Legal
Privacy Policy
This policy explains what personal data Wonderfuel collects, why, who helps us process it, how long we keep it and the rights you have. It applies to the Wonderfuel website and app (together, "Wonderfuel" or "the service").
1. Who we are
Wonderfuel is operated by Digit Draft Kft., registered office: 1133 Budapest, Váci út 112. Fsz. 2. ajtó, Hungary, company registration number: 01-09-437321, tax number: 32685596-2-41 (EU VAT number: HU32685596) ("we", "us"). We are the controller of the personal data described here.
Contact for anything about your data: david@digitdraft.com.
2. What we collect
- Account data. Your email address. If you sign in with Google, we also receive your name, email address and profile picture from Google. We keep the date of your sign-ups and sign-ins.
- Your workspace. What you put into Wonderfuel and what it makes for you: your brands (website, description, competitors, market, topics), the sources you follow, the content items we gather for you, your posting plan, calendar, drafts and scripts, and the channels you connect.
- Recordings and media. Videos and audio you record or upload (which show you and your voice), their transcripts, photos you upload for avatars, and the videos we make from them.
- Your own API keys. If you add a Claude (Anthropic) or Higgsfield key, we store it encrypted and use it only to run the actions you start. We never show it back to you in full, send it to your browser or write it to logs.
- Public information. When you enter a website or follow a source, we read public pages and public posts on the web and on platforms such as Instagram, TikTok, YouTube, X and Reddit. These can include public profiles of other creators and companies.
- Before you sign up. The website address you type on our start page, and the public information we find on its homepage. Your IP address is used for a few minutes to limit how often the start page can be used, and is not stored.
- Usage and technical data. The cost of the paid AI and data calls made for your workspace, and the server logs our hosting providers keep (IP address, browser, time and page requested).
3. Why we use it, and our legal bases
- To provide the service you signed up for: your account, research, plans, drafts and videos. Legal basis: performance of our contract with you (GDPR Article 6(1)(b)).
- To keep the service secure and working: preventing abuse, limiting requests, fixing errors and watching costs. Legal basis: our legitimate interests (Article 6(1)(f)).
- To send you emails you need: sign-in links and messages about your account or these terms. Legal basis: contract, and legitimate interests.
- To read public information about the brands, creators and topics you choose, so we can show you what works. Legal basis: our legitimate interest and yours in researching publicly available content.
- To meet legal obligations, for example accounting and tax rules. Legal basis: Article 6(1)(c).
We do not sell your personal data, we do not use it for advertising, and we do not use your recordings, photos or voice to train AI models.
4. Google user data
If you sign in with Google, we ask Google only for your basic profile: your name, email address and profile picture. We use it only to create your account and sign you in. We do not use it for advertising, do not sell it, and do not share it with anyone except the providers below that run the service. Wonderfuel's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
5. Who processes data for us
We use these providers to run Wonderfuel. Each receives only what it needs for its task, under a data processing agreement or its published terms.
| Provider | What it does for us | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage (your workspace, recordings and media) | EU (Ireland) |
| Google Cloud | Hosting of the app; Gemini AI models (Vertex AI) that read sites and posts and write drafts | EU (Belgium); AI requests may be processed globally |
| OpenRouter | Access to AI models used for research | United States |
| ElevenLabs | Transcribing your recordings | United States |
| WaveSpeed | Removing the background from your videos, when you ask for it | United States |
| Anthropic | The animated story (Claude), on your own key, when you press the button | United States |
| Higgsfield | Avatars and avatar swaps, on your own key, when you press the button | United States |
| Resend | Sending sign-in emails | United States |
| Telegram | Posting reminders, if you connect it | Global |
| Apify, RapidAPI providers, ScrapeCreators, Tavily | Reading public posts, profiles and search results for the sources you choose | United States and other countries |
| Google Fonts | Fonts on our public pages (your browser loads them from Google) | Global |
Where a provider is outside the European Economic Area, the transfer is covered by the EU-US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.
If you connect other channels or tools (for example Slack, Discord, ClickUp or GitHub), we send them what you ask us to, and their own privacy policies apply to it.
6. How long we keep it
- Your account and workspace: for as long as you have an account. When you remove a brand, its topics, sources, content, drafts and media go with it.
- When you ask us to close your account, we delete your account and workspace within 30 days, apart from what the law requires us to keep (for example invoices).
- Server logs: kept by our hosting providers for up to 30 days.
- Rate limiting on the start page: a few minutes, in memory only.
7. Cookies and local storage
We use one cookie that is strictly necessary: it keeps you signed in. We also keep two small settings in your browser's local storage: light or dark mode, and test mode. We do not use advertising or analytics cookies, so we do not ask for cookie consent.
8. Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to david@digitdraft.com; we answer within one month.
You can also complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), 1055 Budapest, Falk Miksa utca 9-11, naih.hu, or to the data protection authority where you live or work.
9. Security
Data travels encrypted (HTTPS). Access to a workspace's data is limited to its members, and the database checks it on every request. Your API keys are stored encrypted, and recordings are stored privately and opened only through short-lived links.
10. Children
Wonderfuel is for businesses and creators. It is not meant for anyone under 16, and we do not knowingly collect data from children.
11. Changes
We will update this policy when the service changes. If a change matters to you, we will tell you by email or in the app before it applies. The date at the top shows the current version.
12. Contact
Digit Draft Kft., 1133 Budapest, Váci út 112. Fsz. 2. ajtó, Hungary. Email: david@digitdraft.com.