Privacy policy
This explains what WayWiser does with personal data. It is written for the people who use WayWiser and for the procurement and IT teams who assess us, so it describes what our systems actually do — including the parts that are not finished.
Anything highlighted in amber is a gap we have not closed yet. We would rather show you those than fill them with something that reads well and is not true.
Last updated 19 September 2026
1. Who we are
WayWiser helps facilities-management contractors write bids for public-sector tenders. You upload your past bids, policies and tender packs; the product searches that library and drafts answers using a large language model.
The controller for the personal data described in section 3 is [legal entity name, company number and registered office to be inserted]. Privacy contact: [monitored privacy mailbox to be inserted]. Security contact: security@waywiser.ai. Our ICO registration number is [ICO registration pending].
We have not appointed a Data Protection Officer. We are not required to, and we would rather say that than name someone who does not hold the role. We hold no security certifications — see Security.
2. Our two roles, and why the difference matters
We are the controller for account and business data: the names and work email addresses of people who use WayWiser, workspace membership, invitations, audit records and our operational logs. We decide why and how that is processed, so this notice applies to it in full.
We are a processor for what our customers upload — past bids, policies, tender packs and the drafts produced from them. Those documents routinely contain personal data: staff names, CVs, referees, TUPE information, signatories. We do not choose what goes into them and we do not use them for our own purposes. The customer organisation decides that, and it is the controller.
So if you are named in a document a WayWiser customer uploaded, and you want to know what is held or want it corrected or removed, ask that organisation — they can act on it, and we will help them. We do not inspect, classify or redact the personal data inside uploaded files; whatever is in the document is stored as it is.
3. What we collect as controller
| What | Where it comes from | Why | Lawful basis |
|---|---|---|---|
| Name, work email address, identity-provider user ID | You, when you sign in | Creating and running your account | Contract / legitimate interests |
| Workspace membership, role, library permissions | Your workspace administrator | Access control | Legitimate interests |
| Invitation records (invitee email, inviting user, role) | A colleague who invited you | Getting you into the right workspace | Legitimate interests |
| Comments, review notes, sign-offs and feedback you write, attributed to you | You | Collaboration features | Legitimate interests |
| Audit records of privileged actions (who did what, when) | Generated by the product | Security, accountability, dispute resolution | Legitimate interests / legal obligation |
| Technical metadata about AI calls and background jobs (model, timing, token counts) | Generated by the product | Running, debugging and costing the service | Legitimate interests |
| Request metadata including IP address, in our cloud platform logs | Your browser | Service operation and security | Legitimate interests |
| Correspondence with us, including rights requests and complaints | You | Answering you, and keeping a record that we did | Legitimate interests / legal obligation |
| Feedback you send from inside the product: the message, the page it was about (as a route pattern, never a tender id), the app version and your browser’s user-agent string | You, when you use Send feedback | Fixing what you reported and improving the product | Legitimate interests |
| Contact-form messages from the public website: your name, email address, message, browser user-agent string and IP address | You, when you use the contact form | Replying to you; the IP address only to limit abuse of the form | Legitimate interests |
Our legitimate interests are: providing a service your employer has contracted for, keeping the platform secure, and being able to show what happened when something goes wrong. You can object at any time (section 8).
Is any of this compulsory?
Your name and work email are necessary to have an account at all — without them we cannot create one and you cannot use the product. Everything else in that table is either generated by running the service or entirely optional: comments, feedback and profile details can be left blank and nothing is withheld from you.
What we do not do
We do not sell personal data. We do not use it for advertising or profiling. There is no advertising, analytics, product-telemetry or session-replay tool in the product — not a reduced set, none at all. The one monitoring tool we use is error reporting (Sentry, stored in the EU): when something breaks it receives the technical stack trace, the route pattern, the software version and an opaque account identifier — never your name, email address, IP address, cookies or session, and by design none of what you typed or uploaded: error messages are capped and scrubbed before they leave, so the most an error can carry is a short technical message.
Data we did not get from you
Two cases. If a colleague invites you, we hold your email address before you have an account. And we retrieve public tender notices from Find a Tender, Contracts Finder and Public Contracts Scotland and store each notice as published; those sometimes include the name, email and phone number of a named procurement officer at the buying organisation. We use that only to display and score tender opportunities inside the product. We never use it for marketing. If you are named in such a notice and want us to stop holding it, contact us.
