Privacy Policy

Last updated: 10 August 2026

This Privacy Policy sets out how Refros Solutions B.V. ("Cwaize", "we", "us", or "our") processes personal data in connection with the Cwaize service and the website at cwaize.com.

Cwaize enables businesses to add an interactive layer to their own videos, allowing visitors to their website to ask questions about a video and receive answers. Because of how the service operates, we process personal data in two distinct roles. This policy is structured around that distinction, and the section "Our role: controller and processor" determines which parts apply to you.

Who we are

The Cwaize service is provided by:

Refros Solutions B.V.
Verdunplein 17, Unit C5986
5627 SZ Eindhoven
The Netherlands

Chamber of Commerce (KvK): 96725648
VAT: NL867733706B01

For any question or request relating to this policy or your personal data, contact us at support@cwaize.com.

Where this policy states that we act as a controller, Refros Solutions B.V. is the data controller for the personal data concerned.

Our role: controller and processor

Data protection law distinguishes between a controller, who determines the purposes and means of processing, and a processor, who processes personal data on the controller's behalf and under its instructions. Cwaize acts in both capacities, depending on whose data is involved.

Controller — our customers' account data. When a business creates a Cwaize account, we determine how their account information is processed, including their email address, login credentials, billing details, and the videos they upload. This policy describes that processing, and our customers may exercise their rights directly against us.

Processor — website visitors' data. When a visitor to our customer's website submits a question through the Cwaize widget, we process that visitor's data on behalf of our customer. In this context, our customer is the controller and determines why the widget is used and for what purpose. If you are a visitor asking a question on a website that uses Cwaize, the operator of that website is the controller of your data, and you should consult their privacy policy. We process such data solely to provide the service to our customer, under a data processing agreement.

The remainder of this policy concerns primarily the data for which we are the controller. Processing carried out in our capacity as processor is described for completeness, but the controller in those cases is our customer.

Personal data we process and our legal basis

We process the following categories of personal data, each for a defined purpose and on a specified legal basis under the GDPR. We limit collection to what is necessary to provide the service.

Account and profile data. When you create an account, we process your email address and login credentials. If you invite team members, we process their email addresses and workspace roles.
Purpose: to create and secure your account, enable sign-in, and manage access to your workspace.
Legal basis: performance of a contract (Article 6(1)(b) GDPR).

Billing data. Our payment provider, Stripe, collects your payment and billing details directly. We do not receive or store your full card number. We retain a reference to your subscription and your billing email in order to manage your plan and issue invoices.
Purpose: to process payments, administer your subscription, and meet our accounting obligations.
Legal basis: performance of a contract (Article 6(1)(b) GDPR) and compliance with a legal obligation (Article 6(1)(c) GDPR).

Videos and knowledge content you provide. To use the service, you upload videos and may add written knowledge to support the AI's answers. Videos may contain the personal data of individuals who appear or speak in them. You are responsible for holding the necessary rights to this content and for informing any individuals in it as required.
Purpose: to analyse your video so the service can answer questions about it, and to store your content so the widget functions.
Legal basis: performance of a contract (Article 6(1)(b) GDPR). Where your content contains other individuals' personal data, you act as the controller for that content and rely on your own legal basis.

Questions submitted through the widget. When a visitor submits a question, we process the text of the question and the answer provided, together with a short-lived session identifier and limited technical information (see below). Questions are free text and may contain any information the visitor chooses to enter.
Purpose: to generate an answer and to provide our customer with analytics on the questions their audience asks, including questions their content did not address.
Legal basis: in this context we act as a processor on behalf of our customer, who is the controller and determines the legal basis. We process this data under our data processing agreement with them.

Technical and usage data. When the service is used, we process limited technical data: the country of a request (at country level only), the device type (such as mobile or desktop), the website domain on which the widget is installed, and standard server log data generated by our infrastructure providers, which may include IP addresses and browser information. We do not store raw IP addresses in our own database.
Purpose: to secure the service, prevent abuse, understand usage in aggregate, and diagnose technical issues.
Legal basis: our legitimate interests in operating, securing, and improving the service (Article 6(1)(f) GDPR).

How the AI processes your data

Cwaize uses artificial intelligence to answer questions about your videos. We consider it important to be clear about what this involves.

To make a video answerable, we send it to Google's Gemini AI service for processing. When a visitor submits a question, we send the question and the relevant parts of your video's content to the same service to generate an answer. Written knowledge you add is processed in the same way.

Two points are relevant:

• Your data is not used to train Google's AI models for Google's own purposes. It is processed only to return answers to the service.
• The AI does not make decisions about individuals. It answers questions. It does not profile visitors, score individuals, or make any decision producing legal or similarly significant effects (see "Automated decision-making").

Google acts as our sub-processor for this processing. Google is located in the United States; see "Data location and international transfers" for the safeguards that apply.

