Privacy Policy

1. Who we are

Wonib is operated by Vijit Vimal Kumar, a sole proprietor based in India and trading as Wonib, at A-12, Shivaji Park, Saddu Vidhan Sabha Road, Raipur, Chhattisgarh 492001. For anything about this policy, write to contact@wonib.com. Our Grievance Officer under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 (“DPDP Act”) is Vijit Vimal Kumar, reachable at contact@wonib.com; we acknowledge grievances within 72 hours and resolve them within 30 days.

2. What we collect, and why

Account data: your name, work email, a salted hash of your password (never the password itself), your company and role, and sign-in records (time, IP address, browser), to run your account and keep it secure. Brand data: the brands you add, including names, colours, typefaces, logos, voice and rules, and anything Wonib reads from a website you point it to, to make your work in that brand. Work data: the briefs, files, images, text, decks, documents and videos you make, upload or approve, and the corrections you make to them, which Wonib remembers for that brand. Messages: notes you send through Feedback or the contact form. Payment data: your plan, invoices and payment status; card and UPI details are collected by Razorpay or Paddle, never by us. Usage data: which features you use and how often, counted, to keep allowances fair and the service working. We collect nothing we do not need for these purposes, and we do not buy data about you from anyone.

3. Lawful basis

We process your data to perform our contract with you (running Wonib for you), with your consent where the DPDP Act or the GDPR requires it (for example a sign-in through Google or Microsoft), and for our legitimate interests in keeping the service secure and improving it. You may withdraw consent at any time by writing to contact@wonib.com; this does not affect processing already done.

4. Who processes it for us

Cloudflare, Inc. (hosting, storage, security, and the AI behind the free image engine and the free caption generator; servers in several countries including India, the EU and the US). OpenAI, L.L.C. and Anthropic, PBC (the AI models that write and paint; they receive the brief, the brand rules and the content needed for the piece, under business terms that forbid training on your data). If you connect your own Claude account, Anthropic processes that use under your agreement with them. Google LLC and Higgsfield, if you add their keys for video clips, under your agreements with them. Razorpay Software Pvt. Ltd. (payments in India, in rupees) and Paddle.com Market Ltd (payments outside India: Paddle is our reseller and Merchant of Record, and processes your payment and tax details as an independent controller under its own privacy notice). Resend, Inc. or Cloudflare (transactional email). If you sign in with Google or Microsoft, those companies tell us only your name and email. We do not sell or rent personal data, and we show no advertising.

5. Cross-border transfer

Your data is stored with Cloudflare and may be processed in countries outside India, including the United States and the European Union, by the processors above. We transfer data only to countries and processors not restricted by the Central Government under the DPDP Act, and under contracts that require protection at least equal to this policy.

6. How long we keep it

Account and brand data: while your account is open and for 90 days after it closes, then deleted. Work data: while your account is open; you can delete any piece at any time. Images made through Claude or the API: 30 days, unless saved to your workspace. Sign-in records and audit logs: 12 months. Messages and contact requests: 12 months. Invoices: 8 years, as Indian tax law requires. Backups are overwritten within 35 days.

7. Your rights

Under the DPDP Act and, where it applies, the GDPR, you can ask for a copy of your personal data, correct it, have it deleted, withdraw consent, nominate a person to exercise your rights if you cannot, and complain to the Data Protection Board of India or your local supervisory authority. Write to contact@wonib.com; we answer within 30 days and never charge for a first request. Owners of a workspace can download all of its work from the app.

8. Security

All traffic is encrypted in transit (TLS). Stored work is encrypted at rest. Passwords are hashed with PBKDF2 and never stored in clear. Sign-in is limited after repeated failures, every sign-in and change is recorded in an audit log visible to the workspace owner, and the service is tested against the OWASP Top 10 on every deploy. If a breach affects your data we will tell you and the Data Protection Board without undue delay, as the DPDP Act requires.

9. Cookies

Wonib sets one strictly necessary cookie to keep you signed in. The website sets none for tracking and uses no advertising or analytics cookies. Your browser may keep your Appearance choice (Light or Dark) in local storage; nothing is sent to us.

10. Children

Wonib is a business tool. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.

11. Changes

If this policy changes in a way that matters to you, we will email the workspace owner at least 14 days before the change takes effect and keep the previous version available on request.