wywy · legal

Privacy Policy

Data controller

Wywy (SASU), registered office 2 rue Guynemer, 75006 Paris, France. SIREN: [À COMPLÉTER]. Publication director: Benjamin Weill. Contact: hello@wywy.eu.

Data collected

identity (first name, surname, @handle, profile photo); contact details (email, mobile number, postal address); Google/Apple authentication identifiers; content you create (photos, messages, places); postcard data (recipient, content, delivery address, status); contacts (compared and then immediately discarded, never stored); technical data (notification token, crash reports, usage).

Recipients without a Wywy account

A user can send a card to someone who has no Wywy account by entering that person's name and postal address themselves. We therefore receive these details from the sender, not from the person concerned. We process them for the sole purpose of printing and posting the card, on the basis of our legitimate interest in enabling postal mail.

Every card carries a code and the address wywy.eu/stop. Anyone who receives a card can object without creating an account: enter the code printed on the card and choose to stop cards from that sender, or from everyone. This takes effect immediately. We then keep a non-reversible fingerprint of the address so we can block later sends.

Lost the card or can't read the code: write to hello@wywy.eu.

Purposes and legal bases

providing the service (performance of the contract); finding friends (consent); notifications (consent); improvement and security (legitimate interest); accounting obligations (legal obligation).

Recipients

technical providers acting as processors, by category: hosting/database/authentication, payment, printing and postal delivery, mapping/geolocation, notifications, error monitoring. A complete named list is available on request.

International transfers

the printing and posting of cards is carried out by our printing provider established in the United Kingdom. On every order, the data needed to produce and post the card (the recipient's name and postal address, the photo and message on the card) is therefore transferred to the United Kingdom. This transfer relies on the adequacy decision adopted by the European Commission in respect of the United Kingdom, which recognises a level of data protection equivalent to that of the European Union. The name of the provider is available on request at the contact address above.

Retention

for as long as the account is active; deletion on request or on account deletion, subject to legal obligations (accounting).

When a user reports content, we retain a copy of the reported content (message, photograph) and the identities of the parties, on the basis of our legitimate interest in preventing abuse and in establishing, exercising or defending legal claims. This data is retained for 12 months from the resolution of the report, unless a longer period is required for legal proceedings, and is retained even if the account concerned is deleted.

Your rights (GDPR)

access, rectification, erasure, restriction, objection, portability. You can delete your account directly in the app. If you received a card without being a member, you can object to any further cards at wywy.eu/stop, without creating an account. Contact: hello@wywy.eu. You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

Minors

the service is not intended for anyone under 15 without parental consent.