Winow app: Privacy Policy
Effective date: 29 September 2026
This policy explains what personal data the Winow mobile app and the service behind it ("Winow") process, why, who helps us process it, how long we keep it and what your rights are.
1. Who we are
Winow is provided by Winow Ltd, Georgiou Christoforou 8, Strovolos 2012, Nicosia, Cyprus ("Winow", "we", "us").
Privacy contact: winowapp1@gmail.com.
Who decides about your data. Winow is used by businesses whose marketing is run either by Winow itself or by a partner agency that uses Winow (the "operator").
- For your account data (your sign-in, profile and device), Winow Ltd is the controller.
- For your business's marketing data and the content you exchange with your operator (campaign figures, reports, approvals, briefs, messages), the controller is Winow Ltd when Winow runs your marketing. When a partner agency runs it, the agency is the controller and Winow processes that data on the agency's behalf. Your agency's own privacy notice then also applies.
2. What the app is for
Winow shows a business how its advertising performs (Meta Ads, Google Ads, Google Analytics 4) in plain language. It also lets the business approve creatives, answer briefs, read reports, get alerts, ask an AI assistant about its own figures and message its account manager. The app is free and contains no advertising.
3. The data we process
Account and identity
- Your sign-in through Sign in with Apple: an account identifier and the email address Apple provides. If you choose "Hide My Email", this is Apple's private relay address.
- Your name, if Apple shares it at your first sign-in, which we save as your display name.
- Your role (for example, owner or member) and which business accounts (workspaces) you belong to.
The shared demo
- When you first sign in, you join a shared demo business with made-up sample figures, so you can explore the app before connecting your own. Everything in the demo is sample data. What you add there — questions to the assistant, comments, approvals, messages — can be seen by other people exploring the demo, and the demo is reset to its sample state every night. Please do not put personal or confidential information into the demo. You can set up your own business in Settings → Workspace; its data is visible only to you, the people you invite and your account manager.
Your business's marketing data
- Campaign names, statuses, budgets and daily figures (spend, impressions, clicks, conversions/leads, revenue, ROAS and derived measures). We read them from the advertising and analytics accounts your business or your operator connected with read-only access. Winow cannot change or delete anything in those accounts.
- Reports, insights, alerts and check-up results computed from those figures.
Content you create or receive in the app
- Questions you ask the AI assistant, its answers and your 👍/👎 feedback on them.
- Messages between you and your account manager.
- Approval decisions, comments and the position of pinned comments on a creative.
- Brief answers, files you upload (documents, images, videos) and access credentials a brief asks for.
- Brief sign-offs: the name you type, the time, and the IP address of the request, kept as the record of your signature.
Device and usage data needed for the service
- A push-notification token for each device you sign in on (at most the 10 most recent devices) and your notification preferences (categories, quiet hours).
- A few interactions that are part of the product: that you viewed an approval (shown in its history), that you opened a report (a read receipt for your operator, only if your operator turns it on), and which notifications you have read.
- Server logs for each request (time, the endpoint called, the result, an account identifier and a request id), used to run and secure the service.
Data we do not collect: location, contacts, photos from your library, camera or microphone input, health data, payment details, the advertising identifier. The app contains no analytics, advertising or tracking SDKs, and nothing about how you use the app is sent to an analytics service. The only third-party code in the app is Google's Firebase Cloud Messaging, used to deliver notifications. Its SDK sends Google limited technical and diagnostic data needed to deliver them.
4. Why we use it (and legal bases under the GDPR)
| Purpose | Data | Legal basis |
|---|---|---|
| Sign you in and keep your account secure | Account and identity, logs | Contract (Art. 6(1)(b)); legitimate interest in security (Art. 6(1)(f)) |
| Show your dashboards, campaigns, reports and alerts | Marketing data | Contract with you or your business |
| Approvals, briefs, sign-offs and messages with your manager | Content you create | Contract; the sign-off record also serves our legitimate interest in proving what was agreed |
| Answer your questions with the AI assistant; write insights and report summaries | Your question, recent conversation, marketing data | Contract |
| Send notifications you asked for | Push token, preferences | Contract; you can switch notifications off at any time |
| Keep the service reliable and investigate errors | Logs | Legitimate interest |
| Meet legal obligations | Any of the above, as needed | Legal obligation (Art. 6(1)(c)) |
We do not sell personal data, use it for advertising, build advertising profiles or track you across other companies' apps and websites.
