Privacy policy

1.1 The controller of personal data described in this policy is ACA GROUP s. r. o., with its registered office at Bardejovská Nová Ves 3092, 085 01 Bardejov, Slovak Republic, Company ID (IČO) 53092996, registered in the Commercial Register of the District Court Prešov, Section Sro, Insert No. 40535/P (the "Controller", "we", "us"). We operate the service woble at woble.ai.

1.2 We have not appointed a data protection officer, because we are not required to under Article 37 GDPR. Questions, requests and complaints about personal data go to privacy@woble.ai or by post to our registered office at Bardejovská Nová Ves 3092, 085 01 Bardejov, Slovak Republic.

1.3 We process personal data in accordance with Regulation (EU) 2016/679 (the GDPR) and Slovak Act No. 18/2018 Coll. on the protection of personal data. Where the UK GDPR applies to people in the United Kingdom, references to the GDPR include it.

2.1 This policy explains how we handle personal data when you use woble, visit our website, or contact us. It covers the app at woble.ai and the public pages around it. It does not cover the services you connect through integrations; each of those has its own policy.

2.2 For your account, for the website, for billing and for support, we are the controller. For the content inside a workspace (messages, files, agent memories, integration data), the organisation that runs the workspace is the controller and we are its processor acting on documented instructions. The Data processing addendum sets out that relationship in detail. If your data sits in a workspace run by your employer or another organisation, that organisation decides how it is used and this policy applies to it only where we act as controller.

3.1 We collect only what the product needs to work. In practice that is:

4.1 We process personal data for the following purposes and on the following legal bases:

5.1 Agents are powered by large language models operated by third-party model providers. To produce a reply, woble sends the relevant part of the channel's recent history, the message that triggered the agent, the agent's instructions and memories, and any attachment the agent needs to read, to a model provider. woble chooses the provider and model for each message automatically.

5.2 Our providers process that data only to return an answer. They do not use it to train their models, and we contract with them on that basis. We do not send integration credentials to a model; keys and tokens are decrypted only inside our own systems at the moment a tool call needs them.

5.3 Because providers are chosen for capability rather than location, a request may be processed outside the European Economic Area. Transfers rely on the safeguards described in article 9. Your stored workspace data itself stays in the EU.

6.1 When you set up your account we ask a separate question: may we read conversations from your workspaces while we work out why an agent got something wrong, and use what we learn to improve how agents behave? This is optional and off unless you turn it on. The product works the same either way, no feature depends on it, and we ask for it separately from the terms so that it is a real choice.

6.2 If you agree, the legal basis is your consent under Article 6(1)(a) GDPR. Access is limited to the members of our team who work on agent behaviour, every access is logged, and the data is used only to improve the product. We do not use it to train models, we do not sell it, we do not show it to other customers and we do not use it for advertising.

6.3 You can withdraw consent at any time under Profile in your settings, or by writing to privacy@woble.ai. Withdrawal stops any further reading from that moment; it does not affect the lawfulness of processing carried out before it. If you want earlier copies removed as well, say so and we will remove them.

7.1 When you connect an integration, you either sign in with the other service (OAuth) or give us a key you created there. We store the resulting token or key encrypted and use it only when an agent, or you, asks woble to act on that service.

7.2 When an agent uses an integration, the request and its result go to that service's operator under their own privacy terms. What comes back is shown in the chat and may be kept in the agent's memory if the agent was told to remember it. You choose which services to connect and which agents may use each one, and you can disconnect any of them from the workspace settings. Disconnecting deletes the stored token.

8.1 Inside a workspace, the people you invite can see the channels and agents they have been given access to. Outside it, access is limited to our staff (only when needed to fix a fault you reported, to investigate abuse, or to answer a support request that includes your content, with every access logged; our staff do not browse customer workspaces), to the subprocessors below, each receiving only what its role requires, and to public authorities where the law requires it. We will tell you about a request from an authority unless we are legally prevented from doing so.

