1. Who is responsible?
Wijs is provided by Ribba B.V., Maashaven Zuidzijde 2, 3081 AE Rotterdam, the Netherlands, registered with the Dutch Chamber of Commerce under number 99098199. Ribba B.V. is the controller of the personal data we process for Wijs.
For privacy questions or requests to exercise your rights, email [email protected] or write to our address with the reference ‘Wijs privacy’. This policy covers wijs.ai, your registration for access and your use of the Wijs app. The data we process depends on the features you use.
2. Data on the website
We have not integrated advertising pixels, session recordings or marketing analytics into this website. Images and fonts are served with the website. Visiting the landing page does not start an AI task. Registering for access is not consent to general advertising. If we want to send newsletters or other marketing messages, we request separate consent where required.
- Visit data: our hosting and network providers process information including your IP address, requested URL, date and time, browser details and technical error or security information. This is needed to deliver the website and address failures and abuse.
- Language preference: selecting Dutch or English saves that preference locally in your browser. The /nl-nl or /en-nl address determines the language shown. You can remove the local preference in your browser settings.
- Registration: when you leave your phone number to get access to Wijs, we store your number, chosen language, registration time and a record of your request. We use this information to manage your registration, recognise duplicate requests and inform you about access to Wijs, for example by text message. Your number is not made public.
- Contact: when you email us, we receive your email address, message and any attachments. Share only what is needed to answer your question.
Cookies and local storage
We only use functional cookies and local storage to operate and secure the website and remember your language. We do not place advertising or tracking cookies and have not integrated marketing analytics or session recordings. The cookie banner is therefore an information notice: selecting ‘Got it’ does not consent to tracking.
Your language preference is stored locally under werker.language; this internal name was retained after the name change. Acknowledgement of the cookie notice is stored under wijs.cookie-notice.v1 with a version and timestamp. We honour it for up to 180 days so the notice does not appear on every visit. This data is not sent to our registration database. You can always reopen the notice using ‘Cookie information’ in the footer.
Our hosting and security providers may use necessary security cookies, for example when checking automated traffic. Which ones appear depends on the security features used and your visit. You can clear or block cookies and local storage in your browser; this may affect essential security features. If we add non-essential cookies, we will first provide specific information and request consent before placing them.
3. Data when using the app
Wijs is an AI assistant that researches information and carries out tasks at your request using a browser on a cloud computer. We retain the conversation and relevant context so you do not have to start again with each task. A website visit or registration alone does not give the assistant access to your device or other accounts.
- Account and preference data, such as your phone number, account identifier, language and preferences you provide.
- Instructions, chat messages, answers, memory items, task status and any schedules, so the assistant can carry out your task and retrieve relevant context.
- Files, images or other content you voluntarily provide to an available feature, and browser observations and screenshots associated with the task.
- Browser data, including visited pages and a retained browser profile. Websites may save their own cookies and session data in that cloud browser.
- Technical execution and security data, such as timestamps, errors and authorised actions.
- If you enable notifications: the necessary device information and a push token to inform you about tasks or questions requiring your attention. You can disable notifications in your device settings.
Share only what is needed for your task. Do not put passwords, payment card security codes, citizen service numbers or identity documents in chat. Information you enter on an external website is also processed by that website. Processing special categories of data, such as health data, requires an appropriate legal exception in addition to a GDPR legal basis. Where required, we ask for separate explicit consent beforehand; merely putting information in chat is not a substitute. Without an appropriate exception, you may not have Wijs process such data.
Data comes from you, sources you share and public pages visited for your task. Do not provide other people’s personal data without a valid reason. Our own obligations towards those people still apply when we process their data.
We do not use the contents of your conversations or files to train general-purpose AI models. Model processing uses Scaleway Generative APIs; Scaleway’s policy states that requests and responses are not used to train the base models. An authorised staff member may review necessary content when investigating a reported issue.
4. Our purposes and legal grounds
- Delivering and securing the website: our legitimate interest in operating a functioning, secure website (Article 6(1)(f) GDPR). We limit processing to what is needed and balance this against your privacy interests.
- Managing your registration for access and informing you about it: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). We send only messages related to your request for this purpose. You may withdraw your request at any time through [email protected].
- Answering your question: steps you request before a contract, or performance of a contract, where your question relates to this (Article 6(1)(b) GDPR). For other correspondence, we rely on our legitimate interest in handling your message.
- Carrying out your tasks and retaining the context you request: performance of the Wijs agreement, to the extent processing is necessary for it (Article 6(1)(b) GDPR).
- Investigating failures, abuse or a dispute: our legitimate interest in protecting the service and people concerned and handling legal claims. We use only relevant data for these purposes.
- Complying with a legal obligation: for example a valid statutory information request or applicable record-keeping obligation (Article 6(1)(c) GDPR).
- Optional processing requiring consent, such as non-essential cookies or marketing messages: we ask separately and in advance (Article 6(1)(a) GDPR). You may withdraw consent at any time without affecting other features that do not depend on it.
A privacy policy provides information; it is not blanket consent. Using the website or reading this policy therefore does not mean that you agree to every possible use of data. Providing contact or account data is voluntary, but we may be unable to answer a question or carry out a task without information that is genuinely necessary.
5. Who receives data?
- Vercel hosts and distributes this website globally and processes technical visit and security data in doing so.
- Supabase stores registration data in a database in Paris, France. The form sends your request through a Vercel server function in Paris. Only the server can access the registration table; it is not publicly readable.
