Privacy Policy

1. Introduction

This Privacy Policy explains how Spectator processes and protects your personal data when you use our application. It applies to all users of instances operated by GETWIZE AG

2. Data Processing

Spectator processes documents and code repositories you upload to extract and verify requirements. In the hosted (SaaS) version operated by GETWIZE AG, this processing takes place on cloud infrastructure in Germany (see Section 3). AI features — requirement extraction, code verification, and the generation of vector embeddings for search — use language and embedding models provided by STACKIT AI Model Serving in the same German region. Your content is sent to these models only to answer the individual request.

Data is generally stored only as far as needed for the purpose of using the tool. We do not collect personal data beyond what is technically necessary to provide and secure the service (account name, email address, password hash, the connection and log data described in Section 5, and project-related content you explicitly upload).

Self-hosted deployments: Spectator can also be operated on-premise or in your own cloud tenant, with language models running locally (e.g. via Ollama). In such a deployment, documents, code, and AI inference stay within the infrastructure you control, and the operator of that instance — not GETWIZE AG — decides where data is stored and which services receive it. The recipients and retention periods described below apply to the hosted version.

3. Data Storage and Third Parties

The hosted version runs on STACKIT, the cloud platform of STACKIT GmbH & Co. KG, in the region eu01 (Germany). Your documents, code repositories, and extracted requirements are stored in a managed PostgreSQL database and in object storage within that region. Data remains under your control.

We use the following service providers, who process data on our behalf as processors:

• STACKIT GmbH & Co. KG (Germany): hosting (Kubernetes, database, object storage), AI model inference (STACKIT AI Model Serving), and monitoring of the service (STACKIT Observability). Processes all project content and account data, and the application logs, traces, and metrics, including access logs and security audit logs that contain IP addresses and internal user IDs (see Section 5). All of this is processed in the region eu01 (Germany).
• Mailjet (Mailjet SAS, France): delivery of service emails such as password resets and invitations. Receives the recipient's email address and the content of the email.

Apart from these processors, data is not shared with third parties, except where required by law (e.g., disclosure to competent authorities upon legally binding request).

4. Data Deletion

When you delete a project, all data associated with it in the database — including project content, extracted requirements, document records, and search indexes — is deleted immediately. Original files you uploaded are held separately in object storage and are currently not removed automatically when a project is deleted; we delete them upon request to info@getwize.ai.

You may request deletion of your entire account at any time. Upon account deletion, your account data (account name, name, email address, password hash, and registered passkeys) is deleted immediately. Projects belong to your organization and remain available to its other members; they are deleted when the project is deleted or upon request.

Backups: The database is backed up automatically for disaster recovery. Backups are retained for 32 days and then deleted automatically, so deleted data remains in these backups until they expire. Backups are not used for any other purpose.

Logs: Access logs and security audit logs (Section 5) are not deleted together with a project or account. They are kept in STACKIT Observability for 7 days and are then deleted automatically.

5. Logging

To operate and secure the service, Spectator logs the following information:

• Access logs: for each request, the client IP address, the HTTP method and path, the response status, and the response time.
• Security audit logs: security-relevant events (e.g. logins, user and permission changes, project deletions, and compliance sign-offs) with the internal user ID of the acting user, the IP address, a timestamp, and the affected object. Audit logs do not contain names or email addresses in plain text.
• Operational logs, traces, and metrics: technical information needed for system maintenance and error detection, which may include internal user IDs or account names.

These logs are stored in STACKIT Observability in the region eu01 (Germany, Section 3). We process them on the basis of our legitimate interest in operating the service securely and detecting misuse (Art. 6(1)(f) GDPR), and retain them no longer than technically necessary for that purpose.

6. Cookies and Session Storage

This application does not use cookies. Authentication tokens and session data are stored exclusively in your browser's sessionStorage, which is automatically cleared when you close the browser tab. No tracking cookies, analytics cookies, or advertising cookies are used. The browser's localStorage is used only for technical interface state, such as the ID of a running analysis so that its progress can be resumed after a page reload.

7. Your Rights

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights:

• Right of access (Art. 15 GDPR): You may request information about the personal data we hold about you.
• Right to rectification (Art. 16 GDPR): You may request correction of inaccurate personal data.
• Right to erasure (Art. 17 GDPR): You may request deletion of your personal data where no legal retention obligation applies.
• Right to restriction of processing (Art. 18 GDPR): You may request that processing of your data be restricted under certain circumstances.
• Right to data portability (Art. 20 GDPR): You may request a copy of your data in a structured, machine-readable format.
• Right to object (Art. 21 GDPR): You may object to the processing of your personal data.

To exercise any of these rights, please contact us at info@getwize.ai.

8. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates when the policy was last revised. We recommend checking this page periodically. Continued use of the application after a policy change constitutes acceptance of the revised policy.

9. Contact

For questions about this Privacy Policy or our data handling practices, please contact: