Legal

Privacy Policy

Effective 3 November 2026

This policy explains how Samorastnik d.o.o. (“Wavelens”, “we”, “us”) handles personal data when you visit our website, use the Wavelens service at https://app.wavelens.si, or connect your accounts at other services (such as Google) to it.

1. Who we are

Samorastnik d.o.o., Ozare 19, 2380 Slovenj Gradec, Slovenia. Contact: [email protected].

We have two roles:

Controller for data about our own website visitors, prospects and account holders (for example your name, email address and sign-in details).
Processor for the data our customers bring into Wavelens about their own customers and colleagues (“Customer Data”), such as emails, chat messages, support tickets, billing and product-usage records. The customer decides what to connect and is the controller of that data; we process it only on their instructions and under our agreement with them. If you are one of our customer’s customers and want to exercise your rights, please contact that company; we will help them respond.

2. What we collect

Account data: name, email address, password (stored only as a salted hash), workspace name, role, and sign-in records. If you sign in with an identity provider, the identifier and email address it returns.
Customer Data: whatever the customer connects: messages and their metadata (senders, recipients, subjects, dates), contacts and companies, support conversations, subscription and invoice data, product-usage events, documents, and answers written by AI agents, together with the facts Wavelens derives from them.
Connection credentials: access and refresh tokens or API keys for the services you connect. They are encrypted at rest.
Usage and technical data: server logs (IP address, browser, requests and errors) and audit records of actions taken in a workspace, kept to operate and secure the service.
Enquiries: what you send us by email or through the early-access form.

Our website does not use analytics or advertising trackers and sets no tracking cookies. It loads fonts from Google Fonts, so your browser connects to Google to fetch them.

3. Data from Google APIs

When a user connects a Gmail account, Wavelens asks Google for these permissions:

Read email (gmail.readonly): to import the messages in that mailbox into the customer’s Wavelens workspace, where they appear in the shared inbox and on the contact’s timeline, and to derive facts about customers from them (for example who wrote, which company they work for, and what they asked about).
Send email (gmail.send): to send the replies the user writes in Wavelens from their own address, so the conversation continues in their mailbox.
Email address (userinfo.email): to know which mailbox was connected.

Wavelens’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:

We use Google user data only to provide and improve the user-facing features described above, in the workspace of the customer who connected the account.
We do not sell Google user data, use it for advertising, or use it to determine credit-worthiness or for lending.
We do not use Google user data to develop, improve or train generalized AI or machine-learning models.
We transfer Google user data to others only to provide the service (to the subprocessors in section 5, under contract, such as the AI model provider that processes a message to extract facts from it), to comply with law, or as part of a merger or acquisition with notice to you.
Our staff do not read Google user data unless the customer asks us to (for example for support), it is needed for security (such as investigating abuse), it is required by law, or it has been aggregated and anonymized for internal operations.

You can disconnect a mailbox at any time in Wavelens, or revoke access in your Google Account settings. Disconnecting stops all further access; revoking access at Google as well makes sure the stored tokens can never be used again. Messages already imported stay in the customer’s workspace until the customer deletes them or the workspace, as described in section 7.

4. How we use data, and our legal bases

To provide the service (performance of our contract with the customer): import, organize, search and analyze Customer Data; check what AI agents told customers against the record; send the messages and alerts users ask for.
To run and secure it (legitimate interests): authentication, preventing abuse, debugging, backups, and keeping audit records.
To communicate with you (contract or legitimate interests): service and security notices, replies to enquiries. We send marketing email only with your consent, and you can withdraw it at any time.
To meet legal obligations, such as accounting and responding to lawful requests.

AI processing. Wavelens uses an AI language model to extract facts from messages, check the claims in AI agents’ answers, and draft replies. Before text is sent to the model, email addresses, phone numbers, card numbers, secrets and similar identifiers are replaced with placeholders.

We use these subprocessors to run Wavelens:

Hetzner Online GmbH (Germany): servers and database hosting, in the EU.
Cloudflare, Inc. (USA): network protection and delivery of the service.
Netlify, Inc. (USA): hosting of this website and of the web app’s files.
An AI model provider, which processes the redacted text described above. Today this is DeepSeek, a provider based in China.

We will update this list before adding a subprocessor. Otherwise we share data only with services the customer chooses to connect, when the law requires it, or in a merger or acquisition, with notice.

6. International transfers

Our servers are in the EU. Where a subprocessor processes data outside the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses or an adequacy decision, together with the safeguards above.

7. How long we keep data

Customer Data is kept for as long as the customer’s workspace exists. A customer can delete individual records, erase everything about a person, or delete the whole workspace. We delete a workspace’s data within 30 days of the subscription ending or a deletion request.
Database backups are kept for 14 days, so deleted data leaves the backups within 14 days.
Server logs are kept only as long as needed to operate and secure the service. Audit records are kept for as long as the workspace exists.
Enquiries are kept for as long as needed to answer them and follow up.

8. Security

Data is encrypted in transit (TLS) and connection credentials are encrypted at rest. Every workspace’s data is isolated by database row-level security. Access is limited to people who need it. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

9. Your rights

Under the GDPR you can ask us for access to your personal data, to correct or delete it, to restrict or object to its processing, and for a copy in a portable format. Where we rely on consent, you can withdraw it at any time. Write to [email protected]; we answer within one month.

You can also complain to a data protection authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si).

10. Children

Wavelens is a business service and is not meant for anyone under 16.

11. Changes

We will post changes here and update the date above. If a change is significant, we will tell account holders by email or in the app before it takes effect.

12. Contact

Samorastnik d.o.o., Ozare 19, 2380 Slovenj Gradec, Slovenia · [email protected]