- Cloudflare provides DNS for wijs.ai and, when its proxy is enabled, may also process website traffic and security information.
- Our email provider processes messages you send to [email protected].
- Scaleway processes the instruction and context needed for a model response. Boxd provides cloud computers containing the agent workspace and browser. We may use a Bright Data or Oxylabs network/proxy service to access external websites. It processes connection details such as destinations and times. Not every provider is involved in every task.
- When we send an access or verification text message, our SMS provider Bird processes your phone number, message content and delivery status. If you use push notifications, the relevant Apple or Google services process the information needed to deliver the notification to your device.
- A website visited through the cloud browser receives information needed for that visit, such as the browser’s or proxy’s network address, search terms and information you intentionally enter there. Its operator is generally an independent controller for that processing.
- Where legally required or necessary for a specific legal claim, relevant data may be shared with competent authorities or professional advisers.
We do not sell your personal data. Providers processing personal data on our behalf must operate under appropriate data processing arrangements. Some providers also process certain security or service data for their own lawful purposes; their own privacy information is relevant to that processing. We share only information necessary for the feature used. You may ask which providers are actually involved in processing your data.
6. EU processing and international transfers
AI model processing is configured to use Scaleway in France. This does not mean all Wijs data stays exclusively in the EU. Vercel and Cloudflare operate international networks. Visited websites and cloud computer, communications and proxy providers may process data outside the European Economic Area (EEA). We do not give a general guarantee that Boxd cloud computers are located exclusively in the EU.
Transfers outside the EEA for which we are responsible require a valid transfer mechanism, such as an adequacy decision or the European Commission’s standard contractual clauses, together with the required assessment and additional safeguards where necessary. A European website, Dutch proxy or encryption alone does not replace those requirements.
Vercel describes its transfer arrangements in its data processing terms. You may ask which countries, providers and safeguards apply to your data and request a copy of relevant safeguards, with confidential information removed where necessary. Reading this privacy policy does not in itself authorise an international transfer.
7. How long is data kept?
- Registration for access: no more than 12 months after registration, or less if you withdraw your request or the registration is no longer needed. If you receive an account, data necessary for that account is retained under the account rules below; other registration data is deleted.
- Form abuse prevention: we retain a daily rotating keyed digest of your IP address with a request counter for approximately 24 hours at most. Your raw IP address is not stored in the registration table. This helps limit automated and repeated submissions.
- Language preference: kept locally until you change it or clear your browser data. This is not a visitor profile maintained by us.
- Contact messages: up to 12 months after your question is resolved. Only correspondence still needed for an ongoing agreement, legal obligation or specific dispute is retained longer for that purpose.
- Technical website data: retention depends on the type of security log and hosting service used. We do not create a separate visitor database or traffic-log archive for this static website. Providers have their own operational log retention periods; relevant incident data may remain necessary until an incident is resolved.
- Account data, conversations, memories, files and browser profiles: while your account is active and they are needed for your conversation or tasks. You may request deletion earlier. Closing your account removes content and files and requests deletion of linked cloud computers. Failed deletion requests are retried; technical cancellation and deletion status records may remain until this is complete.
- Invoice and tax records, if you use a paid service: records covered by Dutch tax retention duties are generally kept for 7 years. This does not justify retaining entire conversations or browser histories.
- Exceptions: only data still necessary for a specific statutory retention duty or legal claim is retained with restricted access for that purpose. Such an exception does not mean that we retain your entire chat history.
Disconnecting a service or closing a browser session does not automatically erase earlier conversations. Explicitly request data or account deletion if that is what you want. Deletion at Wijs also does not erase information received by a visited website under its own responsibility. When requesting deletion, you may ask how recovery copies and provider-held data are handled; we do not promise instantaneous deletion from every provider system.
8. Security and human oversight
The website uses HTTPS. The app architecture separates the agent environment, browser environment and control layer. Stored conversation content and files are encrypted in the backend, and technical provider keys are kept outside the agent environment. The service needs to decrypt content to carry out your task. This is therefore not end-to-end encryption where only you can read the content.
A dedicated virtual machine is a security measure, not a guarantee against every error or attack. Access for administration, support and security investigation must be limited to what is necessary. We handle personal data breaches under the GDPR, including notifying the regulator and affected people when required.
Wijs uses AI to produce answers and suggestions and retrieve relevant context. We do not make solely automated decisions about matters such as your creditworthiness, employment or admission that have legal or similarly significant effects on you. Actions requested by you remain limited by your instruction and the authorisation required. You can always raise a question or objection with a person at [email protected].
9. Your rights
Subject to the applicable legal conditions, you may request access, correction, erasure, restriction of processing and portability of data you provided. You may object to processing based on legitimate interests. You may always object to direct marketing. You can withdraw consent without affecting the lawfulness of earlier processing.
Send your request to [email protected]. We normally respond within one month. For complex or numerous requests, this may be extended by up to two further months; we will notify you within the first month and explain why. We may request necessary additional information to verify your identity, but do not routinely require a full copy of your identity document.
You may lodge a complaint with the Dutch Autoriteit Persoonsgegevens or, where applicable, the supervisory authority in the EEA country where you live or work. You do not have to complain to us first. Your right to seek a judicial remedy remains intact.
10. Age and changes
Wijs is intended for people aged 18 and over. Please contact us if you believe a minor has shared data with us without appropriate permission.
The date at the top identifies the latest revision. We actively inform existing users of material changes affecting them. Before new features process different data, we provide information and request separate consent where legally required.