8.2 We use a small number of companies to run woble. Each has a written contract with us under Article 28 GDPR that requires them to protect your data at least as well as we do. By category:

9.1 Workspace data, account data and encrypted backups are stored on servers in the European Union.

9.2 Some subprocessors, in particular AI model providers and email delivery, operate outside the European Economic Area. Where they do, the transfer is made under the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), under an adequacy decision pursuant to Article 45 GDPR (for example the EU-US Data Privacy Framework for certified US companies), or under another mechanism valid under Chapter V GDPR, and only the data needed for that subprocessor's role is sent. Where the UK GDPR applies, the UK International Data Transfer Addendum is used alongside the clauses.

9.3 You can request a copy of the safeguards in place for a particular transfer at privacy@woble.ai.

10.1 We keep personal data no longer than the purpose requires:

11.1 Strictly necessary cookies. The site cannot work without two cookies: a session cookie set by woble.ai that keeps you signed in and contains a session identifier and nothing else, and the cookieyes-consent cookie of the consent manager, which stores the choice you made in the cookie notice so that we do not ask again. Neither is used for anything else. The legal basis is our legitimate interest and Section 109(8) of Slovak Act No. 452/2021 Coll. on electronic communications, which permits cookies that are strictly necessary to provide a service you asked for.

11.2 Consent manager. Our public pages use CookieYes (CookieYes Limited, United Kingdom), which shows the notice on your first visit, records your choice per category and keeps an anonymised log of the consent. Every optional script stays blocked until you have allowed its category, and the log (a random key, your choice, the date and the version of the notice) lets us demonstrate the consent. You can change or withdraw your choice at any time with the "Cookie settings" link in the footer of every public page, which reopens the notice. Withdrawing consent stops further collection; the cookies already set expire or can be deleted in your browser.

11.3 Analytics. If you opt in to the analytics category, we load Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to understand which pages are read and how visitors move around the public site. We use Google Consent Mode v2: all consent signals (analytics_storage, ad_storage, ad_user_data, ad_personalization) are set to denied by default and remain denied unless you opt in; we do not use Google Analytics for advertising, and advertising signals stay denied even after you opt in to analytics. Google Analytics 4 does not log or store IP addresses. Google may transfer data to the United States under the EU-US Data Privacy Framework. Google's own policy is at https://policies.google.com/privacy.

11.4 Advertising measurement. We advertise on Reddit. If, and only if, you opt in to the advertising category, we load the Reddit Pixel (Reddit Ireland Limited, 1 Grand Canal Street Upper, Dublin 4, Ireland) on our public pages and on the sign-up page, so that we can tell how many people who saw one of our advertisements went on to create an account. Until you opt in, the script is inert markup: nothing is fetched from Reddit and no cookie is set. We do not send Reddit your email address, your telephone number or any other identifier of you; the only thing attached to a sign-up is a random account identifier, which Reddit uses to avoid counting the same sign-up twice. Reddit may transfer data to the United States under the EU-US Data Privacy Framework. Reddit’s own policy is at https://www.reddit.com/policies/privacy-policy.

11.5 Meta advertising measurement. We also advertise on Facebook and Instagram. If, and only if, you opt in to the advertising category, we load the Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) on our public pages, the sign-up page and the page shown right after a payment, so that we can tell how many people who saw one of our advertisements went on to sign up, contact us or subscribe. With the same consent, and only then, our server reports those same events to Meta through its Conversions API, because a browser often blocks the pixel. The server report contains the event, the page address, your IP address and browser user agent, the Meta cookies _fbp and _fbc if present, and your email address and account identifier in hashed (SHA-256) form, never in the clear; for a subscription it also contains the price. Meta uses a shared event identifier to count each event once. Until you opt in, nothing is sent to Meta from your browser or from our server. Meta may transfer data to the United States under the EU-US Data Privacy Framework. Meta's own policy is at https://www.facebook.com/privacy/policy.

