WisWes

GDPR overview

The privacy policy, last updated 9 May 2026, claims GDPR-aligned handling with EU data residency: primary servers sit with Hetzner in Germany, and transfers to US model providers rely on Standard Contractual Clauses or adequacy decisions. Data subject rights - access, rectification, erasure, portability, objection - are recognised for the EU and EEA, the UK and California, with export and deletion buttons in the dashboard and a 30-day response commitment by email. Subprocessors are named one by one, breaches are notified within 72 hours of confirmation, and personal data is redacted from logs. Three things are missing and should be asked for before any European deployment: no customer DPA is published or offered, no Article 27 EU representative is designated, and no data protection officer is named. No security certification is claimed anywhere on the site.

Who owns the data?

Section 8 of the terms is explicit: the merchant owns its store data, FAQs, prompts and the conversations shoppers have with the assistant, and WisWes processes them only to run the service. The privacy policy adds that neither merchant nor shopper data is ever sold, and that WisWes collects no shopper name, email, address or payment detail directly - anything personal that passes through the chat is data the store already held. Five named subprocessors see part of it: Anthropic and OpenAI for inference, Hetzner for EU hosting, Stripe for payments, Resend for transactional email. Everything is deleted within 30 days of cancellation.

Reuse rights

The terms grant WisWes no reuse right beyond operating the service. It processes store data, FAQs, prompts and shopper conversations to answer, to bill and to detect abuse, and exposes the logs back to the merchant for audit and tuning. Foundation models are never trained on them, neither the vendor's nor anyone else's, and the providers it routes to sit on contractual no-training terms; should a future provider ever require training opt-in, WisWes states it would not enable that path without explicit per-tenant consent. Only aggregated, anonymised metrics - chats per day, average response time, which tools fire most - feed platform improvement. On the merchant's side, export and deletion are self-serve buttons in the dashboard, and cancellation triggers deletion within 30 days.

Data retention & training

Hosting summary

Primary servers and the database run on Hetzner infrastructure in Germany, inside the European Union, and both the homepage and the features page advertise EU residency with GDPR-aligned handling. Conversation context sent to the model providers, Anthropic and OpenAI, may be processed in the United States; those transfers rely on Standard Contractual Clauses where required and on adequacy decisions where they exist, and Enterprise customers can ask for routing to EU-resident models instead. Two other subprocessors receive data directly: Stripe for billing details and Resend for account email. Embeddings live in a Qdrant collection scoped to each tenant. Traffic is TLS 1.2 or above in transit, the database is encrypted at disk level, integration secrets are encrypted with a key held outside the application, production access is restricted by SSH key and logged, and dependency scans run on every deploy. Breaches affecting customer data are notified within 72 hours of confirmation. No hosting or infrastructure certification is claimed.