Who we are
Wynoot helps businesses that run activities, workshops and experiences explain what they offer and take bookings, on a website or app in their own brand. This policy explains how we handle personal data on wynoot.com, in the Wynoot dashboard and on the sites businesses build with Wynoot. It follows the EU General Data Protection Regulation (GDPR).
- Name
- Wynoot
- Contact
- our contact page
Our two roles
- We are the controller for people who visit wynoot.com, contact us, subscribe to updates or create a Wynoot account. We decide why and how this data is used, and this policy is our notice to you.
- We are a processor for the people who visit, sign up on or book through a site a business has built with Wynoot (its customers). The business is the controller of that data and we handle it only on its instructions, under the data processing terms in our Terms. If you are one of those customers, please contact the business directly; its own privacy policy applies, and we will help it answer you.
What we collect and why
We only collect what we need for each purpose. The legal basis is the GDPR article that allows it.
| What | Why | Legal basis |
|---|---|---|
| Account: email address and password | To create your account, sign you in and keep it secure. Your password is never stored in readable form. | Contract, art. 6(1)(b) |
| Business content: your business details, offerings, prices, schedules, texts, images and the rules you confirm in Business Understanding | To build and run your site, app and bookings. | Contract, art. 6(1)(b) |
| Messages to us: email, subject and message, plus the IP address and browser type of the request | To reply to you, and to spot and block abuse of our forms. | Legitimate interest in answering and protecting our service, art. 6(1)(f) |
| Product updates: your email address | To send occasional news about Wynoot. You can unsubscribe at any time. | Consent, art. 6(1)(a) |
| Usage counts: how many actions an account takes per service per day | To apply the daily limits of your plan and keep the service fair for everyone. | Contract, art. 6(1)(b) |
| Security logs: IP address, time and the request made | To keep the service secure and find faults. | Legitimate interest in security, art. 6(1)(f) |
| Emails we must send: account verification, password reset, booking messages | To run your account and the bookings on your site. | Contract, art. 6(1)(b) |
You do not have to give us any of this, but without an email address and password we cannot create an account. We do not ask for special categories of data (such as health data), and we ask businesses not to put it into Wynoot.
AI features
Some features use AI models. They only run when you, or a business, use that feature.
- Business Understanding (beta) reads the information a business gives it and proposes rules, such as age limits or what is included. This is processed in the EU. Nothing a proposal says reaches customers until the business has checked and confirmed it.
- Image analysis and image generation in the site editor send the image or the description to an AI provider that may process it outside the EU. Please do not upload images of identifiable people for these features.
Under their terms, these providers process the data for us and do not use it to train their models. We do not make decisions about people that are based only on automated processing and that have legal or similarly significant effects (GDPR art. 22).
Who we share data with
We do not sell personal data and we do not share it with advertisers. We use a small number of carefully chosen service providers that handle data only on our instructions: cloud hosting and storage, sign-in and email delivery, and AI model providers for the features above. Each is bound by a data processing agreement. Businesses that use Wynoot can ask us for the list.
We may also share data when the law requires it, for example with a court or a public authority, and with professional advisers bound by confidentiality. Payments for bookings are made through the business's own payment provider; Wynoot does not receive card details.
Transfers outside the EU
Business information is stored in the EU. Where a provider handles data outside the European Economic Area, the transfer is protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses (GDPR art. 46). You can ask us for a copy of the safeguards.
How long we keep data
| Data | How long |
|---|---|
| Account and business content | While your account is open. When you ask us to close it, we delete it within 30 days. |
| Messages to us | Up to 2 years after our last contact, unless we need them longer for an ongoing matter. |
| Product updates | Until you unsubscribe. |
| Usage counts | About 13 months, then deleted automatically. |
| Security logs | 90 days. |
| Invoices and accounting records, if you pay us | 7 years, as Dutch tax law requires. |
Backups may hold deleted data for a short time longer, until they are overwritten.
Your rights
You can ask us to:
- show you the personal data we hold about you and give you a copy (access, art. 15);
- correct it (rectification, art. 16);
- delete it (erasure, art. 17);
- limit how we use it (restriction, art. 18);
- give it to you or another provider in a common format (portability, art. 20);
- stop using it where we rely on our legitimate interest (objection, art. 21).
Where we rely on your consent, such as for product updates, you can withdraw it at any time; this does not affect what happened before. We reply within one month. We may ask you to confirm who you are first, so we never give your data to someone else.
You can also complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens; you can also go to the authority where you live or work. We would appreciate the chance to help you first.
How we protect data
We use appropriate technical and organisational measures to protect personal data, including encryption, separating each business's data, and giving access only to the people who need it.
No system is perfectly secure, but we work to keep these measures current. If a breach is likely to put you at risk, we will tell you and the authority as the GDPR requires.
Cookies
We only use cookies and browser storage that the site needs to work. Our Cookie Policy lists them.
Children
Wynoot is a service for businesses and is not meant for anyone under 16.
Changes
When we change this policy we update the date at the top. If a change matters for you, we tell you by email or in the dashboard before it takes effect.
Questions about your data
Ask us anything about this policy or your rights. We reply personally.
Contact us →