Privacy Policy

This Privacy Policy describes how the operator of watudo ("watudo", "we", "us") collects, uses, shares, and protects information when you use the AI organizational operating system at app.watudo.com and related web, progressive web, or native clients (the "Service").

It should be read together with our Terms of Service. If you use watudo through an employer or client organization, that organization may control workspace data and can have its own policies that apply in addition to this one.

This policy applies to:

• Account users — people who sign up, join an organization, or access the portal
• Organization workspaces — messages, tasks, files, and other content stored for a team
• Website visitors — people who view marketing or legal pages on watudo.com / app.watudo.com without signing in

For account profile data we collect directly (for example your name, email, and authentication records), watudo is the controller (or equivalent under local law).

Organization owners and admins act as controllers for much of the Customer Content in their workspace (messages, tasks, files, CRM, portal data, and similar). watudo processes that content as a processor / service provider to provide the Service. Enterprise customers may request a data processing addendum (DPA) via hello@watudo.com.

Privacy and data-protection notices: hello@watudo.com. Formal registered-entity name and postal address may be updated in this policy when published; until then, that inbox reaches the Service operator.

Account & profile. Name, email address, password (stored hashed by our auth provider), avatar if you add one, organization membership and roles, and optional profile fields you provide (for example job title, phone, or department).

Workspace content. Messages, voice notes and transcripts, tasks, approvals, decisions, CRM records, calendar items, knowledge entries, files and media you upload, notifications, and similar records created in watudo.

Usage & device. Approximate product usage (for example feature interactions needed for reliability), IP address, browser or app type, device identifiers used for push notifications (when enabled), diagnostic logs for security and troubleshooting, and similar technical data from web or native clients.

Communications. Emails and support messages you send us (for example password reset codes, invite emails, or questions to hello@watudo.com).

Billing-related. Organization billing contact email and plan or subscription status when paid or trial plans apply. If we use a third-party payment processor for card payments, card numbers are handled by that processor — we do not store full card numbers on watudo systems.

We do not require sensitive categories of personal data to use watudo. Please avoid putting unnecessary sensitive personal information into chats or files unless your organization has a clear need and policy for it.

• Create and secure accounts, and authenticate sessions
• Operate organization workspaces — chat, tasks, approvals, CRM, calendar, knowledge, integrations, portal access, and related workflows
• Deliver notifications you or your organization enable (in-app, email, or push)
• Provide optional AI features such as message analysis, task suggestions, decision briefs, and voice transcription
• Send transactional email required to operate the Service (sign-up codes, invites, password reset, security or billing notices). We do not send marketing or promotional email unless you opt in; if we do, you can unsubscribe
• Monitor abuse, investigate incidents, and keep the Service reliable
• Improve the product using aggregated or de-identified insights where practical (not by training shared foundation models on your Customer Content)
• Comply with law and enforce our Terms of Service

We do not use personal data for solely automated decisions that produce legal or similarly significant effects about you. AI features are assistive tools for your team; people remain responsible for important actions.

When AI features are enabled for your organization, watudo may send relevant snippets of Customer Content (for example a message thread or audio for transcription) to configured AI providers such as OpenAI to generate outputs.

• AI outputs are assistive. Review important results before acting on them.
• We use AI subprocessors only to provide the feature you requested — not to sell your data, and not to train shared or foundation models for general use across customers.
• Organization admins may limit which AI capabilities are available where the product supports that.

We use cookies, local storage, service workers, and similar technologies that are needed to run the Service. Today these are essential or functional — not advertising pixels or cross-site ad trackers.

• Authentication & session — to keep you signed in and protect account sessions
• Preferences & client state — for example theme or org context stored locally so the app works reliably
• Push & offline support — service worker and related storage so notifications and progressive web / native clients can function when you enable them
• Security & diagnostics — limited technical data to prevent abuse and troubleshoot errors

You can control cookies through your browser settings and notification or storage permissions through your browser, device, or OS settings. Blocking essential cookies may prevent sign-in or core features from working. We do not currently respond to “Do Not Track” browser signals because we do not use third-party advertising tracking; if that changes, we will update this policy.

Native apps may request optional OS permissions (for example notifications or file access) to provide features you choose to use. You can revoke those permissions in system settings.

