How we handle your personal data

1. Who is responsible

This website (growth.wooshai.com) is operated by Woosh AI. Data controller: Han Gu, sole trader, trading as Woosh AI. Woosh AI is not yet incorporated as a company and therefore has no registered company address or tax number. Contact: contact@wooshai.com. We have not appointed a data protection officer; this address is the contact point for privacy matters.

2. What we collect and why

• What you send us through a form: name, contact details (email or phone/WhatsApp), your message, industry, language preference, the source tag of the page you came from, and the version and time of the consent you ticked. Name, contact details and the consent tick are required (without them we cannot answer your enquiry); the message is optional. Purpose: to answer your enquiry and, with your explicit consent, to send related follow-up emails (at most 3 per stage, each with a one-click unsubscribe link). Legal basis: your consent (GDPR Art. 6(1)(a)).
• Messages you send us on WhatsApp: your number, the message, its identifier, the language we detect, the type of automatic reply we sent and the time. Purpose: to reply and keep a record of the conversation; reply STOP, SAIR or 退订 to stop our automated messages. Legal basis: necessary to respond to your request and take steps prior to a contract (Art. 6(1)(b)).
• Site statistics: page path, language, source tag, and a visitor token derived from your IP address and browser information through a keyed hash that rotates daily. Our statistics use no cookies or local storage, keep no raw IP addresses, build no profiles and are not shared with advertising platforms. Purpose: to see which content is read and which channels bring clicks. Legal basis: our legitimate interest (Art. 6(1)(f), minimal pseudonymised site statistics).
• Opt-out records: after you unsubscribe we keep only the contact detail or number and the time, so that we never send you marketing or automated follow-up again. Legal basis: our obligation not to contact you further and our legitimate interest (Art. 6(1)(c) and (f)).

We make no decisions based solely on automated processing that produce legal or similarly significant effects on you; follow-up emails are sent by fixed rules and each can be unsubscribed.

3. Recipients and service providers

We do not sell your data and do not share it with advertisers. To run the website, email and media, the following providers have access to your data; the role of each (processor on our behalf, or independent processing) is stated in its entry:

• GitHub, Inc. (USA) (processor) — lead records, opt-out lists and website content are stored in an access-controlled private repository.
• Vercel, Inc. (USA) (processor) — website hosting and server execution.
• Cloudflare, Inc. (USA) (processor) — storage and delivery of media files such as videos (your browser sends network requests to it when a video loads), and email routing for contact@wooshai.com.
• Resend (USA) (processor) — delivery of confirmation and follow-up emails.
• Google LLC (Gmail, USA) — our mailbox provider: mail sent to contact@wooshai.com is forwarded by Cloudflare Email Routing to our Gmail account, where we receive and answer your emails; form notifications (including your name, contact details and message) are delivered there too. This is a personal Gmail account (United States country version, contracting entity Google LLC) governed by Google's Terms of Service and Privacy Policy, under which Google processes data independently for its own purposes; transfers to it rely on the EU-U.S. Data Privacy Framework, under which Google LLC is certified.
• Meta Platforms Ireland Limited (Ireland) — only when you contact us on WhatsApp; messages travel through the WhatsApp Business platform.

The hosting and network providers above process connection data such as IP addresses for transport and security under their own policies for short periods; that is separate from our own statistics, which keep no raw IP. GitHub, Vercel, Cloudflare and Resend act as processors on our behalf; transfers to them rely on the EU Standard Contractual Clauses included in each provider's data-processing agreement, with supplementary measures. The transfer basis for the Gmail account is stated in its entry above (EU-U.S. Data Privacy Framework). You can ask us at the address above for details of the safeguards.

AI content services (such as OpenAI) are used to draft the articles, assets and generic follow-up templates we publish. We do not automatically send your name, contact details, form message or WhatsApp chat text to AI services; generic content may be generated using non-identifying industry and language options.

4. How long we keep it

• Enquiry and lead records: 24 months from the last contact, then deleted or anonymised in the next monthly clean-up.
• Opt-out records: kept indefinitely (contact detail and time only) so that we never send you marketing or automated follow-up again; replies to enquiries you start yourself and opt-out confirmations are not affected.
• WhatsApp inbound message log: only the most recent records are kept for manual follow-up and are handled together with lead records.
• Site statistics: stored monthly in pseudonymised form for 13 months; expired monthly files are deleted in the next monthly clean-up.

Note: lead records live in a private, version-controlled code repository, and older copies in its version history remain retrievable by us until purged. We handle deletion requests without undue delay and tell you within one month of receipt how they were handled; retrievable version history is included in that handling, and copies in our mailbox are deleted too. For copies held by providers (such as caches at the repository host) we submit the necessary deletion requests and follow up. Where the law allows an extension we explain the reason and the expected completion date within the first month, and for any copy that must be kept or cannot be purged immediately we tell you the basis, the access restrictions and the applicable deletion arrangement.

5. Your rights

You can ask us at any time to access, correct or delete your data, to restrict or object to processing, to receive a copy of your data (portability), or to withdraw consent (without affecting processing before withdrawal). Email contact@wooshai.com. We reply without undue delay and at the latest within one month of receiving your request; if a request is complex and the law allows an extension, we tell you the reason within that first month. You also have the right to lodge a complaint with the Portuguese supervisory authority CNPD (cnpd.pt) or the authority in your own country.

6. Cookies

Visitor-facing pages set no tracking cookies. A single session cookie is set only when the site administrator signs in to the back office; it never applies to visitors.

7. Changes

If this notice changes materially we update the version date on this page and, where necessary, notify you.