Privacy Policy

• Your account information — your name, email address and how you use WonderArk — is handled by us, and we decide how it is used. This policy covers it.
• Customer Data — the records a business puts into the Service, such as its prospects, customers, contacts, employees and investors — belongs to that business. We process it on the business's behalf and only under its instructions. If your details are held in a business's WonderArk account and you want to access, correct or delete them, please contact that business; we will help them respond.

• Account details: your name, email address and password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name, email address and profile picture from Google.
• Business details: your business name, address, contact details and registration details such as a GSTIN, and the team members you invite.
• Content you add: the records, messages and files you and your team enter or upload — for example prospects, contacts, inventory, jobs, invoices, marketing content, investor records and data-room documents.
• Messages sent through the Service: emails you send from WonderArk and the replies they receive, and — if you connect them — messages from channels such as WhatsApp, Instagram or Facebook.
• Payment details: when you buy something, our payment provider (Razorpay) collects your card or bank details. We receive only the payment status, amount and reference numbers — never your full card number.
• AI provider keys: if you connect your own AI provider API key, we store it encrypted.
• Technical information: your IP address, browser and device type, and logs of requests and errors, which our hosting providers record so the Service can run securely.

We use personal data to:

• create and secure your account and sign you in;
• provide the Service and its features, including the modules your business licenses;
• send service messages, such as sign-up confirmation, password resets, security notices and messages you ask the Service to send;
• process payments and keep billing and tax records;
• provide support and respond to your requests;
• monitor, protect and improve the Service, including preventing fraud and abuse;
• meet our legal obligations.

We do not sell personal data, we do not show advertising in the Service, and we do not use your Customer Data to train AI models.

When you use an AI feature, the content that request needs (for example your product description, a prospect's company details or a draft) is sent to the AI provider that serves it — OpenAI, Anthropic or Google — to generate the result. If you connect your own API key, the request is made under your account with that provider and its terms apply. Some Discovery features search the public web for information about companies. AI results are stored in your account so you do not pay for the same request twice.

We share personal data only with service providers who help us run the Service, under contracts that require them to protect it and use it only for that purpose:

• Supabase — database, authentication and file storage (hosted in Mumbai, India)
• Vercel — application hosting and content delivery
• Resend — sending and receiving email
• Razorpay — payment processing
• OpenAI, Anthropic and Google — AI features, only when you use them
• Google — sign-in, only if you choose to sign in with Google
• Meta (WhatsApp, Instagram, Facebook) — only if your business connects those channels

We may also disclose personal data if the law requires it, to protect the rights, safety or property of our users or others, or as part of a merger, acquisition or sale of our business, in which case this policy will continue to apply to your data.

Our database and file storage are hosted in India (Mumbai). Some of our service providers — for example the AI providers and email delivery — may process data in other countries when you use their features. Where that happens we rely on providers with strong security and contractual safeguards, and we transfer data only as permitted by Indian law.

• We keep your account and Customer Data for as long as your account is active.
• Cancelling a module does not delete its data. It stays read-only for 30 days, is then kept but inaccessible, and is restored if you reactivate the module.
• If you ask us to close your account, we delete or anonymise your data within 90 days of confirming the request, except for records we must keep by law (such as invoices and tax records) and copies in encrypted backups, which are deleted as the backups expire.
• Technical logs are kept for a limited period for security and troubleshooting.

• Every business's data is isolated at the database level: each request can only reach the records of businesses the signed-in user belongs to.
• Data is encrypted in transit (TLS). AI provider keys you connect are additionally encrypted with AES-256-GCM before they are stored.
• Access within a business is controlled by roles and permissions, and important changes are recorded in an audit log.
• Shared data-room links can be set to expire and can be revoked at any time.

No system is perfectly secure. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities as the law requires.

Subject to applicable law, you have the right to:

• ask for a summary of the personal data we hold about you and how we use it;
• have inaccurate or incomplete data corrected and updated;
• have your data erased when it is no longer needed for the purpose it was collected for;
• withdraw your consent, where we rely on consent (this does not affect processing that already took place);
• nominate another person to exercise your rights if you die or become incapacitated;
• have a grievance about our handling of your data addressed.

To exercise any of these rights, email connect@wonderapps.biz from the address on your account. We will respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

We use only the cookies and browser storage the Service needs to work: authentication cookies that keep you signed in, and preferences stored in your browser such as your light or dark theme and which menu sections you have collapsed. We do not use advertising or cross-site tracking cookies.

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy from time to time. The date at the top of this page shows when it last changed. If we make a material change, we will tell you by email or in the product before it takes effect.

For any question or complaint about privacy or this policy, contact our Grievance Officer at connect@wonderapps.biz. We will acknowledge your complaint within 24 hours and aim to resolve it within 15 days.