Privacy Policy

Last updated: April 30, 2026

Data controller

The data controller is Waibly SAS, registered at 6, rue Antoine Lavoisier, 77680 Roissy-en-Brie, France. For any question about your personal data, please contact hello@waibly.com.

Data collected

Waibly only collects data necessary to provide the service:

— Account data: name, email, hashed password
— Billing data: payment information processed by Stripe (Waibly never stores card numbers)
— Usage data: connected sites, generated content, imported documents
— Technical data: IP address, browser, operating system

Processing purposes

Your data is processed to:

— Provide and improve the Waibly service
— Manage your subscription and billing
— Send account-related information
— Ensure platform security
— Comply with legal and accounting obligations

Legal basis

Processing is based on contract performance (Terms of Service), your explicit consent for marketing communications, and our legal obligations for invoice retention.

Subprocessors

Waibly relies on GDPR-compliant subprocessors:

— OVH (hosting, France)
— Stripe (payment, Ireland/USA — Standard Contractual Clauses)
— TinaCMS (content management, USA — Standard Contractual Clauses)
— Plausible Analytics (anonymous audience measurement, EU)
— Anthropic and OpenAI (AI content generation, USA — Standard Contractual Clauses)

Retention period

Your data is retained for the duration of your subscription. After cancellation, it is deleted within 30 days, except for legal obligations (invoices kept for 10 years).

Your rights

Under GDPR, you have the following rights:

— Right of access
— Right of rectification
— Right of erasure
— Right to data portability
— Right to object
— Right to restrict processing

To exercise these rights, write to hello@waibly.com. You may also lodge a complaint with the CNIL (www.cnil.fr).

Security

Waibly implements technical and organizational measures to protect your data: TLS encryption, hashed passwords, restricted access, regular backups.

Transfers outside the EU

Some subprocessors are located outside the European Union (notably USA). These transfers are framed by the Standard Contractual Clauses adopted by the European Commission.

Changes

This policy may be modified. Any substantial change will be notified to you by email at least 30 days before it takes effect.