Wiply Privacy Policy

Last updated: 30 September 2026


This Privacy Policy explains how Wiply Corp OÜ collects and uses your personal data when you use the Wiply social network (wiply.net), Cassy AI (cassy.wiply.net), Wiply Studio, the Help Center (help.wiply.net) and our other services (together, the "Services").


1. Who we are

The data controller is Wiply Corp OÜ, a company registered in Estonia, registry code 16444101, VAT number EE102471139, with registered office at Ahtri tn 12, 10151 Tallinn, Harju County, Estonia.

For privacy requests and questions, write to help@wiply.net or open a ticket in our Help Center at help.wiply.net. Business enquiries: business@wiply.net.


2. What data we collect

  1. Account data: Username, email address, password (stored encrypted), date of birth or age confirmation, language. Source: you, when you register.
  2. Profile and content: Avatar name, profile photo, posts, comments, photos, albums, groups, messages, reactions. Source: you.
  3. Virtual world and game data: Avatar or player names and identifiers (for example a Second Life avatar key) and in-world messages, if you link an account or use our in-world tools. Source: you and the virtual world or game, when you use them.
  4. Cassy AI data: Your chats with Cassy, files you upload, images you generate, memories Cassy saves about your preferences, credit balance. Source: you, when you use Cassy.
  5. Payments: Plan, purchases, wallet and credit transactions. We do not store full card numbers. Source: you and our payment providers.
  6. Technical data: IP address, device and browser type, log files, security and anti-spam signals. Source: automatically, when you use the Services.
  7. Support: Tickets, emails and chat messages with our team. Source: you.


Please do not share special categories of data (health, religion, political opinions, sexual orientation, ethnic origin) or other people's personal data in posts or in chats with Cassy unless it is necessary.


3. Why we use your data and on what legal basis

  1. Creating and running your account, showing your content, providing Cassy AI and other features you ask for. Legal basis: Contract (Art. 6(1)(b))
  2. Plans, payments, wallet and AI credits. Legal basis: Contract; legal obligations for accounting and tax (Art. 6(1)(c))
  3. Safety and moderation: spam prevention, automatic blurring and labeling of sensitive images, handling reports. Legal basis: Legitimate interest in a safe community (Art. 6(1)(f)); legal obligations under the Digital Services Act
  4. Cassy memory (remembering your preferences across chats). Legal basis: Consent (Art. 6(1)(a)). You can turn it off at any time in Settings → Personalization.
  5. Security, fraud prevention, fixing errors. Legal basis: Legitimate interest (Art. 6(1)(f))
  6. Service emails (security, changes to these policies). Legal basis: Contract and legal obligation
  7. Newsletters and promotional messages. Legal basis: Consent. You can unsubscribe at any time.


4. Artificial intelligence

  1. Cassy AI is an AI assistant. Its answers are generated automatically and can be wrong. Cassy is clearly identified as an AI and never pretends to be a person.
  2. Your chats are processed by AI models running on Amazon Web Services (Amazon Bedrock). We do not use your chats or content to train AI models, and our providers do not use them either.
  3. Memory: if enabled, Cassy saves short notes about your stable preferences (for example your language or your work) to personalise answers. It is instructed not to save sensitive data. You can view, edit and delete memories, or switch memory off, in Settings → Personalization.
  4. Web search: when Cassy searches the web, the search terms are sent through our own search server to search engines, without your account data.
  5. Voice: answers read aloud are produced by Amazon Polly in the EU. Dictation uses your browser's speech service (for example Google in Chrome, Microsoft in Edge, Apple in Safari), under that provider's privacy policy.
  6. Moderation: our AI systems automatically blur sensitive images and label adult posts. They do not delete content or suspend accounts on their own: those decisions are taken by a person (see our Community Standards).
  7. AI-generated images and audio are identified as AI-generated. We are adding machine-readable marks to their files, as required by the EU AI Act.


5. Who we share data with

We never sell your personal data and we do not work with advertising partners. We share it only with providers that help us run the Services, under contracts that protect your data (data processing agreements):

  1. Amazon Web Services: hosting, file storage and AI models (EU regions: Ireland and Paris). Image generation runs in the United States (Oregon).
  2. Stripe and PayPal: payments. Card and account details are handled by them; we never see your full card number.
  3. Service emails are sent from our own email server; no third-party email provider receives your address.
  4. Cloudflare Turnstile and Google reCAPTCHA: protection against bots on sign-up and other forms. They process technical data such as your IP address and browser information.

We may disclose data to authorities when the law requires it, or to protect the safety of our members.


6. Transfers outside the European Union

Most data is processed in the EU. Some processing involves a transfer outside the EU: AI image generation (Amazon Web Services, United States), payments (Stripe, PayPal) and bot protection (Cloudflare, Google). These transfers are covered by the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses in our agreements with the providers.


7. How long we keep data

  1. Account, profile and posts: as long as your account is active. When you delete your account, we delete or anonymise your data within 30 days, except backups, which are overwritten within 90 days.
  2. Cassy chats: until you delete them or your account. Temporary chats are not saved in your history and are deleted automatically after 30 days.
  3. Cassy memories: until you delete them, switch memory off or delete your account.
  4. Payment and invoice records: as long as required by accounting and tax law (in Estonia, usually 7 years).
  5. Security logs: up to 12 months.
  6. Moderation records and reports: up to 12 months after the case is closed, or longer if needed for a legal claim.


8. Your rights

You have the right to access your data, correct it, delete it, receive a copy in a portable format, restrict or object to its processing, and withdraw consent at any time. Many of these you can do yourself: edit your profile, delete posts, chats and memories, export your Cassy chats, or delete your account in Settings.

For anything else, write to help@wiply.net. We answer within one month. You also have the right to complain to a data protection authority: in Estonia, the Andmekaitse Inspektsioon (Data Protection Inspectorate); in Italy, the Garante per la protezione dei dati personali; or the authority of your country.


9. Minimum age

You must be at least 16 years old to use Wiply and Cassy AI. Adult content is only shown to members aged 18 or over who choose to see it. If we learn that someone younger is using the Services, we close the account.


10. Cookies

We use only the cookies needed to run the Services, such as keeping you signed in and protecting against attacks. Cloudflare Turnstile and Google reCAPTCHA may set their own technical cookies on forms to tell people from bots. We do not use advertising or tracking cookies. If this changes, we will ask for your consent first.


11. Security

We protect your data with encryption in transit (HTTPS), encrypted passwords, access controls, firewalls and regular updates. No system is perfectly secure: if a breach affects your data and puts you at risk, we will inform you and the authorities as required by law.


12. Changes to this policy

We will tell you about important changes by email or with a notice on Wiply before they take effect. The date at the top shows the latest version.