Privacy Policy

1. Data Controller

NOWWWA ("we", "us", "our") is the data controller responsible for your personal data. NOWWWA operates under Romanian law and is subject to the General Data Protection Regulation (EU) 2016/679 ("GDPR"). For all privacy-related matters, contact us at hello@nowwwa.ai.

2. Information We Collect

We collect the following categories of data:

• Account data: email address, display name, and authentication credentials provided at sign-up.
• Project content: the prompts, generated code, files and images you attach, and any business documents generated on your behalf by Brain OS (strategy, branding, marketing, legal, accounting, and workforce documents).
• Usage and interaction data: prompts submitted, projects created, AI generations run, features clicked, pages visited, and credit transactions. We collect this data explicitly to understand how users interact with the Service so we can improve it.
• Behavioural events: specific in-app actions such as opening the pricing page, clicking upgrade buttons, booking calls, or starting support chats. This helps us identify friction points and make the product better.
• Support and human-assistance data: messages exchanged in Expert Chat, scheduled-session booking details (name, email, and any notes you provide), and, where you engage a NOWWWA-affiliated developer to work in your project directly, the project content they access to do so.
• Billing data: subscription status and payment history. Full card details are handled exclusively by Stripe and are never stored on our servers.
• Invitation data: if you join through someone's invitation link, we record which account invited you, when you opened the link and when you signed up, and — when you pay for your first plan — a reference to that payment and the card fingerprint our payment processor gives us (a code that identifies a card without revealing its number). We compare that fingerprint with the cards used by the account that invited you, to prevent self-referral. The person who invited you sees your invitation only as a number ("Invited #n"), with its status and dates to the day — never your name, email address, or anything else that identifies you. If you invite others, we keep your invitation code and the same record for each person you invite.
• Connected accounts: if you connect one of your own accounts to a project (for example a payment, calendar or social media account), we store the access the provider gives us (its tokens, or the key you enter), encrypted with a key kept only on our servers and separate from our database, together with the account's name as you see it, the permissions you granted, and a log of when the connection was made, used, renewed or removed. We use this access only to do what you ask in that project. The services you connect process your data under their own terms, as your providers. You can disconnect an account at any time from the project's Connections page: we then delete the stored access and, where the provider allows it, withdraw it there too.
• Outgoing webhooks: if you add a web address on a project's Connections page, we send the events you choose (for example a form sent from your published site, including what the visitor wrote in it) to that address, signed so you can check they came from us. You decide where this data goes, and the service that receives it processes it under its own terms. We keep a log of each delivery (the time, the result, and a short fingerprint of what was sent), and we keep what was sent, encrypted, only while a failed delivery is waiting to be retried — at most one day.
• Your own voice and face (optional): if you set them up in Content, the recording of your voice, a portrait of you, and the record of your consent. See Section 13.
• Technical data: IP address, browser type, device type, and session identifiers collected automatically when you use the Service.

3. Legal Bases for Processing (GDPR)

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): to provide the Service, process payments, and manage your account.
• Legitimate interests (Art. 6(1)(f) GDPR): to analyse usage patterns, improve the Service, detect abuse, and ensure security. Our legitimate interests do not override your fundamental rights.
• Legal obligation (Art. 6(1)(c) GDPR): to comply with applicable Romanian and EU law, including tax and financial regulations.
• Consent (Art. 6(1)(a) GDPR): for any processing not covered by the above, such as marketing communications, where we will ask for your explicit consent separately.
• Explicit consent (Art. 9(2)(a) GDPR): for your own voice and face, which may be special categories of personal data. You give it in the product when you set them up, and you can withdraw it at any time by deleting them (Section 13).

4. How We Use Your Information

We use your data to operate and improve the Service, process payments and subscriptions, send transactional emails (account confirmation, receipts, booking confirmations), analyse aggregate and individual usage patterns to guide product decisions, detect and prevent fraud or abuse, and respond to support requests. We do not sell your personal data to third parties.

