Privacy Policy

Last updated: March 26, 2026

Effective Date: 26 March 2026

Degaus Technologies Ltd (trading as "Wonda") ("Wonda," "we," "our," or "us") operates the website wonda.sh (the "Website"), and provides its customers with the AI-powered social media marketing platform "Wonda" (the "Platform") and other services and functions, as specified in the Wonda Terms and Conditions (the "Services"). Degaus Technologies Ltd is a company registered in England and Wales (Company No. 16769117) with registered office at 1 Mark Square, Mark Square, London, England, EC2A 4EG.

Wonda is committed to transparency in the processing of information. This Privacy Policy describes how we handle your personal data. "Personal data" means any information that is directly linked or can be linked to you.

When This Privacy Policy Applies

This Privacy Policy applies where Wonda acts as a data controller — that is, where we determine the purposes and means of the processing of your personal data.

This Privacy Policy covers:

  • Visitors to our Website
  • Job candidates who apply for positions at Wonda
  • Prospective users who enquire about or sign up for the Platform
  • Users of the Platform

When This Privacy Policy Does Not Apply

This Privacy Policy does not apply where Wonda acts as a data processor — that is, where we process personal data solely on behalf of, and under the instructions of, our users. In such cases, the user is the data controller and is responsible for its own privacy practices.

This Privacy Policy does not apply to employees or contractors of Degaus Technologies Ltd, whose personal data is governed by separate internal privacy notices.

We are not responsible for the privacy practices of our users or any third parties. We encourage you to review the privacy policies of any third party before providing them with your personal data.

PLEASE READ THIS PRIVACY POLICY CAREFULLY. BY ACCESSING OR USING THE WEBSITE OR THE PLATFORM, YOU ACKNOWLEDGE THAT YOU HAVE READ, UNDERSTOOD, AND AGREE TO BE BOUND BY THIS PRIVACY POLICY. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, PLEASE DO NOT ACCESS OR USE THE WEBSITE OR THE PLATFORM.

Personal Data We Collect

Personal Data You Provide to Us

We collect personal data that you voluntarily provide to us, including when you register for an account, use the Platform, contact us, or apply for a job. This may include:

  • Name and contact information — your first and last name, email address, phone number, and postal address
  • Username and account credentials — your chosen username, password, and other authentication information
  • Business information — your company name, job title, industry, and business address
  • Billing and payment information — your billing address, payment card details, and other financial information necessary to process payments (payment card information is processed by our third-party payment processor and is not stored on our servers)
  • Career information — your CV/resume, cover letter, work history, education, and other information you provide when applying for a position
  • Social media account credentials and access tokens — for platforms you connect to the Service, including authentication tokens, account identifiers, and associated profile information
  • Brand assets, style preferences, and marketing materials — logos, colour palettes, fonts, brand guidelines, images, videos, and other creative assets you upload to the Platform
  • AI prompts, instructions, and content creation inputs — text prompts, creative briefs, editing instructions, and other inputs you provide through the chat interface or other content creation features of the Platform
  • Social media content and posting preferences — content you create or schedule for publication, posting schedules, target audiences, captions, hashtags, and other content-related preferences

Personal Data We Collect Through Automated Means

When you visit our Website or use the Platform, we may automatically collect certain information, including:

  • Device information — your device type, operating system, and unique device identifiers
  • IP address — your Internet Protocol address
  • Browser information — your browser type, version, and language preferences
  • Log data — access times, pages viewed, referring URLs, and other diagnostic data
  • Records of AI content generation activities — including prompts submitted, parameters selected, and outputs generated through the Platform
  • Social media publishing history and scheduling data — records of content published or scheduled through the Platform, including timestamps, target platforms, and publication status
  • Social media analytics and performance data — engagement metrics, reach, impressions, click-through rates, and other performance data from your connected social media accounts
  • Usage patterns and feature interaction data — how you navigate and interact with the Platform's features, including frequency of use, features accessed, and workflow patterns

Cookies

We use cookies and similar tracking technologies on our Website and Platform. We use functional cookies that are strictly necessary for the operation of the Website and Platform. We may also use non-essential cookies for analytics and performance purposes, but only with your consent and in accordance with applicable privacy laws.

You can manage your cookie preferences through your browser settings or through any cookie consent mechanism we provide on the Website.

