Privacy Notice

1. What personal data do we collect?

Information you disclose to us. We collect personal information that you voluntarily provide when you register, express an interest in our products, or contact us. Depending on how you interact with the App, this may include your full name, email address, phone number, username/account name, business name (business users only), promotional or referral code, and contact preferences.

Sensitive information. We do not process sensitive personal information (such as racial or ethnic origins, health data, biometric data, religious beliefs, or sexual orientation) as part of normal App use.

Payment data. We may collect data necessary to process your payment with Apple, such as your payment instrument reference number. All payment card data is handled and stored by our payment processor — we do not directly store full card details.

Information generated by your use of the App. Scheduling preferences and meeting norms learned by the AI scheduling agent; meeting types, locations, and travel mode preferences; timezone settings; connected calendar and video conferencing providers (we store OAuth integration tokens only, not your calendar contents); content of scheduling conversations and threads; app usage data; and device type, OS, and app version.

Information collected automatically. Log and usage data (IP address, browser/device information, pages or features accessed, timestamps, error reports), device data, and approximate location derived from IP address and timezone settings (you can opt out of device location via your device settings).

What we do NOT collect or store. We do not store your calendar events or contents on our servers (calendar data is accessed in real time only); we do not sell your personal data; and we do not use your personal data for advertising profiling or behavioural advertising.

Meeting recipients (non-Wenya users). If a Wenya user sends you a meeting proposal, we collect and process the name and email address you provide to facilitate that meeting, relying on our legitimate interests. You can opt out at any time by clicking unsubscribe in any email we send.

2. How do we process your information?

We process your information to: facilitate account creation, authentication, and management; deliver the AI scheduling keyboard, calendar integrations, and scheduling threads; respond to enquiries and offer support; send administrative and transactional communications (OTPs, meeting confirmations, invitations) via Resend and push notifications via Apple APNs; manage orders, subscriptions, and billing for Pro users; enable AI-powered personalisation of your scheduling preferences; conduct analytics (via Mixpanel and internal logging) and AI research and development using anonymised or aggregated data; ensure security and fraud prevention; and comply with applicable legal obligations.

3. What legal bases do we rely on?

EU / UK (GDPR & UK GDPR): consent (Art. 6(1)(a)); performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) in improving the App, preventing fraud, and ensuring security; legal obligation (Art. 6(1)(c)); and vital interests (Art. 6(1)(d)).

Singapore (PDPA): we collect, use, and disclose personal data only with your consent (express or deemed), or where permitted by a PDPA exception.

Canada: we process your information with your express or implied consent, which you may withdraw at any time, except in certain legally permitted cases.

United States: we process personal information under the CCPA/CPRA and equivalent state legislation (see Section 15).

4. When and with whom do we share your personal information?

We do not sell your personal data. We share data with third-party vendors and service providers who perform services on our behalf under contracts designed to safeguard your information. These include:

• AWS — cloud infrastructure, database, storage, WAF (Singapore, US East, EU/Frankfurt)
• OpenAI API — AI scheduling assistant (GPT-4); scheduling context passed at query time, zero retention (US)
• Anthropic API — AI model research & development; anonymised/aggregated data, zero retention (US)
• Google Calendar API / Microsoft Graph API / Zoom API — calendar & video integrations; OAuth tokens only (US)
• Resend — transactional email (US); Apple APNs — iOS push notifications (US)
• Google Maps / Places API — location-based scheduling features (US)
• Google Analytics — website analytics; Mixpanel — in-app product analytics (US)
• Payment processor — payment processing for Pro subscribers (payment reference data only)

We may also share information in connection with a business transfer (merger, sale, or acquisition — with advance notice), and in response to valid legal disclosures required by law.

5. Third-party websites

The Services may link to or integrate with third-party websites and services (including Google Calendar, Microsoft Outlook, and Zoom). We are not responsible for the safety, content, or privacy practices of third parties, and the inclusion of an integration does not imply endorsement. Any data collected by third parties is governed by their own privacy policies. You should review the privacy policy of any third-party service you connect.

6. Cookies & tracking technologies

We may use cookies and similar tracking technologies (such as web beacons and pixels) on our website to maintain security, prevent crashes, fix bugs, save your preferences, and assist with basic site functions. We use Google Analytics to track and analyse use of our website; to opt out, visit tools.google.com/dlpage/gaoptout. Full details are set out in our Cookie Policy.

7. AI-based products

Our core product is an AI-powered scheduling keyboard and agent. We provide AI functionality through third-party providers: OpenAI (GPT-4) powers the @Wenya AI scheduling assistant (scheduling context may be passed to OpenAI's API to generate responses), and Anthropic is used for AI research and product development with anonymised or aggregated data. The AI scheduling agent learns your scheduling preferences over time to personalise your experience — this learned data is associated with your account and deleted on account deletion. We do not use your individual scheduling data to train general AI models without your explicit consent.

8. Social logins

Our Services let you register and log in using your Google or Apple account. Where you choose to do this, we receive certain profile information from the provider (typically your name and email address) and use it only for the purposes described in this Privacy Notice. We recommend you review the provider's privacy notice.

