GDPR

The middle row is the point most vendors cannot make. We hold the account and the licence; we do not hold the work. Delivering software that runs on your own machines removes the processing relationship rather than papering over it, which is why our DPA is narrow.

• Contract, and steps before a contract. Replying to your demo request, authenticating you, delivering what we agreed.
• Legitimate interests. Keeping the website secure and available, managing business relationships, defending legal claims. We balance these against your rights and you can object at any time.
• Consent. Analytics cookies. You can withdraw it whenever you like.
• Legal obligation. Bookkeeping and tax records we are required to keep.

Send data subject requests to privacy@waybound.ai. Tell us what you want and enough detail for us to find your records, usually the email address you contacted us from.

• We acknowledge requests promptly and respond within one month.
• If a request is complex we may extend by up to two further months, and we will tell you why within the first month.
• We verify identity proportionately. We will not demand documents we do not need.
• There is no charge unless a request is manifestly unfounded or excessive.
• If we cannot fulfil a request in whole or part, we tell you which exemption applies and why.

The full list of rights, covering access, rectification, erasure, restriction, portability, objection and withdrawal of consent, is set out in the Privacy Policy.

You can complain to the Norwegian Data Protection Authority (Datatilsynet), our lead supervisory authority, or to the authority in the EEA country where you live or work. We would rather you raised it with us first, but you are not required to.

We prefer providers that process within the EU/EEA. Where a provider processes data outside the EEA, we rely on the European Commission's Standard Contractual Clauses (2021 version), supported by the EU–US Data Privacy Framework where the provider is certified, and by a transfer impact assessment where one is warranted.

Because the software runs on your own machines and does not call home, no customer code, prompt or artifact is transferred out of your environment by us. The usual source of transfer risk in developer tooling does not arise. What crosses a border is account and billing data, which is what the table above covers.

Our controls are designed against the SOC 2 Trust Services Criteria. We are aligned with that framework; we have not completed a SOC 2 audit and do not yet hold a report, and we will say so plainly rather than imply otherwise in a procurement process.

Measures in place include:

• Encryption in transit for all traffic to this website and our services.
• Least-privilege access, with database policies that stop public interfaces reading data they only need to write.
• Separation of the public website from anything holding customer workloads.
• Review of the providers we rely on before we adopt them, and a deliberately short sub-processor list.
• An on-premise product architecture that keeps customer code and prompts out of our systems entirely.

If a breach affecting personal data we control occurs, we notify the Norwegian Data Protection Authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to individuals, and we notify affected individuals without undue delay where the risk to them is high.

Where we act as your processor, we notify you without undue delay so you can meet your own 72-hour obligation.

We are not required to appoint a data protection officer: we do not carry out large-scale systematic monitoring and we do not process special categories of data at scale. Privacy questions are handled by our privacy contact at privacy@waybound.ai.

We maintain records of our processing activities under Article 30. The Data Processing section is the public summary of them. Our DPA, including the current sub-processor list, is available on request.