If you start an Expert Chat, book a scheduled session, or engage "Hire NOWWWA Team", the NOWWWA-affiliated developer(s) assisting you can see your project's code and content for the duration of that engagement, and — only where you explicitly ask them to — make changes to it directly. This access is limited to what is needed to provide the support or work you requested.

5. AI Processing

Prompts and project context you submit are sent to our AI model providers — currently Anthropic (Claude API) and, for some features, OpenAI — to generate code, chat responses, and Brain OS business documents. Each provider processes this data under their own privacy policy and API data usage terms. By default, neither provider uses API inputs to train their models. We recommend avoiding submitting sensitive personal information — such as passwords, financial details, or health data — in your prompts or attachments.

Documents Brain OS generates (strategy, branding, marketing, legal, accounting, and workforce planning) are produced the same way — by sending your project context to an AI model provider — and are stored in your account like any other project content.

Pictures you start from in Content. When a creation in Content starts from a picture you uploaded (or one made from it), our AI model processor first looks at it, only to check for recognisable people, a possible child, nudity or signs of a public figure — never to identify anyone — and we keep that answer with your account, never the picture. A copy of the picture as it was checked is kept with the creation it was used for until you delete that creation, its project or your account; if the creation fails, the copy is deleted at once.

6. Data Storage and Security

Your data is stored using Supabase (PostgreSQL) hosted on AWS infrastructure, currently in the EU (eu-west-1 / Ireland region). We apply industry-standard security practices including TLS encryption in transit, AES-256 encryption at rest, and strict access controls limiting production data access to authorised personnel only.

7. Third-Party Services

The Service integrates with the following third-party processors. We share only the minimum data necessary for each integration:

• Stripe — payment processing and subscription management. Processes your email address and billing information.
• Anthropic and OpenAI — AI code generation, chat, and Brain OS document generation. Process prompts and project context you submit.
• Supabase — database, file storage, and authentication infrastructure. Stores all account and project data, including uploaded files and images.
• Vercel — hosts and runs the NOWWWA application itself. Processes all requests to the Service, including project content in transit.
• Resend — transactional email delivery. Processes your email address to deliver confirmations, receipts, and booking notifications.
• Cloudflare — CDN and hosting for published sites. Processes request metadata for sites you publish through NOWWWA.
• Google — calendar scheduling and video calls (Google Meet) for booked sessions with NOWWWA developers. Processes your name, email, and the time you book.
• Meta (Facebook) — advertising measurement. A tracking script on our marketing pages processes your IP address, browser, and the pages you visit. When you complete a purchase or book a call with NOWWWA Studio, we also send Meta your email address as an irreversible hash, together with your IP address, your browser and the identifiers Meta's own cookies set, so the purchase or the booking can be matched to an ad.
• TikTok — advertising measurement. A tracking script on our marketing pages processes your IP address, browser, and the pages you visit. When you complete a purchase we also send TikTok your email address as an irreversible hash.

8. International Data Transfers

Some of our third-party processors (including Anthropic, OpenAI, Stripe, Vercel, Google, Resend, Meta, and TikTok) are based in the United States. Where data is transferred outside the European Economic Area, we ensure appropriate safeguards are in place — primarily Standard Contractual Clauses (SCCs) as approved by the European Commission under Art. 46 GDPR. By using the Service, you acknowledge that your data may be processed in the US under these safeguards.

9. Cookies and Tracking

We use session cookies to maintain your authenticated state. We collect first-party behavioural event data, stored in our own database, to understand feature usage and guide product improvements.

For every visit to our website, with an account or without, we record which pages were viewed, the website or campaign link that brought you (only its domain and its campaign tags), the country your connection comes from, and your type of device and browser. This uses no cookies: a random visit identifier is kept in your browser tab and disappears when you close it. We do not store your IP address. If your browser sends "Do Not Track" or "Global Privacy Control" and you are not signed in, we record nothing.

Our marketing pages also carry advertising trackers from Meta and TikTok. These set their own cookies and identifiers, and they report to Meta and TikTok which of our pages you visited. They do not run on the pages we send you by email. We do not sell your data to anyone.

