or analytics cookies. The board app uses:

• your browser's local storage, which remembers which view you last had open on each board;
• your browser's saved login, if a board is password-protected, so you don't have to enter the password again.

Both are strictly necessary for the service to work, so they don't need consent. You can clear them in your browser settings at any time.

9. Security

All traffic is encrypted with HTTPS. Boards run on AWS infrastructure in the EU, secrets are kept outside the code, and access to production systems is restricted to the people who operate Wuyud. No system is perfectly secure. If a breach puts your rights at risk, we'll notify you and the supervisory authority as the law requires.

10. Your rights

Under the GDPR you can ask us to:

• access the personal data we hold about you and get a copy;
• correct inaccurate data, or delete it;
• restrict or object to processing based on legitimate interests;
• port your data, meaning receive it in a machine-readable format;
• withdraw consent at any time, where we rely on consent.

Email jakub@metamatics.ventures and we'll respond within one month. You also have the right to complain to a supervisory authority. In the Czech Republic that is the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7. You can also complain to the authority where you live or work.

11. Children

Wuyud isn't intended for anyone under 16, and we don't knowingly collect their data. If you think a child has given us personal data, contact us and we'll delete it.

12. Changes & contact

We'll update this policy when our practices change and revise the date at the top. If a change is material, we'll let you know in the app or by email before it takes effect. You can find our Terms of Service here. For any question, email jakub@metamatics.ventures.