5. The AI assistant
When you ask the assistant a question, our server sends your question, the recent messages of that conversation and the figures from your business's campaign data needed to answer it to Anthropic's Claude API, which generates the answer. We do not send your email address or your account identifier. The assistant only uses your own business's data, shows its sources and a confidence level, and never makes changes to your advertising accounts. The same service writes the nightly insight, report summaries and the Growth Check-Up narrative from your campaign figures. AI answers can be wrong. Check important figures in the report or with your account manager.
6. Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Google (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Run, Cloud Tasks, Cloud Scheduler, Cloud KMS, Firebase Cloud Messaging, Cloud Logging) | Sign-in, storing app data and files, running our servers, encryption keys, push notifications, logs | EU region europe-west1 (Belgium) for our data and servers. Firebase Authentication and Cloud Messaging are global Google services |
| Supabase | Hosted PostgreSQL database for app data and campaign figures | EU (Ireland, eu-west-1) |
| Anthropic | Generating AI assistant answers, insights and summaries | United States, under Anthropic's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses |
| Apple | Sign in with Apple; delivering notifications to iPhone (through Firebase Cloud Messaging) | Apple's own terms apply |
Data sources, not processors: Meta (Meta Ads) and Google (Google Ads, Google Analytics 4). With read-only permission, we read your business's campaign data from them. We do not send them data from the app.
Where data leaves the EU/EEA, we rely on the European Commission's adequacy decisions (for example the EU–US Data Privacy Framework, where the recipient is certified) or Standard Contractual Clauses.
7. Security
All traffic between the app and our servers is encrypted (HTTPS). Access tokens for connected advertising accounts and credentials submitted in briefs are stored encrypted (AES-256-GCM, with keys managed in Google Cloud KMS), and each time an operator views a credential, it is logged. On your phone, your session is stored in the iOS Keychain. Every request is checked against the business account it belongs to.
8. How long we keep data, and deleting your account
- While your account is active, we keep your account and your business's data so the app can work.
- Deleting your account in the app: open Winow → tap your initials at the top left of Home → Settings → Delete my account. We delete your account immediately: your sign-in account, your profile (name and email), your devices and push tokens, your memberships, and your personal assistant sessions. We also revoke Winow's access to your Sign in with Apple account.
- Your business's data: if you were the last person on your business's workspace, its data stored with Winow — dashboards and campaign figures, reports, check-ups, approvals, briefs and uploaded files, conversations, notifications and shared links — is deleted permanently after a 30-day grace period. If other people still use the workspace, it stays for them. Your campaigns themselves stay untouched in your advertising accounts.
- The shared demo is sample data and is not deleted; anything you added to it disappears at its next nightly reset.
- We keep a record that a deletion took place (date and account, without its content) as proof that we completed it.
- Backups: our database is backed up nightly and backups are kept for 30 days, so deleted data disappears from backups at most 30 days after deletion.
- Shared links you create for a report or check-up expire (check-up links after 90 days) or when you revoke them. Download links for files and exports expire within 24 hours.
- Disconnecting a data source deletes the stored access token for it.
- Logs are kept for 30 days.
- On your phone: the app keeps your last synced figures, your assistant chats and widget data on the device so it works offline. Signing out removes them from the device. Deleting the app removes all of it.
If your business's marketing is run by a partner agency, the agency can also ask us to delete your business's data.
9. Your rights
Under the GDPR you have the right to access your data, to rectification, to erasure, to restriction of processing, to data portability and to object to processing based on legitimate interests. To get a copy of your data (we can export your business's data in a machine-readable format) or to use any other right, email winowapp1@gmail.com. We answer within one month. You may also complain to the Cyprus supervisory authority, the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy), or to the authority in your country.
10. Notifications
The app asks for permission before sending notifications. You can choose categories and quiet hours in Settings → Notifications, or switch notifications off in iOS Settings.
11. Children
Winow is a business tool for adults and is not directed at children under 16. We do not knowingly process children's data.
12. Changes
If we change this policy, we will update the effective date above and, for significant changes, tell you in the app.
13. Contact
Winow Ltd, Georgiou Christoforou 8, Strovolos 2012, Nicosia, Cyprus · winowapp1@gmail.com