Service providers

We rely on a limited number of providers to operate Cwaize, and we share only the data each requires. Each provider is bound by contract to protect the data it processes. We do not sell personal data, and we do not share it for advertising purposes.

We may update this list as the service develops. Business customers may request notification of changes to our sub-processors (see "Business customers and data processing agreements").

Data location and international transfers

Your data is stored in the European Union, with our database and uploaded content hosted in Stockholm.

Certain providers are established in the United States, which involves a transfer of limited personal data outside the EU. We carry out such transfers only with appropriate safeguards:

• Google and Stripe are certified under the EU-U.S. Data Privacy Framework, an adequacy mechanism recognised by the European Commission for transfers to certified U.S. organisations.
• For providers not certified under that framework, transfers are governed by the European Commission's Standard Contractual Clauses.

The legal framework for EU–U.S. transfers is subject to change. Should a mechanism on which we rely cease to be valid, we will transfer the relevant data on an alternative lawful basis.

Retention

We retain personal data only for as long as necessary for the purposes set out in this policy.

• Account data: for the duration of your account. Following cancellation, we retain it for up to 90 days before deletion, except where we are legally required to retain certain records for longer, such as invoices for tax purposes.
• Questions submitted through the widget: retained for up to 12 months to provide analytics and improve answers, after which they are deleted. Where we act as a processor, our customer may specify a different period.
• Billing records: retained for the period required by applicable tax and accounting law.
• Technical and server logs: retained briefly for security and troubleshooting, then removed by us or our infrastructure providers in line with their retention practices.

When you delete your account, your content — including your videos and the associated data — is removed.

Your rights

Under the GDPR, you have the following rights in respect of your personal data:

• Access — to obtain confirmation of, and a copy of, the personal data we hold about you.
• Rectification — to have inaccurate or incomplete data corrected.
• Erasure — to have your data deleted ("right to be forgotten").
• Restriction — to limit how we process your data.
• Portability — to receive your data in a portable format, or have it transferred where technically feasible.
• Objection — to object to processing based on our legitimate interests.
• Withdrawal of consent — where we rely on consent, to withdraw it at any time.

To exercise any of these rights, contact support@cwaize.com. We will respond within the period required by law, normally one month, and will not charge a fee for a reasonable request.

If you are a visitor who submitted a question on a website that uses Cwaize, the operator of that website is the controller of your data. You may contact us at the address above and we will help direct your request, but the operator is responsible for determining it.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). You may also contact the authority in your country of residence.

Cookies and analytics

Our website (cwaize.com).

On our own website, we use Google Analytics 4 (GA4) to understand how the site and product are used, so we can improve them. GA4 is only activated after you give explicit consent through our cookie banner. Until you consent, no analytics cookies are set and no analytics data is collected.

If you consent, GA4 collects pseudonymised usage data such as pages visited and general interactions. Google does not store your IP address in GA4, we do not use the data for advertising, and we do not use marketing cookies that follow you across other websites. You can withdraw your consent at any time — see below.

We also use your browser's local storage for things that are strictly necessary to operate the service, such as keeping you signed in and remembering your cookie choice. These are not used to track you.

Withdrawing consent. You can withdraw your analytics consent at any time by resetting your cookie preferences, which brings the banner back so you can decline. You can also clear your browser's storage for our site.

The Cwaize widget on our customers' websites. The widget itself sets no cookies and places no persistent tracking identifier on visitors' devices. It uses only a small amount of temporary browser storage to operate during a visit. The analytics described above apply to our own website, not to the widget embedded on our customers' sites.

Security

We implement appropriate technical and organisational measures to protect personal data. These include encryption of data in transit and at rest, access controls that restrict each account to its own data, a private storage environment for uploaded videos, and controls governing where and how the widget may be used.

No system can be guaranteed entirely secure. We nonetheless work to protect your data and to keep our measures current.

Automated decision-making

We do not carry out automated decision-making that produces legal effects or similarly significantly affects individuals within the meaning of Article 22 of the GDPR. The AI answers questions about video content; it does not profile visitors, score individuals, or make decisions about people.

Business customers and data processing agreements

If you use Cwaize to add the widget to your own website, you are the controller of your visitors' personal data and Cwaize acts as your processor. In these circumstances, data protection law requires a data processing agreement (DPA) between us.

Business customers may request our DPA by contacting support@cwaize.com.

Children

Cwaize is a business tool and is not directed at children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Where changes are material, we will update the "Last updated" date above and, where appropriate, notify you. We recommend reviewing this policy periodically.

Contact

For any question or request regarding this policy or your personal data:

Refros Solutions B.V.
Email: support@cwaize.com
Verdunplein 17, Unit C5986, 5627 SZ Eindhoven, The Netherlands