wywy · legal

Privacy Policy

Data controller

Wywy (SASU), registered office 2 rue Guynemer, 75006 Paris, France. SIREN: [À COMPLÉTER]. Publication director: Benjamin Weill. Contact: hello@wywy.eu.

Data collected

identity (first name, surname, @handle, profile photo); contact details (email, mobile number, postal address); Google/Apple authentication identifiers; content you create (photos, messages, places); postcard data (recipient, content, delivery address, status); contacts (compared and then immediately discarded, never stored); technical data (notification token, crash reports, usage).

Recipients without a Wywy account

A user can send a card to someone who has no Wywy account by entering that person's name and postal address themselves. We therefore receive these details from the sender, not from the person concerned. We process them for the sole purpose of printing and posting the card, on the basis of our legitimate interest in enabling postal mail.

Every card carries a code and the address wywy.eu/stop. Anyone who receives a card can object without creating an account: enter the code printed on the card and choose to stop cards from that sender, or from everyone. This takes effect immediately. We then keep a non-reversible fingerprint of the address so we can block later sends.

Lost the card or can't read the code: write to hello@wywy.eu.

Purposes and legal bases

providing the service (performance of the contract); finding friends (consent); notifications (consent); improvement and security (legitimate interest); statistics on accounts (legitimate interest); anonymous audience measurement (legitimate interest, no consent required under the CNIL's rules); accounting obligations (legal obligation).

Audience measurement and statistics

To understand how Wywy is used and improve it, we produce two kinds of statistics.

Statistics on accounts. Week by week and month by month, we count sign-ups, cards sent, opened, printed and shipped, and how many people are active from one week to the next. To do this we use the dates and types of your actions (for example signing up, sending or opening a card, a comment, a reaction, a friend request) and whether certain profile fields are filled in (name, address, phone, notifications), never what they contain, and never your photos, messages or comments. Only weekly and monthly totals come out: no result contains a name, an identifier or any text. Founders' accounts and test accounts are left out. Legal basis: our legitimate interest in measuring and improving the service. You can object at any time by writing to hello@wywy.eu: your account is then removed from all of these statistics. Deleting your account removes it too.

Anonymous audience measurement in the app. While you are signed in, the app counts how often it is opened, which screens are shown and which features are used (a frame, a filter or a reaction, for example). It never records anything you type. The counts stay in the app's memory and are sent to us when you leave the app at the latest, without any identifier (no account, device or advertising identifier) and without cookies; nothing is stored on your phone except your choice, if you turn the measurement off. We keep only weekly totals for the whole app: they are never matched with your account or any other data, are never used for marketing, and are kept for 25 months at most. As with any connection to our servers, your IP address and the request's technical details pass through our host's logs; we do not store them with the counts or use them to produce them. Under the CNIL's rules on audience measurement, this does not require your consent, but you can turn it off at any time in Settings, Preferences, "Anonymous usage statistics". The choice applies to the device on which you make it.

Recipients

technical providers acting as processors, by category: hosting/database/authentication, payment, printing and postal delivery, mapping/geolocation, notifications, error monitoring. A complete named list is available on request.

International transfers

the printing and posting of cards is carried out by our printing provider established in the United Kingdom. On every order, the data needed to produce and post the card (the recipient's name and postal address, the photo and message on the card) is therefore transferred to the United Kingdom. This transfer relies on the adequacy decision adopted by the European Commission in respect of the United Kingdom, which recognises a level of data protection equivalent to that of the European Union. The name of the provider is available on request at the contact address above.

Retention

for as long as the account is active; deletion on request or on account deletion, subject to legal obligations (accounting).

When a user reports content, we retain a copy of the reported content (message, photograph) and the identities of the parties, on the basis of our legitimate interest in preventing abuse and in establishing, exercising or defending legal claims. This data is retained for 12 months from the resolution of the report, unless a longer period is required for legal proceedings, and is retained even if the account concerned is deleted.

Weekly totals of the anonymous audience measurement: 25 months at most.

Your rights (GDPR)

access, rectification, erasure, restriction, objection, portability. To object to the statistics on accounts, write to hello@wywy.eu; the anonymous audience measurement can be turned off in Settings. You can delete your account directly in the app. If you received a card without being a member, you can object to any further cards at wywy.eu/stop, without creating an account. Contact: hello@wywy.eu. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

Minors

the service is not intended for anyone under 15 without parental consent.