Privacy Policy

Last updated: 19 July 2026

This policy explains what data the wyper.io browser extensions (“wyper.io Social Cleanup” and “wyper.io Fact-Check”), the website wyper.io and our backend process, why, and your rights under the EU General Data Protection Regulation (GDPR).

The short version. The Cleanup tool runs entirely in your browser — nothing you delete and no login ever leaves your device. The Fact-Check tool sends only the text/transcript you explicitly ask it to check (with emails, phone numbers and card numbers stripped out first) to our server, which relays it to AI providers for verification. We never receive your social or Google passwords, we never sell your data, and we don’t use it for advertising.

1. Who is responsible (Controller)

Gelato Zupply LLC, 30 N Gould St, Ste N, Sheridan, WY 82801, USA — the operator of the wyper.io tools (the "Controller").
Contact for all privacy matters: support@wyper.io.

2. What the products do

wyper.io Social Cleanup — bulk-deletes your own posts, likes, comments and follows on X and Instagram. It acts inside your already-logged-in browser tab using standard page interactions.
wyper.io Fact-Check — on your explicit request (right-click / button), reads the text, selection or video captions of the current page and returns an AI-assisted verdict.

3. Data processed — by feature

3.1 Social Cleanup — processed locally only

All actions run on your device inside your logged-in session. We do not receive, transmit or store your posts, likes, follower lists, account credentials, session tokens or any content. To operate, the extension reads counts and lists from the page and stores small settings locally in your browser (chrome.storage.local), e.g. an interface-language preference and progress state. This never leaves your browser.

3.2 Fact-Check — data sent to our backend

When you trigger a check, the extension sends the following to our backend (operated on our behalf; see §5):

The content you asked to verify — the selected text, article text, or the video’s caption text, plus the page title and URL for context.
Local PII redaction first: before anything is sent, the extension removes detected email addresses, phone numbers and payment-card numbers from the text.
An anonymous installation ID — a random identifier generated on first use, stored locally. It lets us enforce fair-use limits and (for paid users) your plan, without an account or your identity.
Browser language — so the result is returned in your language.

This content is relayed to our AI sub-processors (Google — Gemini; xAI — Grok) to produce the verdict and is used only to answer that request.

3.3 Proof Library (Pro)

If you have an active Pro plan and use the Proof Library, the verification records you create (claim, verdict, sources, date) are stored on our backend and linked to your licence so you can view them in the extension. You can request deletion at any time (see §9).

3.4 Website & payments

The website is served via Cloudflare and our host; standard server logs (IP, timestamp, user agent) may be processed transiently for security and delivery.
Subscriptions are handled by Stripe. Payment/card data is entered directly with Stripe — we never see or store card details. We receive only what we need to manage your subscription and licence (e.g. subscription status, billing email).

4. Legal bases (GDPR Art. 6)

Purpose	Legal basis
Providing the fact-check you requested	Art. 6(1)(b) — performance of a contract / pre-contract
Fair-use limits, abuse prevention, security	Art. 6(1)(f) — legitimate interests
Subscriptions & licence management (Stripe)	Art. 6(1)(b) — contract
Proof Library storage	Art. 6(1)(b) — contract (feature you enabled)

5. Sub-processors & recipients

We share the minimum necessary data with these providers, each acting under a data-processing agreement:

Provider	Purpose	Location
Google (Gemini API)	AI fact-checking	EU / USA
xAI (Grok API)	AI cross-check & deep research	USA
Stripe	Payments & subscriptions	EU / USA
Hetzner Online GmbH (data centre in Germany, EU)	Backend hosting	Germany / EU
Cloudflare	CDN, TLS, security	EU / USA

We do not sell your data and do not share it with advertisers or data brokers.

6. International transfers

Some providers are located in the USA. Where data is transferred outside the EU/EEA, it is protected by appropriate safeguards, in particular the EU Standard Contractual Clauses and the providers’ certifications.

7. Retention

Fact-check content: processed to answer your request and cached only briefly to improve speed; not retained as a long-term profile.
Anonymous install ID & usage counters: kept as needed to enforce limits, then rotated/reset.
Proof Library: kept while your plan is active or until you delete it.
Billing records: retained as required by law (e.g. tax/commercial retention periods).

8. Google API / Chrome Web Store “Limited Use”

wyper.io’s use of information received from Google APIs adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. We use the data solely to provide and improve the user-facing features described here, do not sell it, do not use it for advertising, and do not allow humans to read it except as necessary for security, legal compliance, or with your consent.

9. Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction, data portability, and to object. To exercise any of these, or to delete your Proof Library or installation data, contact support@wyper.io. You also have the right to lodge a complaint with a supervisory authority.

10. Children

wyper.io is not directed to children under 16 and we do not knowingly process their data.

11. Changes

We may update this policy; the “last updated” date reflects the current version. Material changes will be announced on this page.