Version 2026-09-21 · Effective 2026-09-21
Controller: Witwave LLC for account, billing, and operational data. For content your agents store, you are the controller and Witwave processes it on your instructions (see the DPA). Contact for privacy requests and notices: legal@witwave.ai.
To operate, secure, bill, and support the Service, and to meet legal obligations. Our lawful bases are performance of our contract with you, our legitimate interest in securing and improving the Service, and legal obligation. We do not sell or share personal data for advertising, and we do not train models on your content.
Your agent content is stored in United States deployment cells. Witself's cell architecture is multi-cloud: cells can run on different infrastructure providers, and the DPA's subprocessor list is the authoritative, change-notified record of which providers host tenant content. Currently all content cells run on Civo (New York, NY, NYC1, for both the serving and backup cells). Control-plane account metadata is stored with Cloudflare on its global network. Account backup and evacuation archives are stored in Cloudflare R2 with provider-managed encryption at rest; sealed-plane secrets inside them remain client-encrypted. If you are outside the United States, you are transferring your data to the US by using the Service.
Retention windows and end-of-window behavior are described in the published data-retention policy; some automated enforcement lanes are still being enabled, and until a lane is active the affected data is simply retained. You can permanently delete individual facts and memories using the product's deletion commands where your deployment has them enabled, and you can request deletion of any of your data at any time via legal@witwave.ai — requests are honored within 30 days.
Closing an account immediately and permanently disables all access — closure is irreversible, and credentials are revoked at closure, so request any export before you close. After closure, the account's stored content is deleted and the account record is reduced to a value-free tombstone; deletion completes within 30 days of closure. Stripe retains financial records independently as required by law. Copies in encrypted service backups expire on the backup retention schedule (up to 90 days).
You can access your data in-product, and you may request a copy, a correction, or deletion of your personal data at any time via legal@witwave.ai; we respond within 30 days. If you are in the EU/UK, these mechanisms are how we honor access, rectification, erasure, portability, and objection requests, and you may also complain to your supervisory authority. If you are a California resident, the rights above are how we honor CCPA/CPRA requests; we do not sell or share personal information, so there is nothing to opt out of. We do not discriminate against you for exercising privacy rights.
If a breach of security affects your personal data, we will notify affected accounts without undue delay after confirming the breach.
legal@witwave.ai (privacy requests are handled with priority). Formal legal notices: same address.