In short#
- Wovea works without sign-up: we don’t ask for your name, email or phone number.
- The files and texts you drop in are used only for the action you choose. On the server they are deleted after 24 hours.
- Several actions run on your device and the file never leaves it.
- Results are saved in the library of your browser, not on our server.
- We don’t sell data, we don’t show ads and we don’t use third-party analytics or counters.
Data controller#
- Controller
- Wovea
- Data protection contact
- info@wovea.app
We have not appointed a data protection officer: it is not mandatory for a service like this. Data questions are handled directly by the controller.
What data we process#
- What you upload or type for an action: files (documents, audio, video, photos) and texts. They may contain personal data, yours or other people’s; we use them only to perform the action.
- The result of the action (translation, transcription, extracted text…), while it is on the server.
- Technical connection data: IP address, date and time, requested page and browser. It is used to deliver the website and protect it from abuse.
- What you write to us by email, if you do.
We don’t create accounts or profiles, we don’t link your actions to one another and we don’t know who you are.
What happens on your device#
These actions run in your browser and the file is not sent to our server: remove background, ID photo, enhance photo, convert images (including HEIC to JPG and reducing file size) and video to MP3.
To remove backgrounds and enhance photos, your browser downloads the necessary models from our website once and keeps them in its cache, so it doesn’t have to download them every time. That download does not include your photo.
What we use it for and on what legal basis#
- Performing the action you start (translate, proofread, transcribe, subtitle, extract text, write a description, pick the right action for what you describe): it is the service you ask us for — GDPR art. 6.1.b.
- Protecting the service from bots and abuse: we count AI requests per IP address, up to 60 per hour — legitimate interest in keeping a free service running, GDPR art. 6.1.f.
- Delivering the website and fixing errors using technical logs — legitimate interest, GDPR art. 6.1.f.
- Replying to you if you write to us — your request, GDPR art. 6.1.b.
We don’t make automated decisions that affect you and we don’t build profiles.
If you don't give us the data#
No law or contract obliges you to give us any data: you decide which file or text you drop into Wovea, and whether you do it at all. Without it we can't carry out the action, because that is exactly what we process.
The IP address and the other technical connection data are necessary: without them the website can't deliver its pages or protect itself from abuse.
Artificial intelligence#
Translating and proofreading texts and documents, replying to messages, transcribing and subtitling, extracting text from a photo or a PDF, writing a listing description and understanding what you describe in words are done by language models from Anthropic (Claude) and Google (Gemini). We send them the necessary text, audio or image through the intermediary OpenRouter, which chooses the data centre that handles the request: Anthropic’s, Google’s or that of Amazon Web Services, which also offers Anthropic’s models.
OpenRouter states in its privacy policy that it does not use requests or responses to train models. Anthropic, Google and Amazon state in the terms of their business services that they do not train models on their customers’ data. We don’t use your files or texts for anything other than the action you chose.
AI results may contain errors: check them before using them for anything important (more in the Terms and conditions).
Who else sees the data#
We work with these providers, who process data on our behalf (GDPR art. 28):
- Hetzner Online GmbH (Germany): the server where Wovea runs and where files wait until they are deleted.
- Cloudflare, Inc. (USA): delivers the pages and protects the website from attacks; it sees the technical data of each request.
- OpenRouter, Inc. (USA): intermediary that routes the request to the AI model.
- Anthropic PBC, Google LLC and Amazon Web Services, Inc. (USA): run the AI models, only for the actions that use them.
We don’t share data with anyone else, except where required by law (for example, a court order).
Transfers outside the European Union#
The server is in Germany, within the European Economic Area. Cloudflare, OpenRouter, Anthropic, Google and Amazon are US companies.
Cloudflare, Anthropic, Google and Amazon are certified under the EU–U.S. Data Privacy Framework, which guarantees an adequate level of protection. With providers not listed under that framework, such as OpenRouter, the transfer relies on the standard contractual clauses approved by the European Commission (Decision 2021/914), with the additional safeguards required by Chapter V of the GDPR.
How long it is kept#
- Files, texts and results on the server: deleted after 24 hours; the automatic clean-up runs every hour.
- Request counter per IP: kept only in the server’s memory; it is forgotten after 1 hour and is not stored in any database.
- Web server access logs (with the IP): deleted automatically after 30 days at most.
- AI spending control: records without personal data (action, model, cost and date of each request, without IP or content). They are kept for as long as they are needed for the service's accounting.
- Your library and your browser settings: they are on your device, not on our server; they last until you delete them (see the Cookie policy).
- Emails you send us: while we handle your request and for up to 1 year afterwards, unless the law requires us to keep them longer.
AI providers may keep requests for a limited time to monitor abuse, under their own terms.
Your rights#
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by writing to info@wovea.app. Since we don’t know who you are, tell us which action you used and roughly when, so we can find the data while it is still on the server. We reply within one month, free of charge.
If you think we are not handling your data properly, you can file a complaint with the Agencia Española de Protección de Datos (the Spanish Data Protection Agency, AEPD): www.aepd.es.
Security measures#
The connection to the website is encrypted (HTTPS). Uploaded files are not in a public folder: they can only be downloaded with a long, random identifier known only to your browser. Access to the server is restricted, and whatever is not needed is deleted quickly.
Changes to this policy#
If what we do with data changes, we will update this page and the date it was written.