Privacy Policy
What personal data Waybound AS processes, why, and what you can ask us to do about it.
Last updated 7 September 2026
1. Who is responsible
Waybound AS, which trades as Waybound and operates CrowdBuilder, is the data controller for the personal data described in this policy.
Oslo, Norway. Org. no. 937 496 184.
Privacy contact: privacy@waybound.ai
2. What we collect, and why
| Data | Where it comes from | Why we process it | Legal basis |
|---|---|---|---|
| Name, work email, company, engineering team size, your message, and which page the request came from | You, when you submit the demo request form | To reply to you and to run the demo or sales conversation you asked for | Steps taken at your request prior to entering a contract (Art. 6(1)(b)), and our legitimate interest in responding to business enquiries (Art. 6(1)(f)) |
| Email address, name and authentication identifiers | Our Better Auth account service at account.crowdbuilder.ai when you sign in | To authenticate you and keep you signed in | Performance of a contract (Art. 6(1)(b)) |
| Your organisation, the email domains approved for it, your role, and which releases your account has downloaded | Created as your account and licence are set up and used | To tell one customer's users from another's, to admit only people on an approved domain, and to know which release you are entitled to and have taken | Performance of a contract (Art. 6(1)(b)) |
| Invoicing records: what was bought, for which organisation, when, and the billing contact and address | You and your organisation, when you buy a licence | To invoice the licence and meet our bookkeeping obligations | Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Website usage: pages viewed, approximate location derived from IP, device and browser type, referring source | Google Analytics, loaded through Google Tag Manager, once you have consented to analytics cookies | To understand which pages are useful and improve the site | Consent (Art. 6(1)(a)) |
| Technical logs: IP address, request time, user agent, error information | Automatically, by the infrastructure serving this website | To keep the site running, diagnose faults and defend against abuse | Legitimate interest in the security and availability of our website (Art. 6(1)(f)) |
| Correspondence you send us | You, by email | To answer you and keep a record of our dealings | Legitimate interest in managing business relationships (Art. 6(1)(f)) |
We do not ask for special category data, we do not run credit or background profiling, and we make no decisions about you by automated means that produce legal or similarly significant effects.
3. What we do not collect
Being specific about this is more useful than a long list of what we might do:
- We do not receive your source code, specifications, prompts, artifacts or run history. The installed software does not report them to us, and has no channel to.
- We do not sell personal data, and we do not share it with advertising networks or data brokers.
- We set no advertising, remarketing or cross-site tracking cookies on this website.
- We do not build marketing profiles or add demo requesters to mailing lists.
- We do not ask for or hold payment card details. Licences are invoiced, so there is no card to take and no checkout on this site.
5. International transfers
We are based in Norway and prefer providers that process data within the EU/EEA. Some processing, in particular Google Analytics, involves transfer to the United States. Those transfers rely on the European Commission's Standard Contractual Clauses, and, where the provider is certified, on the EU–US Data Privacy Framework.
6. How long we keep it
| Data | Retention |
|---|---|
| Demo and contact requests | Up to 24 months after our last contact with you, then deleted |
| Correspondence | Up to 3 years, or longer where needed for an active or anticipated legal claim |
| Analytics data | For the retention period configured on our Google Analytics property, after which user- and event-level records expire; aggregate reports remain |
| Technical logs | Short-term, on a rolling basis, for security and troubleshooting |
| Account, organisation and approved-domain data | For as long as the account exists, then deleted |
| Download records | For as long as the licence is active, then deleted with the account |
| Contract and accounting records | For as long as Norwegian bookkeeping law requires (generally five years after the end of the financial year) |
7. How we protect it
Our security programme is built around the SOC 2 Trust Services Criteria: least-privilege access, encryption in transit, logging of administrative access, and review of the providers we rely on. We have not completed a SOC 2 audit and do not hold a SOC 2 report. We describe our controls as aligned with the framework, not certified against it.
The largest single protection is architectural: because CrowdBuilder is deployed on your infrastructure, the data most sensitive to you never reaches us and cannot be exposed by a compromise of ours.
Demo requests are stored in a database where they are readable only by our administrators; the form itself can write but not read.
8. Your rights
Under the GDPR you can ask us to:
- Give you a copy of the personal data we hold about you (access).
- Correct data that is wrong or incomplete (rectification).
- Delete your data (erasure), where we have no overriding basis to keep it.
- Restrict how we use it, or object to processing based on our legitimate interests.
- Receive data you gave us in a portable, machine-readable format.
- Withdraw consent for analytics cookies at any time, without affecting processing already carried out.
Email privacy@waybound.ai. We respond within one month and will tell you if we need longer because the request is complex.
You can also complain to the Norwegian Data Protection Authority (Datatilsynet), or to the supervisory authority in the EEA country where you live or work.
9. Children
CrowdBuilder is a business product. This website is not directed at children, and we do not knowingly collect personal data from anyone under 16.
10. Changes to this policy
We update this policy when our processing changes. The version published here is the current one, and the "last updated" date shows when it changed.
11. Contact
Waybound AS, Oslo, Norway. Org. no. 937 496 184.
Written to be read and understood rather than to be exhaustive. If you need contractual certainty for a specific situation, ask us and we will put it in writing.