4. How the AI works, precisely
This is the part a procurement team should scrutinise, so here is the mechanism rather than a reassurance.
Retrieval happens at request time. When the product drafts an answer it searches your library for relevant passages and puts them in a prompt alongside the question. The model remembers nothing between requests.
We do not train on your data. There is no model-training or fine-tuning code anywhere in WayWiser.
What leaves our infrastructure. Prompts — containing your question and passages from your own documents — go to OpenRouter in the US, which forwards them to a model provider. Every request carries a routing restriction limiting it to providers that do not retain or train on inputs. Being precise about that limit: it is a routing control OpenRouter operates, not a signed no-training contract with each downstream provider, and we do not hold one of those today. Uploaded files may be sent to Reducto in the US for text extraction. Retrieved passages are re-ranked by a Google service on a global endpoint.
Your content stays yours. Content you upload is never added to the shared reference library that other customers can search.
No automated decision-making. Nothing in WayWiser makes a decision with legal or similarly significant effect about a person. It produces drafts and decision support that a person reviews, edits and chooses whether to use.
5. Subprocessors and international transfers
Everything is stored at rest in Google Cloud’s London region. The full list of who processes what, and where, is published on our Security page and kept in step with it.
One part of our own service runs outside the UK: the web front end, which builds the pages you see and passes what you type, upload and download to and from our API, runs in Google Cloud’s Belgium region, inside the EEA. Your data passes through it in transit. It keeps nothing on disk; it holds working copies of some workspace details — your company profile and settings, your library list, and the titles of your tenders and questions — in memory until the server is replaced. That transfer rests on the UK’s adequacy regulations for the EEA.
Several of those processors are in the United States: WorkOS (identity data), OpenRouter (prompts including passages from your documents), Reducto (uploaded files) and Resend (email, built but not switched on in production today). Google’s ranking service uses a global endpoint. Error reports go to Sentry in the EU (Frankfurt) — stack traces and opaque identifiers, no content — also under the UK’s adequacy regulations for the EEA.
6. How long we keep things
| What | How long |
|---|---|
| Account and workspace records | While the account is active |
| Feedback sent from inside the product | Until the workspace is deleted — it is one of its records |
| Contact-form messages (name, email, message) | The IP address is removed after 30 days; the message, name and email after 12 months — or sooner if you ask us to delete them |
| Documents you upload, and everything derived from them | Until you delete them, or the workspace is deleted |
| Background job records | 14 days |
| AI call metadata (no prompt or response content) | 365 days |
| Audit records | Kept indefinitely, detached from a deleted workspace |
| Data-export archives you request | Until the workspace is deleted |
| Public tender notices (which may name a procurement officer) | Indefinitely — we have no purge for these yet |
| Cloud platform request logs, including IP addresses | 30 days (our provider’s default; we have not set our own) |
| Encrypted database backups and point-in-time-recovery logs | 7 days |
| Prior versions of stored files | 30 days |
7. Deleting a workspace
A workspace administrator can delete the workspace. That starts a seven-day window which can be cancelled at any time. After it passes, a nightly job erases the workspace’s database records, its uploaded documents and tender packs, any data-export archive previously generated for it, and the accounts of people who belonged to no other workspace. A single audit entry recording that the deletion happened is kept, containing no personal data.
Two kinds of copy outlive that, and we publish the windows rather than implying erasure is instantaneous: encrypted database backups and point-in-time-recovery logs (7 days), and prior versions of stored files (30 days). Both then expire automatically. During those windows the data is not used for anything — it exists only so we can recover from a failure.
8. Your rights
Under UK data protection law you can ask us to give you a copy of your personal data, correct it, delete it, restrict how we use it, or provide it in a portable format. You can object to processing based on legitimate interests, and withdraw consent where we rely on it.
Contact [monitored privacy mailbox to be inserted] and we will respond within one month. We may need to confirm who you are first.
Remember section 2: if your data is inside a document a customer uploaded, that customer is the controller and is the right first point of contact. Tell us anyway if you cannot reach them and we will help.
10. Children
WayWiser is a business tool sold to organisations and is not intended for anyone under 18. We do not knowingly collect children’s data.
11. Changes to this notice
When we change this notice we update the date at the top. If a change materially affects how we use your personal data we will tell account holders directly rather than relying on you noticing.
12. Complaints
Please raise it with us first — we would rather fix it. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or 0303 123 1113.