Privacy Policy

Wysava is operated by Cayden Wise, a sole proprietor located in Indiana, United States, who is the data controller for the information described here. Wysava is operated entirely online, and the fastest way to reach us about your data is by email.

Cayden Wise, Indiana, United States.
wisecreations47@gmail.com

Account information

Your name, email address and a securely hashed password. If you are invited to a workspace, the email address used to invite you.

Content you put into Wysava

Brand positioning, audiences, products, campaigns, drafted content, approvals, and files you upload — brand documents, images and performance exports. This can include personal data about other people if you choose to upload it, for example customer reviews, survey responses, interview notes or sales call transcripts. See section 7.

Usage and billing records

Records of AI generations — which operation, which model, how many tokens, what it cost — used to enforce your plan’s allowance and show you where it went. An audit trail of significant actions in your workspace. Your subscription status and billing history held by our payment processor.

Technical information

Standard server logs from our hosting provider, and error diagnostics. We deliberately redact credentials and secrets from anything we log.

An email address you leave without an account

If you use the form on our home page to hear about Wysava later, we store that address and, where the link you arrived through carried one, the name of the campaign that brought you. Nothing else — no name, no company, no profile. We use it for one thing: to email you when there is something worth seeing. It is not a newsletter, it is never passed or sold to anyone, and every message includes a way to be removed. Ask us at any time and we will delete it.

We never see or store your card number. Payment details go directly to Stripe.

• To provide the service — running your workspace, generating what you ask for, keeping your data available to you. Basis: performance of our contract with you.
• To take payment — subscriptions, invoices, failed-payment handling. Basis: performance of our contract, and our legal obligations.
• To keep the service secure and working — logging, abuse prevention, enforcing plan limits and rate limits. Basis: our legitimate interest in operating a reliable service.
• To contact you about your account — signup confirmation and password resets. Basis: performance of our contract.

We do not sell personal data, we do not share it for advertising, and we do not use it to build profiles of you.

Wysava is built on a small number of named providers. Each receives only what it needs to do its job. Two of them are AI providers, and they are used for different things: Anthropic writes, OpenAI draws.

• Supabase — database, authentication and file storage. Holds your account and all workspace content. Uploaded files are kept in private buckets, not publicly accessible.
• Anthropic — the AI that drafts content. Each generation sends only the records it needs: the relevant brand, audience, product, campaign and any approved learnings that match. We do not send your whole workspace. Anthropic states that it does not use data submitted through its API to train its models.
• OpenAI — generates Brand Visuals images. It receives the description you write and the brand context you selected for that image: the brand name, description, industry, positioning and tone, any words or claims your brand rules prohibit, and the name and details of the campaign, audience or product you chose. It does not receive your account details, your other brands, or anything you did not select. We have not independently verified OpenAI’s retention, training or storage practices, so we make no claim about them here — their own policies govern, and you should read them if that matters to you.
• Stripe — payments. Receives your email and payment details directly, and holds your billing history.
• Vercel — hosting. Processes requests and standard server logs.
• Resend — sends the two transactional emails we send: signup confirmation and password reset. Receives your email address only.
• Plausible — counts visits to the public pages only: the home page, sign-in, sign-up and these legal pages. It never runs inside your workspace, sets no cookie, and receives no account details. It sees the page address, the site you arrived from, your country and your device type, and does not tie any of it to a person.

Your workspace data is stored in the United States — our database, authentication and file storage run in Amazon Web Services’ US East (Northern Virginia) region, and that includes the images Brand Visuals generates. Our other providers also process data in the United States, with the exception of OpenAI, whose processing locations we have not independently verified and therefore do not describe here.

If you are in the EU or UK, that means your personal data is transferred outside your region. The safeguard relied on for that transfer is the European Commission’s Standard Contractual Clauses, together with the UK Addendum where it applies, as included in our providers’ data processing terms.

We keep your data for as long as your workspace exists. We do not delete it on a schedule, and we do not promise a retention period we would not keep.

When you delete a workspace from Settings, we cancel its subscription, clear its uploaded files from storage, and delete its records. Some information is kept longer where we have to: billing and tax records held by Stripe, and backups, which expire on their own cycle.

If you upload material containing personal data about your own customers or contacts, you remain the controller of it and we process it on your behalf as your processor. You are responsible for having a lawful basis to upload it and for telling those people what you do with it.

We will process it only to provide the service to you, and delete it when you delete it or your workspace. If you need a data processing agreement, write to us.

Wysava uses strictly necessary cookies only: one to keep you signed in, and one to remember which workspace you are viewing.

There is no advertising pixel, no tag manager and no third-party tracking script anywhere inside your workspace. Once you sign in, nothing measures what you do.

The public pages — this one, the home page, and the sign-in and sign-up pages — count visits using Plausible, so we can tell which pages people read and which sites they arrived from. Plausible sets no cookie, stores nothing in your browser, and does not build a profile or follow you to other sites. It records the page, the referring site, the country, and the type of device, and none of it is tied to a person.

That is why you are still not asked to accept cookies — every cookie here is strictly necessary, and there is nothing optional to accept.

One convenience item is stored in your own browser rather than sent to us: if you review content through a shared review link, your name is remembered locally so you do not retype it.

If you are in the EU or UK, you have the right to access your data, correct it, delete it, restrict or object to processing, and receive it in a portable form. You can also complain to your local supervisory authority.

If you are in California, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA.

Wherever you are, you can delete your workspace yourself from Settings at any time. There is no self-service export yet, so to obtain a copy of your data — or to exercise any other right above — write to wisecreations47@gmail.com and we will respond within 30 days.

Every workspace is isolated at the database level by row-level security, so one customer’s data cannot be read by another even if the application has a bug. Uploaded files are held in private buckets. Traffic is encrypted in transit. Credentials and secrets are redacted from our logs.

No system is perfectly secure. If a breach affects your personal data we will tell you and the relevant authority as the law requires.

Wysava is a business tool and is not intended for anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

If we change how we handle your data we will update this page and change the date at the top. Where the change is material we will tell you by email or in the app before it takes effect.

See also our Terms of Service.