How We Use Your Personal Data

We use the personal data we collect for the following purposes:

  • Provide and maintain the Services — to create and manage your account, provide the Platform's features, process transactions, and deliver customer support
  • Communicate with you — to send you service-related notices, updates, security alerts, and administrative messages
  • Generate AI content — to process your prompts, instructions, and inputs through third-party AI service providers to generate media content (images, videos, posters, style transfers) on your behalf
  • Publish social media content — to access your connected social media accounts to publish, schedule, and manage content on your behalf
  • Analyse social media performance — to process analytics data from your connected social media accounts to provide insights, recommendations, and performance reports
  • Store and manage brand assets — to maintain your brand identity, style preferences, and marketing materials for use in content creation
  • Provide AI-powered recommendations — to analyse your content history and performance data to suggest content ideas, optimal posting times, and marketing strategies
  • Improve our Services — to understand how our Services are used, identify trends, and develop new features and functionality
  • Marketing and promotional purposes — to send you marketing communications about our products and services, where you have consented to receive them or where we have a legitimate interest in doing so
  • Compliance and legal obligations — to comply with applicable laws, regulations, and legal processes
  • Protect our rights and safety — to detect, prevent, and address fraud, security issues, and technical problems
  • Process job applications — to evaluate candidates for employment opportunities

How We Disclose Your Personal Data

We may disclose your personal data to the following categories of recipients:

  • Service providers — we engage third-party companies and individuals to perform services on our behalf, such as hosting, analytics, payment processing, email delivery, and customer support. These service providers have access to your personal data only to perform these tasks and are obligated to protect it
  • Third-party AI service providers — we transmit your prompts, instructions, and input content to third-party AI service providers for the purpose of generating media content. These providers process your data in accordance with their own privacy policies and data processing agreements. We select providers that maintain appropriate data protection standards, but we encourage you to review the privacy policies of these providers
  • Social media platforms — when you connect your social media accounts and use the Platform to publish content, we transmit content and associated metadata to the relevant social media platforms on your behalf and in accordance with your instructions
  • Protection of Wonda and others — we may disclose your personal data if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the Services; (d) protect the personal safety of users of the Services or the public; or (e) protect against legal liability
  • Joint offerings — we may offer services or promotions jointly with third parties. If you participate in such offerings, we may share your personal data with those third parties as necessary to facilitate the offering
  • Compelled disclosure — we may disclose your personal data to government authorities or law enforcement officials if required to do so by law, regulation, or legal process (such as a court order or subpoena)
  • Business transfers — in connection with any merger, acquisition, reorganisation, sale of assets, or bankruptcy, your personal data may be transferred to a successor entity. We will notify you of any such change in ownership or control of your personal data
  • With your consent — we may disclose your personal data for any other purpose with your explicit consent

AI Training Data and Model Improvement

  • We do not use your input content, AI prompts, generated outputs, or any other User Content to train, fine-tune, or improve artificial intelligence models without your explicit prior consent.
  • Third-party AI service providers may have their own data retention, processing, and model training policies. We encourage you to review the privacy policies and terms of service of these providers. Where commercially reasonable, we negotiate data processing terms with providers that restrict the use of your data for model training.
  • Aggregated, anonymised usage data (which cannot be used to identify you) may be used to improve the Platform's features and user experience.

How We Retain and Dispose of Your Personal Data

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data, whether we can achieve those purposes through other means, and the applicable legal requirements.

Specific retention practices include:

  • Social media access tokens and credentials — stored using industry-standard encryption and retained only for the duration of the active connection between your account and the relevant social media platform. Tokens are deleted promptly when you disconnect a platform.
  • AI-generated content — retained in your account until you delete it or your account is terminated, at which point it is securely deleted in accordance with our standard data retention schedule.
  • AI prompts and interaction history — retained for the purpose of providing conversational context within the Platform and are deleted when your account is terminated.

When your personal data is no longer required, we will securely delete or anonymise it in accordance with applicable laws and our internal data retention policies.

Your Rights and Your Choices

Correcting, Updating, and Accessing Your Personal Data

You have the right to access, correct, and update your personal data. You may do so at any time by:

  • Updating your information directly in your account settings on the Platform
  • Contacting us at contact@wonda.sh

We will respond to your request within 30 days. We may request additional information to verify your identity before processing your request.

Removal and Objection

You may unsubscribe from our marketing communications at any time by clicking the "unsubscribe" link in any marketing email we send you, or by contacting us at contact@wonda.sh.

Please note that even if you opt out of marketing communications, we may still send you transactional communications related to your account and use of the Services (such as account verification, purchase confirmations, and security alerts). You cannot opt out of these transactional communications.

If you wish to opt out of receiving postal marketing communications, please contact us at contact@wonda.sh.

Connected Social Media Accounts

You may disconnect any social media account at any time through your account settings on the Platform. Upon disconnection, we will delete stored access tokens and cease accessing that account.

