Privacy notice
Version 2026-10-02
Wonder Creator is a place to make things. What you make, and what you bring in to make it, belongs to you. This notice explains what personal data we process, why, for how long, who helps us, and the rights you have under the EU/UK General Data Protection Regulation (GDPR) and India’s Digital Personal Data Protection Act, 2023 (DPDP).
Who we are
Wonder Creator is the controller (GDPR) and Data Fiduciary (DPDP) for the personal data described here. Write to us about privacy at connect@wonderapps.biz.
What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email, password (hashed), name, handle — or, if you continue with Google, the name and email address your Google account shares | Your account and signing in | Contract (GDPR 6(1)(b)); consent / legitimate use (DPDP §§6–7) |
| Profile, Materials, Creations, notes, voice, uploads | Providing the studio you asked for | Contract; your consent |
| Material you ask CreativeMind to work on | AI assistance, only when you use it | Contract; your consent |
| Huddle audio/video, messages | Live sessions — dissolved when everyone leaves; only what you choose to keep is stored | Contract |
| Payment records (amount, status, provider reference) | Licences, payouts, refunds, tax and accounting | Contract; legal obligation (GDPR 6(1)(c); DPDP §7(c)) |
| Sign-in history, IP address, device, audit trail | Security, fraud prevention, accountability | Legitimate interests (GDPR 6(1)(f)); DPDP §7(i) |
| Usage measures (counts and timings, never content) | Improving the product — only if you turn it on | Consent (GDPR 6(1)(a); DPDP §6) |
| Product emails | News about features — only if you turn it on | Consent |
| A message you send us from the Contact page: your name, email address, what it’s about and your words | Answering you | Legitimate interests (GDPR 6(1)(f)); DPDP §7(i) |
We don’t sell personal data, don’t show third-party advertising, don’t track you across other sites, and never use your material to train AI models.
Children
Wonder Creator is for people aged 18 and over. We ask you to confirm your age when you join and don’t knowingly process children’s data; if we learn an account belongs to a child, we close it and erase its data.
Who helps us
A small set of providers process data for us under contract — hosting, database, AI, live media and payments. They’re listed, with what they receive and where, on our subprocessors page. Card and bank details are entered on Stripe’s or Razorpay’s own pages and never reach our servers. Links you paste (for example YouTube) are fetched to show a preview; mood music streams from its licensed source.
International transfers
Our app is hosted in India (Mumbai). Some providers process data in other countries. For data from the EU/UK we rely on adequacy decisions or Standard Contractual Clauses; under the DPDP Act we transfer only to countries the Government hasn’t restricted.
How long we keep it
- Your account and work: until you delete them or your account. Deleting your account erases it immediately; backups roll off within 30 days.
- Expired share links, deleted replies, finished background jobs: purged 30 days after they stop being needed. Capture receipts: 90 days. AI proposals you didn’t act on: 90 days.
- Payment and accounting records: as long as tax and company law require (typically 8 years in India, up to 10 in the EU), then deleted.
- Security and audit records: kept as evidence of what happened and can’t be edited; once your account is deleted they no longer link to your name, email or profile.
- Privacy requests: kept for 3 years after they’re closed, as proof they were handled.
- Messages you send from the Contact page: 12 months, then deleted. Ask us to delete one sooner and we will.
Your rights
- Access and portability — download everything we hold about you in one file: Settings › Privacy & Security › Export my data.
- Correction — edit your profile directly, or ask us to correct anything else.
- Erasure — delete individual work at any time, or your whole account from Settings.
- Withdraw consent — turn usage measures or emails off in Settings, as easily as you turned them on. Withdrawal doesn’t affect what happened before it.
- Object or restrict — to processing based on legitimate interests.
- Nominate someone to exercise your rights if you die or become unable to (DPDP §14).
- Grievance redressal — raise a complaint with us first; we answer within 30 days.
Make any request from Settings › Privacy & Security › Make a privacy request. We track each one and answer within one month (GDPR) / the period DPDP Rules prescribe, whichever is shorter. We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
Grievance Officer and complaints
Our Grievance Officer: Priya Sharma, Grievance Officer. If you’re not satisfied with our answer, you may complain to the Data Protection Board of India, or, in the EU/UK, to your local data-protection authority.
Security and breaches
We protect data with encryption in transit, database-level access rules, two-step verification, audit trails and the other measures on our security page. If a breach affects your data, we’ll tell you and the relevant authorities without undue delay — within 72 hours for supervisory authorities where GDPR applies, and as the DPDP Rules require for the Data Protection Board.
Cookies
We use only the cookies needed to keep you signed in securely. There are no advertising or cross-site tracking cookies, so there’s no cookie banner.
Changes
When this notice changes materially we update the version above and ask you to read and agree again before you continue.