Privacy Policy

This policy explains what personal data wessages (“we”, “us”) collects, why, and your choices. We keep it short and try not to collect more than we need. It is written to meet the EU and UK GDPR and the California Consumer Privacy Act (CCPA/CPRA); region-specific rights are set out below.

1. Who we are (data controller)

The controller of your personal data is the company that operates wessages; full legal-entity details (registered name and address) are available on request. For any privacy question or request, contact privacy@wessages.com.

2. What we collect

• Account & contact — your email address (used to sign in via a magic link and to send transactional email).
• Brief & creative — the product details, scripts, and images you submit to generate ads.
• Billing — plan and payment status. Card details are handled by Stripe; we never see or store full card numbers.
• Usage & technical — basic request metadata (e.g. IP address) used for rate limiting, security, and debugging.
• Device tokens — if you install the mobile app and enable notifications, a push token so we can tell you when an ad is ready.
• Email preferences — whether you’ve unsubscribed from marketing email (so we honour it).

3. How we use it & our legal bases

For people in the EEA/UK, the GDPR requires a legal basis for each use. Ours are:

• To provide the Service — generate your ads, deliver them, process payments, manage your plan and credits, and send transactional email (sign-in links, receipts, “your ad is ready”). Basis: performance of a contract.
• To secure the Service — prevent abuse, rate-limit, debug, and keep the product working. Basis: our legitimate interests in a safe, reliable service.
• Marketing email and ad measurement — only where you’ve opted in (or where we’re otherwise permitted to email an existing customer about similar products, subject to your right to opt out at any time). Basis: consent, or legitimate interests where the law allows.
• Legal compliance — meeting tax, accounting, and other obligations. Basis: legal obligation.

We do not sell your personal data. We don’t share it with advertising platforms unless you opt in via the cookie banner — and then only to measure our own ads, never for anyone else’s.

4. Marketing email & how to unsubscribe

There are two kinds of email from us:

• Transactional (sign-in links, receipts, “your ad is ready”, payment and account notices) — these are part of the Service and are sent to everyone with an account; you can’t unsubscribe from them while your account is active.
• Marketing / promotional (announcements, tips, offers) — entirely optional.

You can opt out of marketing email at any time, in any of these ways:

• click Unsubscribe in the footer of any marketing email;
• use your mail app’s one-click unsubscribe (we include the standard List-Unsubscribe header); or
• email privacy@wessages.com from the address you want removed.

Opting out takes effect right away and never affects transactional email. We keep a record that you unsubscribed so we can keep honouring it.

5. Service providers we share with

We use a small set of trusted processors to run the Service:

• Vercel — hosting, delivery, and cookieless web analytics;
• Neon — database;
• Upstash — rate limiting;
• Cloudflare R2 — storage for generated videos;
• Stripe — payments;
• Resend — transactional and marketing email delivery;
• Clerk — sign-in and account security (when enabled);
• Sentry — error monitoring, so we can fix problems fast;
• Anthropic — AI used to draft ad copy and hooks;
• third-party AI video generation infrastructure — to render your ads;
• advertising partners (Meta, TikTok, Google) — only if you consent via the cookie banner, to measure whether our own ads work. See the Cookie Policy.

Each processes data only to provide their service to us.

6. International transfers

Some of our providers process data outside your country, including in the United States. Where personal data of EEA/UK individuals is transferred, we rely on appropriate safeguards — such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or an adequacy decision — so your data stays protected.

7. Retention

We keep your data for as long as your account is active and as needed to provide the Service, then for a reasonable period to meet legal, accounting, and security obligations. You can ask us to delete your account data (see “Your rights”).

8. Your rights (EEA & UK)

If the EU or UK GDPR applies to you, you have the right to access, correct, delete, export (portability), and restrict or object to certain processing of your personal data, and to withdraw consent at any time (without affecting prior processing). To exercise any of these, email privacy@wessages.com and we’ll respond within the time the law requires. You also have the right to lodge a complaint with your local supervisory authority (in the UK, the Information Commissioner’s Office, ico.org.uk).

9. California privacy rights (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to access and delete it, to correct it, and to opt out of the “sale” or “sharing” of personal information. We do not sell your personal information, and we only “share” it for cross-context behavioural advertising if you opt in via our cookie banner — which you can turn off at any time there. We will not discriminate against you for exercising these rights. To make a request, email privacy@wessages.com; we’ll verify it against the email on your account.

10. Security

We use encryption in transit, scoped access, signed sessions, and other safeguards. No system is perfectly secure, but we work to protect your data and to respond quickly if something goes wrong.

11. Children

The Service is for businesses and is not directed to anyone under 18.

12. Changes

We’ll post updates here with a new effective date. For material changes we’ll make reasonable efforts to notify you.

13. Contact

Privacy questions or requests: privacy@wessages.com. See also our Cookie Policy and Terms of Service.