1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) for this website and the wavebird service is:
We have not appointed a data protection officer. Please direct privacy requests to the contact details above.
2. Purpose of the service
This public chat sends your request and the context needed to answer it to the enabled AI provider. The current text-chat model uses OpenAI. You can send prompts without a wavebird account. The separate ad request does not contain your raw prompt or conversation history.
While the answer is processed, a labeled area can show a banner or clip. The public chat uses house placements to demonstrate this experience; seeing one does not establish paid sponsorship. Ad content is kept outside the model request and answer.
Chat history is kept in your browser, in memory or, with the relevant setting and consent, in localStorage. wavebird does not keep a server-side chat-history feature. Requests still pass through our server and the AI provider; their operational processing is distinct from browser history.
wavebird also provides advertising infrastructure for consumer AI applications. Publisher teams use its API, SDK and dashboard to integrate placements and manage accounts, projects, reporting and payouts. The publisher product has its own processing context and contractual terms.
In publisher integrations, wavebird connects applications to advertising partners using OpenRTB 2.6. A partner request can include permitted topic and language classifications alongside placement, auction and consent fields. Raw prompts and conversation history are excluded from partner ad requests. Technical or pseudonymous identifiers can still be personal data; this boundary does not make every field anonymous.
3. Which data are processed?
We process only the data necessary for operation, security, and provision of the features.
Typically this includes:
- Chat content/prompts: your inputs and, if applicable, limited context are transmitted to OpenAI to generate an answer.
- Uploads/files: if you upload a file, it is transmitted to our server to extract text (e.g., PDF/DOCX). The file is not stored as a product feature. Extracted text may be transmitted to OpenAI if you include it in your prompt.
- Technical metadata: e.g., time, requested URL, user agent, derived security and rate-limit signals.
- IP address: processed purely for technical security/abuse prevention (rate limiting, bot protection) and not for profiling; we do not use it as a persistent product feature.
- Session/security data: e.g., a pseudonymous session ID (cookie), bot verification (ALTCHA), and rate-limit/abuse signals (e.g., counters in Redis).
- Local browser data: e.g., consent status, UI state, and optional (opt-in) chat persistence, statistics/experiments, and telemetry.
- Publisher/dashboard data: when using the publisher product, for example account information (email, company name), payout details (e.g., IBAN, billing email), project and API credentials, and settlement references.
Which data are sent (especially upstream requests to providers) can be viewed transparently at /settings#your-data.
Legal bases: Art. 6(1)(b) GDPR (service provision) and Art. 6(1)(f) GDPR (security, abuse prevention, stable operation). Where consent is required for specific local storage: Art. 6(1)(a) GDPR.
4. Cookies, local storage & consent
We use technically necessary cookies and (in some cases) local storage for core functionality and security. Optional features are disabled by default (privacy-by-default) and are enabled only after your consent.
Where applicable under German law, the legal basis for setting/reading non-essential cookies or local storage is § 25(1) TDDDG (consent). Technically necessary storage is based on § 25(2) no. 2 TDDDG.
Categories (settings: /settings#privacy):
- Necessary: sessionId (httpOnly cookie, usually up to 7 days) for session stability, rate limiting, and secure operation.
- Necessary: bv_token (httpOnly cookie, short-lived and scope-specific) for ALTCHA bot verification.
- Necessary: device_id (httpOnly cookie, up to 365 days) as a pseudonymous security and abuse-prevention signal.
- Necessary: session/security cookies (httpOnly) for stability, rate limiting, bot protection.
- Functional (opt-in): chat persistence in your browser (e.g., threads/model selection in localStorage).
- Statistics & experiments (opt-in): pseudonymous browser IDs (e.g., client_id), session IDs (e.g., ux_eval_session_id), local runtime config (ux_eval_admin_config_v1) and experiment cookies (wb_ads_arm / wb_ads_exp) for A/B tests.
- Telemetry (opt-in, may also be disabled by the operator): latency metrics without prompt content (local flag wepayyourprompt_latency_telemetry).
Withdrawal/deletion: You can change or reset your consent at any time in settings. On withdrawal, related local keys/cookies are deleted.
For details and technical keys, see /settings#your-data.
5. Recipients / processors
Depending on features used, recipients/processors may include:
- Hetzner Online GmbH (Nuremberg, Germany / EU) (hosting/server operations).
- Hetzner Object Storage (Nuremberg, Germany / EU) (object storage, e.g., for technical artifacts).
- OpenAI for the enabled text-chat model and OpenAI image-generation features. If an enabled image-generation feature uses Gemini, Google processes the prompt and any submitted reference images for that request.
- Advertising partners in publisher integrations: permitted matching context and technical auction, placement, consent and delivery fields via OpenRTB 2.6; no raw prompt or conversation history in the partner ad request.
- IONOS as domain registrar. Hosting and object storage are provided by Hetzner as listed above.
- ALTCHA (self-hosted) for bot/abuse protection.
- Self-hosted Redis (Germany) for rate limiting, concurrency, and abuse prevention.
- No third-party analytics or marketing tools.
AI-provider processing is separate from ad delivery. Keeping raw chat content out of an ad request does not mean that an AI provider never receives it. Submitted prompts and the necessary context are processed to provide the requested AI feature.
AI-provider processing may involve countries outside the EU, including the USA, depending on the enabled provider and applicable agreement. Our own hosting location in Nuremberg does not determine the processing location of every external provider. The applicable provider terms and transfer safeguards must be considered separately.
OpenAI Data Controls (short note): According to OpenAI, API data are not used to train models by default. OpenAI may retain prompts/outputs for abuse monitoring for up to 30 days. Depending on contract/configuration, options such as Zero Data Retention (ZDR) or Modified Abuse Monitoring may be available.
6. TLS/SSL encryption
This website uses TLS/SSL encryption so that data you transmit to us is protected during transport. You can recognize an encrypted connection by `https://` in your browser address bar.
7. Retention / deletion
We store personal data only as long as necessary for the purposes of processing.
For this public chat in particular:
- Chat histories are not stored server-side as a chat log.
- The policy target for routine technical server logs is 7 days. Incident investigation, legal duties and security evidence may require longer retention.
- The policy target for optional UX evaluation and latency telemetry is 7 days. Storage and cleanup schedules are configured separately for each record category.
- Pseudonymized technical proof/ledger events (e.g., for evidence/billing) may be retained long-term.
- Local browser data remain until you delete them (e.g., via /settings or browser functions).
8. Your rights
You have the following rights under GDPR:
- Access (Art. 15 GDPR)
- Rectification (Art. 16 GDPR)
- Erasure (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection (Art. 21 GDPR), especially to processing under Art. 6(1)(f) GDPR
- Complaint to a supervisory authority (Art. 77 GDPR)
To exercise your rights, please contact us via the contact details above or by email at info@wavebird.ai.
9. Contact / complaints
For privacy inquiries, contact us at info@wavebird.ai. You also have the right to lodge a complaint with a supervisory authority.