By creating a NOWWWA account, including a free account, you agree to the advertising measurement described above: that Meta and TikTok receive your IP address, your browser, and the pages you visit on our marketing pages, and that when you complete a purchase they also receive your email address as an irreversible hash.

You can disable cookies in your browser settings, or block these trackers with a browser extension or a "Do Not Track" setting that your browser sends. Disabling cookies entirely will prevent you from staying logged in.

The sites you publish through NOWWWA carry none of this: they set no cookies of any kind and run no trackers.

10. Data Retention

We retain your account data and project history for as long as your account is active. Upon account deletion, your personal data is removed from our primary database within 30 days. Anonymised, aggregate analytics data (with no identifying information) may be retained indefinitely. Backup copies may persist for up to 90 days before being fully purged. Billing records may be retained for up to 7 years to comply with Romanian and EU tax regulations.

The access to a connected account and the settings of an outgoing webhook are deleted when you disconnect the account or remove the address, when you delete the project, and when you delete your account. When a project or an account is deleted, we also ask each provider to withdraw the access, where the provider allows it; if a provider does not confirm, we keep that access, still encrypted, only to ask again, and for at most one day. The log of a project's connections is kept for as long as the project exists. Delivery logs are kept for up to 30 days.

11. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to restriction — request that we limit how we process your data in certain circumstances.
• Right to object — object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at hello@nowwwa.ai. We will respond within 30 days. You also have the right to lodge a complaint with the Romanian Data Protection Authority (ANSPDCP) at dataprotection.ro, or with the supervisory authority in your EU country of residence.

12. Children's Privacy

The Service is not directed at children under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

13. Your Own Voice and Face

In Content you can choose to use your own voice and your own face in your ads and voice-overs. This is optional, and it is only ever for your own: you may set up only your own voice and your own face, never anyone else's (Section 4 of the Terms).

• What we store: the recording in which you read your consent and a short text (for your voice), a sample of your cloned voice, the portrait you upload (for your face), and the record of your consent — the name you typed, the exact statement, its language and version, when you gave it and, later, when you withdrew it, and a fingerprint (a SHA-256 hash) of the file. For each check we also keep its outcome (for example, that a portrait was refused for showing more than one face), never the file it read.
• Why: only to make the content you ask for in your own account. We never use your voice or face to identify you, to recognise you in other material or to train models, and no other account can use them.
• Checks: before we keep your voice or your face, an AI model processor checks that your recording contains your consent statement with your name, and that your portrait shows one adult, clearly, and does not look like a picture of a public figure (a stage, the press, a cover, a caption). A recording or a portrait that fails a check is deleted at once. These checks read what is in the file; they do not establish who you are, and they cannot prove that it is you — that is what your consent confirms.
• Who processes it: our AI model processor, which transcribes your recording, clones your voice and animates your portrait on our behalf, and the model providers it works with, which may process them outside the European Union, including in the United States, with safeguards of the kind described in Section 8; and our storage provider, which keeps the files privately. The files are reached only through short-lived links.
• How long: until you delete them, or your account. Deleting your voice or face deletes the recording, the sample and the portrait at once, and the cloned voice is never used again. The processor that made it offers no way to delete a cloned voice, so we delete its identifier on our side and never call on it again. We keep the record of your consent — without the file — as proof of what you agreed to and when you withdrew it, until your account is deleted; the files of a deleted account are removed by our next scheduled clean-up.
• What stays: content you already made with your voice or face stays in your library until you delete it; it is yours.

Your voice and face may be special categories of personal data (Article 9 GDPR). We process them only with your explicit consent, which you give when you set them up and can withdraw at any time by deleting them; withdrawing does not affect content made before.

14. Changes to This Policy

We may update this Privacy Policy from time to time. For significant changes, we will notify you via email or an in-app notice at least 14 days before the changes take effect. The "last updated" date at the top of this page reflects the most recent revision. Continued use of the Service after changes take effect constitutes acceptance of the revised policy.

15. Contact

For any privacy-related enquiries or to exercise your rights, contact us at hello@nowwwa.ai.