Please note that previously published content will remain on the social media platform and is subject to that platform's own terms of service and privacy policy. We do not have the ability to remove content from third-party social media platforms after publication.

Third-Party Links and Features

Our Website and Platform may contain links to third-party websites, services, or features that are not owned or controlled by Wonda. This Privacy Policy does not apply to those third-party websites, services, or features.

We are not responsible for the privacy practices of any third party. We encourage you to review the privacy policy of every third-party website, service, or feature that you visit or interact with.

International Transfer of Your Personal Data

Your personal data may be transferred to, stored in, and processed in countries other than the country in which you reside, including the United Kingdom, the European Union, the United States, and other jurisdictions where our service providers operate.

These countries may have data protection laws that are different from the laws of your country. We take appropriate safeguards to ensure that your personal data remains protected in accordance with this Privacy Policy, including:

  • Entering into EU Standard Contractual Clauses (SCCs) with data recipients outside the EEA
  • Applying the UK International Data Transfer Addendum to the EU SCCs where transfers are made from the United Kingdom
  • Implementing supplementary measures where necessary, based on transfer impact assessments

How We Protect Your Personal Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

  • Encryption of data in transit and at rest
  • Access controls and authentication mechanisms
  • Regular security assessments and monitoring
  • Employee training on data protection and security
  • Social media credentials and access tokens are encrypted at rest and in transit using industry-standard encryption protocols
  • Access to social media credentials is restricted to automated systems that require them for content publishing — human access is limited to authorised personnel for support and troubleshooting purposes only

While we take reasonable measures to protect your personal data, no method of transmission over the Internet or method of electronic storage is completely secure. We cannot guarantee the absolute security of your personal data.

Children and Privacy

Our Website and Platform are not directed to children under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a child under 18 without verification of parental consent, we will take steps to remove that information from our servers promptly.

If you believe that we may have collected personal data from a child under 18, please contact us at contact@wonda.sh.

Aggregate Data

We may collect, use, and disclose aggregate, de-identified, or non-identifiable data derived from your use of the Website and Platform for any purpose, including but not limited to improving our Services, monitoring usage patterns, analysing trends, and for research and development.

This aggregate data does not identify you personally and is not subject to this Privacy Policy. We may disclose aggregate data to third parties, including advertisers, business partners, and the general public.

Territory-Specific Terms

EEA and the United Kingdom

If you are located in the European Economic Area (EEA) or the United Kingdom, the following additional terms apply to you.

Legal Basis for Processing

We process your personal data on one or more of the following legal bases:

  • Performance of a contract — processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract (e.g., providing the Services, managing your account)
  • Legitimate interests — processing is necessary for our legitimate interests or the legitimate interests of a third party, provided that such interests are not overridden by your rights and freedoms (e.g., improving our Services, fraud prevention, marketing)
  • Legal obligation — processing is necessary to comply with a legal obligation to which we are subject (e.g., tax reporting, responding to lawful requests from authorities)
  • Consent — you have given your explicit consent to the processing of your personal data for one or more specific purposes (e.g., marketing communications, non-essential cookies)

Your Data Protection Rights

Under the UK GDPR and EU GDPR, you have the following rights:

  • Right to Access — you have the right to request a copy of the personal data we hold about you
  • Right to Data Portability — you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller
  • Right to Rectification — you have the right to request that we correct any inaccurate or incomplete personal data we hold about you
  • Right to Objection — you have the right to object to the processing of your personal data where we rely on legitimate interests as our legal basis
  • Right to Restrict Processing — you have the right to request that we restrict the processing of your personal data in certain circumstances
  • Right to Erasure — you have the right to request that we delete your personal data in certain circumstances
  • Right to Lodge a Complaint — you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State or UK jurisdiction where you reside, where you work, or where the alleged infringement took place
  • Right to Refuse or Withdraw Consent — where we rely on your consent to process your personal data, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal
  • Right Not to Be Subject to Automated Decision-Making — you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you

To exercise any of these rights, please contact us at contact@wonda.sh. We will respond to your request within one month of receipt, or within the time period required by applicable law.

International Transfers

Where we transfer your personal data outside the EEA or the United Kingdom, we ensure that appropriate safeguards are in place, including:

  • EU Standard Contractual Clauses (SCCs) approved by the European Commission
  • The UK International Data Transfer Addendum to the EU SCCs, as approved by the UK Information Commissioner's Office
  • Any additional supplementary measures required following a transfer impact assessment

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Email: contact@wonda.sh

Address: Degaus Technologies Ltd, 1 Mark Square, Mark Square, London, England, EC2A 4EG

For general support enquiries, you may also contact us at contact@wonda.sh.