Responsibility and contact
Send privacy, access, deletion and account-closure requests to bussines@wawyshorts.win. The operator’s legal identity and contact address have not yet been supplied for publication. Controller identification is therefore incomplete; the brand and email do not resolve that requirement.
Participation is intended for adults aged 18 or over. If a child’s information has been submitted, contact this address so it can be assessed and unnecessary data removed. We do not need your exact date of birth for the age declaration.
Information and reasons for processing
Account and work: email, display name, age/terms declaration, authentication records, social links, accepted task instructions, activity, submissions and review outcomes are used to provide the account and task agreement. Password authentication is handled by Supabase; the website does not ask for social-network passwords.
Payments and invitations: wallet transactions, receiving details, payout status, invitation attribution and qualification checks are used to handle rewards and withdrawals. Payment details are encrypted in the application. Financial and agreement records may also be necessary to meet legal obligations and establish or defend claims.
Security: connection IP data, approximate country/city, rate limits and keyed network or payout fingerprints help investigate abuse and protect accounts, funds and service availability. The intended basis is legitimate interests in preventing fraud and securing the service, subject to necessity, proportionality and your right to object. A shared network or estimated location alone does not prove wrongdoing.
Support and AI: questions and replies are stored to continue conversations you request. For a signed-in user, AI receives relevant balances, recent task/withdrawal states and setup flags. It is not supplied your bank numbers, saved PayPal receiving details or passwords. Evidence checks can send accessible posts, video evidence or screenshots to the AI provider. Avoid putting sensitive or unrelated information in chat.
Optional features: public social-profile lookup requests the username you enter from the selected platform and caches available public details. Authorized YouTube connections store channel details and encrypted credentials for requested actions. You can remove saved links, clear chat or disconnect an authorized connection. Where processing depends on consent, you may withdraw it without affecting earlier lawful processing. Essential account processing is not based on a forced marketing consent.
Sources, personalization and decisions
Data comes from you, your browser/connection, linked public profiles and posts, authorized platforms, and payment status recorded by the operator. Vercel may estimate location from an IP address; it is not GPS or a precise home address. Invite attribution comes from the invitation you choose to use.
Offer selection can consider saved platforms, previous work and rotation. If regional pricing is enabled, estimated country and public country groups affect the offered price. The exact amount is shown before you accept and then stays fixed. Ask for review if the estimate is wrong.
Rules may temporarily limit new reservations or flag a referral; AI can identify possible mismatches. Final task approval and payment decisions are not made solely by the AI. You can contest a flag or outcome and request human review through the contact address.
Recipients and external services
Access is limited to your own records, the operator where needed, and providers used to run the service. Supabase supplies authentication, database and file storage; Vercel supplies hosting and AI Gateway; Google Gemini processes AI requests; Resend delivers account, task and payment messages. Relevant receiving information is used with the payout method you select. This is not a public directory of participants.
YouTube API data may include a channel ID/name/image, public video or comment details, credentials for an expressly authorized channel, and delivery records for requested comments. Google and YouTube have their own privacy and service terms. Public profile search does not verify that a user owns a social account.
External Drive, platform and tutorial pages open when you follow a link and have their own policies. No advertising or analytics trackers are added by the current site. The Cookies page explains essential storage and optional invitation attribution.
Providers may process information outside the EEA. Applicable adequacy decisions or appropriate safeguards, such as standard contractual clauses, are required for such transfers. The operator’s provider-contract and transfer assessment is not yet fully documented; this notice does not certify that work is complete. Contact the address above to request the relevant safeguards information.
Retention and deletion
Account and accepted-task records remain while needed to operate the account, settle rewards, resolve disputes or meet applicable legal recordkeeping duties. Retention must be limited to that purpose. A complete schedule for financial records, support history and provider backups has not yet been finalized. No claim of automatic deletion of all records is made.
Public profile cache entries expire after up to seven days. Recent connection-country and keyed network records are removed after 31 days. First-visit duplicate-suppression records expire after 31 days as visits are processed. Separate security watch/review records remain until reviewed and removed.
A first-visit security email may contain the observed IP address, estimated city/country and time. Those email copies currently remain in the receiving mailbox until deleted; database expiry or clearing cookies does not delete them. This mailbox retention still needs a defined deletion process.
Clear chat deletes your saved support conversation in the application. Disconnecting YouTube removes the stored access credential and cancels queued comments; channel and comment history remain until removed separately. Request deletion at the contact address. You may also revoke access in Google Account permissions. These controls do not remove posts already published on a social network or copies retained by external providers under their policies.
Account closure and erasure requests are assessed record by record. Information that is no longer needed should be removed; a necessary accounting or dispute record may be retained with its reason explained. The operator must also address relevant processors and recipients where required.
Your rights and complaints
Depending on the circumstances, you can request access, correction, deletion, restriction or a portable copy of your data, object to legitimate-interest processing, and withdraw consent. You can challenge a significant automated decision and ask for a person to review it.
Send requests to bussines@wawyshorts.win, ideally from your account email. State what you need; do not send passwords or full payment credentials. Reasonable identity checks may be needed. GDPR requests generally require a response within one month; a lawful extension must be explained within that period.
You may complain to a competent data protection authority, including the authority where you live or work. You do not have to resolve a complaint through AI chat first.