11.6 We use no other advertising cookies and no other third-party trackers. Inside the signed-in app there are no analytics or advertising cookies at all; only the session cookie is used.

12.1 Data is encrypted in transit and at rest, integration secrets are encrypted separately with keys kept outside the database, workspaces are isolated from each other, and agents ask a person before doing anything irreversible. The Security page describes our technical and organisational measures under Article 32 GDPR in more detail, and how to report a vulnerability.

13.1 Under Articles 15 to 21 GDPR you have the right to access the personal data we hold about you, to have it corrected, to have it deleted, to restrict its processing, to receive it in a structured, commonly used and machine-readable format, and to object to processing based on our legitimate interest. Where we rely on consent, you can withdraw it at any time without affecting processing carried out before withdrawal.

13.2 To exercise a right, write to privacy@woble.ai. We will confirm receipt, may ask you to verify your identity, and will respond within one month, which we may extend by two further months for complex requests as Article 12(3) GDPR allows; we will tell you if that happens. Deletion of an account or workspace is completed within 30 days of the request, including backups. Requests are free of charge unless they are manifestly unfounded or excessive.

13.3 If your data is in a workspace run by your employer or another organisation, that organisation is the controller for it. We will pass your request to them within five working days and help them answer it.

13.4 You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work or place of the alleged infringement. The authority competent for us is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava 27, Slovak Republic, https://dataprotection.gov.sk.

14.1 woble is not for people under 16 and we do not knowingly collect data from them. If you believe a child has an account, write to privacy@woble.ai and we will remove it.

15.1 Some integrations connect woble to your Google account through Google's APIs: Google Calendar (reading your calendars and events, creating and updating events, checking free time), Google Sheets (reading and writing spreadsheets you point an agent to), Google Drive (files the agents create or that you choose), Google Slides (creating a presentation, adding slides to it and reading back one that woble made, using the same per-file Drive permission) and Gmail (searching and reading the threads you name, writing a reply as a draft in your own mailbox, and sending it). Access is granted by you through Google's sign-in screen, limited to the scopes shown there, and can be withdrawn at any time in your Google account settings or by disconnecting the integration in woble, which deletes the stored token.

15.2 Mail is only ever read when you ask an agent to deal with a specific message or search: nothing scans your mailbox in the background, and no message is read for any purpose other than the request in front of you. Nothing is sent from your address until you have seen the exact text on an approval card in the chat and pressed Approve.

15.3 woble's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

15.4 In practice this means: Google user data is used only to provide and improve the feature you asked for (an agent answering your request about your calendar, sheet or file), and only inside your workspace. It is not used to serve advertisements, it is not sold, it is not transferred to data brokers or information resellers, and it is not used, transferred or sold to create, train or improve generalised or foundational machine learning or artificial intelligence models, neither ours nor anyone else's. Humans at woble do not read it except with your explicit consent (article 6), for security purposes such as investigating abuse, to comply with the law, or where it has been aggregated and anonymised so that it no longer identifies anyone.

15.5 When an agent works with Google user data, the relevant part of it may be sent to a third-party AI model provider as part of the request the agent is answering (article 5). Each such request is sent with data collection disabled, so that only model providers that do not retain or train on inputs are used; the data is processed to produce that one answer and for nothing else. We do not use any Google user data to develop, train, fine-tune or improve AI or machine learning models.

15.6 Google user data received through these APIs is stored only as far as the product needs it: the encrypted access token for as long as the integration is connected, and whatever an agent put into a chat message or was explicitly told to remember, which you can delete like any other content (article 10). Disconnecting the integration deletes the token immediately.

16.1 If we change this policy in a way that matters to you, we will show a notice in the app or send an email before the change takes effect and update the date at the top of this page. Minor wording changes may be made without notice.

16.2 Questions, requests and complaints about privacy go to privacy@woble.ai. Everything else goes to hello@woble.ai. Our full company details are on the Company details page. This policy was last updated on 23 September 2026.