If you are in the EEA, UK, or a similar jurisdiction, we process personal data under one or more of these bases:

• Contract — to provide the Service you or your organization signed up for
• Legitimate interests — to secure, improve, and support the Service in ways that do not override your rights
• Consent — where required (for example certain optional notifications or marketing), which you can withdraw
• Legal obligation — when we must retain or disclose information to comply with law

We do not sell personal data. We share information only as needed to run watudo:

• Infrastructure — hosting, database, and auth providers (for example Supabase) that store and serve the Service
• Email — transactional email providers (for example Resend) for codes, invites, and account messages
• AI — model providers (for example OpenAI) when AI features process Customer Content
• Push delivery — browser or device push services when you enable notifications
• Payment processors — if and when you purchase a paid plan through a payment provider we designate; that provider processes payment details under its own terms
• Organization members — people in your workspace can see content shared with them according to roles and group membership
• Customer-configured integrations — webhooks or outbound connections your organization enables may send Customer Content to destinations you control; once delivered, that destination's practices apply
• Legal — if required by law, valid legal process, or to protect rights, safety, or the Service
• Business transfers — if we are involved in a merger, acquisition, financing, or sale of assets, personal data may transfer to a successor or affiliate under appropriate confidentiality, and this policy (or a successor notice) will continue to apply unless you are notified otherwise

Subprocessors are bound to protect data appropriately for their role. If we add or replace a material subprocessor that processes Customer Content, we will update this policy and, where appropriate, notify organization admins in-product or by email.

We keep account and workspace data for as long as your organization uses watudo and as needed to operate the Service.

• Active workspaces — retained while the organization account remains active
• After cancellation or termination — we make commercially reasonable efforts to allow an organization admin to export Customer Content for about thirty (30) days where the product supports export and the account is not suspended for abuse or legal risk (see our Terms of Service), then delete or de-identify data from active systems
• Backups & security logs — may persist for a limited additional period (typically up to about ninety (90) days) for resilience, fraud prevention, and incident investigation, then roll off in the ordinary course
• Billing, dispute, and legal holds — retained as long as needed for tax, accounting, or legal obligations

If you delete your account, we remove or anonymize personal profile data we control, except limited records we must keep. Content you contributed to an organization may remain under that organization's control.

Depending on where you live, you may have rights to:

• Access the personal data we hold about you
• Correct inaccurate information
• Request deletion of your personal data
• Object to or restrict certain processing
• Export data in a portable format where applicable
• Withdraw consent where processing is consent-based

To exercise these rights, email hello@watudo.com. We may need to verify your identity before responding. If your data lives primarily in an organization workspace, we may need to coordinate with that organization's admin. We aim to respond within thirty (30) days (or longer where allowed by law, for example if the request is complex), and will tell you if we need more time.

You can also update profile details in Settings, leave organizations you joined, and disable push notifications in your browser or device settings.

If you are a resident of California or another US state with similar privacy laws, this section provides additional information.

We collect the categories of personal information described in Section 4 (identifiers such as name and email; commercial or subscription information when applicable; internet or device information; and Customer Content you or your organization submit). We use them for the business purposes in Section 5.

We do not sell personal information and we do not share it for cross-context behavioral advertising as those terms are commonly defined under the CCPA/CPRA. We also do not use or disclose sensitive personal information for purposes that require a right to limit under those laws, beyond what is necessary to provide the Service.

You may request access, correction, or deletion, or appeal a decision, by emailing hello@watudo.com. We will not discriminate against you for exercising privacy rights. Authorized agents may submit requests with proof of authority. We aim to respond within the timelines required by applicable state law (often 45 days, extendable where permitted).

We use industry-standard measures appropriate to a cloud SaaS product, including encrypted transport (HTTPS), access controls, auth session management, and encryption at rest where provided by our infrastructure providers. No method of transmission or storage is 100% secure. Please use a strong unique password and protect devices that stay signed in to watudo.

Organization admins should invite only trusted members and review roles regularly.

If we become aware of a personal-data breach affecting the Service, we will investigate, take steps to mitigate harm, and notify affected organization admins and regulators as required by applicable law, without undue delay.

watudo and its subprocessors may process data in countries other than where you live, including the United States and other regions where our providers operate. Where required, we rely on appropriate safeguards (such as standard contractual clauses or equivalent mechanisms used by our providers) for cross-border transfers.

watudo is built for workplace and professional teams. It is not directed at children under 16 (or the higher age of digital consent in your region). We do not knowingly collect personal data from children. If you believe a child has provided us data, contact us and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. When we make material changes, we will revise the "Last updated" date and, where appropriate, provide additional notice in the product or by email. We encourage you to review this page periodically.

Privacy questions or requests: hello@watudo.com.

For product terms, see our Terms of Service.