Data Processing
A plain summary of the data we process, our sub-processors, and what never reaches us.
Last updated 7 September 2026
1. Processing activities
| Activity | Personal data | Purpose | Retention |
|---|---|---|---|
| Demo and contact requests | Name, work email, company, engineering team size, free-text message, the page the request came from, timestamp | Replying to you and running the sales conversation you asked for | 24 months after last contact |
| Website analytics | Pages viewed, referring source, device and browser type, approximate location from IP, a cookie-based browser identifier | Understanding which pages are useful and improving the site | Per the retention configured on the analytics property |
| Accounts and sign-in | Email address, name, authentication identifiers, session metadata | Signing you in to the web app and keeping the session valid | Life of the account |
| Organisation and licence | Your organisation, its approved email domains, your role in it, your licence and the releases your account has downloaded | Telling one customer's users from another's, admitting only people on an approved domain, and knowing what your organisation is entitled to | Life of the account |
| Invoicing | What was bought, for which organisation, when, and the billing contact and address we invoice | Invoicing the licence and meeting our bookkeeping obligations | As Norwegian bookkeeping law requires, generally five years after the financial year |
| Website operation and security | IP address, request time, user agent, error details | Keeping the site available, diagnosing faults, defending against abuse | Short-term, rolling |
| Business correspondence | Whatever you include in your email to us | Answering you and keeping a record of our dealings | Up to 3 years |
2. What happens when you submit the demo form
The full path, end to end:
- Your entries are validated in your browser, for length limits and a valid email address, before anything is sent.
- The request is written directly to our database over an encrypted connection. Only the fields on the form are sent; no hidden tracking fields are attached.
- Access is one-way: the public form can create a request but cannot read any request back, including its own.
- Only our administrators can read submitted requests, and they do so to reply to you.
- You are not added to a mailing list, and the details are not passed to any advertising or lead-enrichment service.
3. Sub-processors
These providers process personal data on our behalf, under a data processing agreement, for the purposes shown. We keep the list short on purpose.
| Provider | What it does for us | Data it touches | Processing location |
|---|---|---|---|
| Google (Google Analytics and Google Tag Manager) | Website usage analytics, and the tag container that loads it | Analytics identifiers, page views, IP-derived approximate location | EU and United States |
| Supabase | The backend behind this website. It stores demo and contact requests and runs the site's server-side functions | The form fields listed in section 1 | As configured for our project |
| Cloudflare (account service using Better Auth) | Hosting account and session management for the web app | Email address, name, authentication identifiers | As configured for our account service |
| Website hosting and content delivery | Serving this website | IP address and request metadata in technical logs | Named in the sub-processor list available on request |
Where a provider processes data outside the EEA, the transfer relies on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework.
4. What the software does not send us
Once downloaded, CrowdBuilder is installed and operated on your own infrastructure. It does not call home. It holds no channel back to us, reports no usage, and needs nothing of ours to be reachable in order to run. That is why the categories of data that matter most to an engineering organisation are never processed by us:
- Source code, repositories and branches.
- Specifications, plans, tasks and generated artifacts.
- Prompts and model responses.
- Run history and audit logs.
- Credentials and API keys you configure in your environment.
The software does make outbound calls when you tell it to: to the AI model providers and third-party services you connect. Those go from your environment straight to that provider, under your account and their terms. None of them route through us, and we see nothing of them.
Our relationship with your deployment is therefore the account, the licence and the download, and nothing after it.
Where you ask us to assist with a deployment and that gives us access to personal data in your environment, we act as your processor and a data processing agreement governs it.
5. Data processing agreement
A DPA, including the current sub-processor list and transfer safeguards, is available on request from privacy@waybound.ai.
For your rights over this data and how to exercise them, see the Privacy Policy and the GDPR section.
Written to be read and understood rather than to be exhaustive. If you need contractual certainty for a specific situation, ask us and we will put it in writing.