9. International transfers

As a company incorporated in Singapore, your personal data may be transferred to and processed in countries outside your country of residence. Our primary infrastructure is hosted on AWS in Singapore, US East (N. Virginia), and EU (Frankfurt, Germany). For UK and EEA transfers we rely on adequacy decisions, International Data Transfer Agreements / Standard Contractual Clauses with the UK Addendum, and the EU SCCs (Module 2). Transfers outside Singapore are conducted in accordance with the PDPA's transfer limitation obligation. Our SCCs can be provided upon request.

10. How long do we keep your information?

We keep your information only as long as necessary for the purposes set out in this notice, unless a longer period is required by law. In summary: account data is kept for the duration of your account + 12 months after deletion; group scheduling data is deleted 90 days after a conversation ends; AI preference / learned-norms data is deleted on account deletion; OAuth tokens are kept until revoked or your account is deleted; usage/analytics data is anonymised after 12 months; payment records are kept for 7 years; and security logs are kept for 12 months. When we no longer have a legitimate need, we delete or anonymise your data.

11. How do we keep your information safe?

We use appropriate technical and organisational measures, including: TLS/SSL encryption in transit; encryption at rest (Aurora PostgreSQL and S3); AWS WAF with DDoS protection; VPC private subnets; IAM least-privilege access; JWT authentication and OAuth 2.0 for integrations; and AWS Secrets Manager for credentials. No method of transmission or storage is 100% secure. In the event of a personal data breach, we will notify you and the relevant authorities as required by applicable law (UK ICO within 72 hours; PDPC within 3 calendar days; affected users without undue delay where high risk).

12. Information from minors

The App is not directed at children under 16 (or 13 in the United States), and we do not knowingly collect data from them. If we learn that we have collected such data, we will deactivate the account and delete the data. US (COPPA): parents/guardians who believe their child under 13 has provided personal information without consent should contact info@wenyawanna.ai. California minors under 18 may request removal of content under California Business & Professions Code Section 22581.

13. Your privacy rights

EEA, UK, and Switzerland users have rights to: request access and a copy of your personal information; request rectification or erasure; restrict processing; data portability; and object to processing. If you believe we are unlawfully processing your information, you may complain to your data protection authority or the UK ICO (ico.org.uk). You can withdraw consent at any time by contacting info@wenyawanna.ai, and unsubscribe from marketing at any time. Upon request to terminate your account, we will deactivate or delete your account and information from our active databases, subject to limited legal retention.

14. Controls for do-not-track features

Because there is not currently a uniform industry or legal standard for recognising and implementing Do-Not-Track (DNT) signals, we do not respond to DNT browser signals at this time. We respond to Global Privacy Control (GPC) signals instead (see our Cookie Policy). If a standard is adopted in the future, we will inform you in a revised version of this notice.

15. Do United States residents have specific privacy rights?

If you reside in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have specific rights under the CCPA/CPRA and equivalent state laws. The categories of personal information we collect include identifiers, California customer records, commercial information, internet/network activity, geolocation data, professional information (business name), and inferences (scheduling preferences and AI-learned meeting norms used solely to improve your in-App experience — not for advertising profiling or sold to third parties). We do not collect protected classification characteristics, biometric information, audio/sensory information, education information, or sensitive personal information.

We have not sold or shared personal information for a business or commercial purpose in the preceding twelve months, except: geolocation data shared with Google Maps Platform APIs to enable location-based scheduling, and internet/network activity shared with Google Analytics and Mixpanel for analytics. Your rights include the right to know, access, correct, delete, obtain a copy, non-discrimination, and to opt out of targeted advertising, the sale of personal data, or profiling. To exercise your rights, email info@wenyawanna.ai with the subject "US Privacy Rights Request — [Your Name]". You may appeal a declined request, and California residents may make a "Shine the Light" request.

16. Do Singapore residents have specific rights?

Under the PDPA, Singapore residents have the right to access and correct their personal data, and to withdraw consent for its collection, use, or disclosure. To exercise these rights, contact info@wenyawanna.ai with the subject "PDPA Request — [Your Name]"; we will respond within 30 days. You may also lodge a complaint with the Personal Data Protection Commission (PDPC) at pdpc.gov.sg. Our Data Protection Officer is Thomas Beattie.

17. Do we make updates to this notice?

We may update this Privacy Notice from time to time. The updated version will be indicated by an updated effective date. If we make material changes, we will notify you by prominently posting a notice or by email/in-app notification at least 14 days before changes take effect.

18. How can you contact us?

Company: Wenya Labs Pte Ltd · Address: 50 Chin Swee Road, #08-02, Singapore 169874 · Email: info@wenyawanna.ai (subject line: "Privacy Request — [Your Name]"). UK users may contact the ICO (ico.org.uk); Singapore users the PDPC (pdpc.gov.sg); California users the CPPA (cppa.ca.gov); Switzerland users the FDPIC (edoeb.admin.ch). To review, update, or delete your data, email us with the subject "Data Request — [Your Name]" and we will respond within 30 days.

© 2025 Wenya Labs Pte Ltd. All rights reserved. This is a draft document for review purposes only. Not legal advice. Seek independent legal counsel before publishing.