Privacy Policy

1. Who We Are

Wynder ("we," "us," or "our") operates the website at trywynder.com and provides a batch AI image generation platform for content creators. For purposes of applicable data protection law, Wynder is the data controller of personal information collected through the Service.

Contact: grant@trywynder.com

2. Information We Collect

Information You Provide Directly

• Account information — name, email address, and password when you register. If you sign in via Google or GitHub (OAuth), we receive your name and email from that provider.
• Payment information — billing address and payment method details. Payment card information is collected and processed directly by Stripe; Wynder never receives or stores raw card numbers.
• Content and prompts — the text prompts, style configurations, project names, and other content you submit when using the Service.
• Communications — messages you send us via email or support channels.

Information Collected Automatically

• Usage data — features you use, pages you view, batch runs initiated, images generated, credits consumed, errors encountered, and timestamps of activity.
• Log data — IP address, browser type and version, operating system, referring URL, and HTTP request/response data when you access the Service.
• Device information — device type, screen resolution, and browser capabilities collected for compatibility and performance purposes.
• Session data — authentication tokens stored in browser local storage to maintain your logged-in session.

Information from Third Parties

• OAuth providers — if you sign in with Google or GitHub, we receive your name and email address from that provider. We do not receive your OAuth password.
• Stripe — we receive billing event data from Stripe (e.g., successful payment, subscription created, subscription cancelled) to manage your account status.

3. How We Use Your Information

We use the information we collect for the following purposes:

4. AI Processing Disclosures

Because Wynder is an AI-powered service, the following disclosures are important:

Prompt Transmission

When you generate images, your text prompts are transmitted over an encrypted connection to OpenAI's API for processing. OpenAI processes these prompts on our behalf according to their Privacy Policy and Usage Policies. By using the Service, you acknowledge this transmission.

Model Training

Wynder does not use your prompts or generated images to train its own AI models. We have a zero data-training opt-out in place with OpenAI under our API agreement, meaning your prompts are not used by OpenAI to train their foundation models. However, OpenAI may retain API inputs and outputs for a limited period for safety and abuse monitoring in accordance with their own policy — this is outside Wynder's control. We encourage you to review OpenAI's privacy policy for details on their own data handling.

Automated Decision-Making

The Service uses automated content filtering to screen prompts for prohibited content before generation. This is an automated process with no human review of individual prompts in normal operation. If a prompt is rejected, you may contact us at grant@trywynder.com if you believe the rejection was in error.

Human Access to Prompts

Wynder staff may access user prompts and generated images in limited circumstances: (a) to investigate reported abuse or policy violations, (b) to respond to a support request you initiate, or (c) to comply with a legal obligation. We do not routinely review individual user prompts.

5. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

Service Providers

We share information with the following categories of service providers who process data on our behalf under contractual data processing agreements:

• Supabase (database, authentication, file storage) — your account data, prompts, projects, and generated image files are stored on Supabase-hosted infrastructure.
• Stripe (payment processing) — your payment information, billing history, and subscription status.
• OpenAI (AI image generation) — your text prompts are transmitted to OpenAI's API for processing.
• Resend (transactional email) — your email address and the content of transactional emails we send you.

Legal Requirements

We may disclose your information if we believe in good faith that such disclosure is necessary to: (a) comply with applicable law, regulation, legal process, or governmental request; (b) enforce our Terms of Service; (c) protect the rights, property, or safety of Wynder, our users, or the public; or (d) detect, prevent, or address fraud, security, or technical issues.

Business Transfers

If Wynder is involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or a portion of its assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your information is transferred and becomes subject to a different privacy policy.

With Your Consent

We may share your information with third parties for purposes not described in this policy when we have your explicit consent to do so.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. Specific retention periods:

Important note on deletion and third-party providers: When you delete your account, we will delete or anonymize your data from our active Supabase database within 30 days (to account for backup rotation cycles). However, deletion of your account from Wynder does not automatically delete your data from OpenAI's systems. OpenAI may retain API call records independently in accordance with their own privacy policy. We are not able to submit deletion requests to OpenAI on your behalf for historical API calls.

Payment records are retained for 7 years regardless of account deletion to satisfy financial and tax reporting obligations.

7. Your Rights

Depending on where you live, you may have the following rights regarding your personal information. To exercise any of these rights, email grant@trywynder.com with the subject line "Privacy Request." We will respond within 30 days (or as required by applicable law).

• Access — request a copy of the personal information we hold about you
• Correction — request that we correct inaccurate or incomplete information
• Deletion — request deletion of your personal information, subject to our legal retention obligations
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Restriction — request that we restrict processing of your data in certain circumstances
• Withdraw Consent — where we process data based on your consent, you may withdraw it at any time (this does not affect the lawfulness of processing before withdrawal)

We may need to verify your identity before processing a request. We will not discriminate against you for exercising your rights.

8. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) gives you additional rights:

Categories of Personal Information Collected

In the past 12 months, we have collected the following categories of personal information: identifiers (name, email, IP address); commercial information (purchase history, credit usage); internet or other electronic network activity (usage data, log data); and inferences drawn from this information to create a profile about you (for the purpose of providing the Service).

No Sale or Sharing for Cross-Context Advertising

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising.

Your CCPA Rights

• Right to Know — request disclosure of the categories and specific pieces of personal information collected about you
• Right to Delete — request deletion of personal information we have collected (subject to exceptions)
• Right to Correct — request correction of inaccurate personal information
• Right to Opt Out — opt out of the sale or sharing of personal information (not applicable here, as we do not sell or share for advertising)
• Right to Limit Use of Sensitive Personal Information — we do not use sensitive personal information beyond what is necessary for the Service
• Non-Discrimination — we will not discriminate against you for exercising any CCPA right

To submit a request, email grant@trywynder.com with the subject line "California Privacy Request." You may also authorize an agent to submit requests on your behalf, in which case we will require verification of the agent's authorization.

9. EU / EEA Residents (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (GDPR) or equivalent local law. The legal bases for our processing are described in Section 3.

EU Representative

As of the date of this policy, Wynder does not yet have a formally designated EU representative under GDPR Article 27. If our EU user base grows materially, we will appoint one and update this policy accordingly. In the meantime, EU/EEA residents may direct all inquiries to grant@trywynder.com.

Right to Lodge a Complaint

If you are located in the EEA and believe we have violated your rights under GDPR, you have the right to lodge a complaint with your local data protection authority (DPA). A list of EU DPAs is available at edpb.europa.eu. We ask that you contact us first to attempt to resolve the issue.

10. International Data Transfers

Wynder is based in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, which may have different data protection laws than your country.

EU-US Data Privacy Framework

For transfers of personal data from the EEA to the United States, we rely on our service providers' participation in the EU-US Data Privacy Framework (DPF), where applicable. Stripe and OpenAI are both certified under the EU-US DPF. Supabase implements Standard Contractual Clauses (SCCs) for EU data transfers. By using the Service, you acknowledge that your data will be transferred to and processed in the United States.

11. Security

We implement industry-standard technical and organizational measures to protect your personal information, including:

• Encryption of data in transit using TLS 1.2 or higher
• Encryption of data at rest by our database provider (Supabase)
• Access controls limiting employee and contractor access to personal data on a need-to-know basis
• Authentication via bcrypt-hashed passwords managed by Supabase Auth
• Regular review of security practices and third-party provider security commitments

No method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and relevant authorities as required by applicable law.

12. Cookies and Tracking

Wynder uses browser local storage (not traditional HTTP cookies) to maintain your authenticated session. We do not use third-party advertising cookies, tracking pixels, or behavioral advertising networks.

We may use basic analytics to understand aggregate usage patterns (e.g., which pages are visited most often). Any analytics tools we use are configured to minimize personal data collection. We do not currently use Google Analytics or other advertising-linked analytics platforms.

You may clear local storage at any time through your browser settings. Doing so will log you out of the Service.

13. Marketing Communications

We send transactional emails (receipts, account notifications, password resets) as part of providing the Service. These are necessary for the operation of your account and cannot be opted out of while your account is active.

We may also send you promotional emails about new features, offers, or updates. You can opt out of promotional emails at any time by clicking the unsubscribe link in any promotional email or by emailing grant@trywynder.com with the subject line "Unsubscribe." Opting out of promotional emails does not affect transactional emails.

14. Children's Privacy

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete that information promptly. If you believe we may have collected information from a child under 18, please contact us at grant@trywynder.com.

15. Third-Party Links

The Service may contain links to third-party websites, services, or resources. This Privacy Policy applies only to the Wynder Service. We are not responsible for the privacy practices of any third-party site and encourage you to review the privacy policy of any site you visit.

16. Changes to This Policy

We reserve the right to update or replace this Privacy Policy at any time, with or without prior notice, at our sole discretion. Changes take effect immediately upon posting unless stated otherwise. The "last updated" date at the top of this page reflects when the policy was last revised. Your continued use of the Service after any changes constitutes your acceptance of the updated policy. We are not obligated to notify you of every change, though we will make reasonable efforts to communicate significant changes by email or in-app notice when feasible. If you do not agree to the updated policy, your sole remedy is to stop using the Service and delete your account.

17. Contact and Complaints

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Email: grant@trywynder.com
Response time: We aim to respond to all privacy-related inquiries within 5 business days and to complete requests within 30 days (or as required by applicable law).

If you are not satisfied with our response to a privacy complaint, and you are located in a jurisdiction with a supervisory authority (such as an EU data protection authority), you have the right to lodge a complaint with that authority.