Privacy policy

1. Who we are

• Controller: OneCodeToRuleAll d.o.o. (OCTRA), which runs EditWise. Sinđelićeva 6, 19000 Zaječar, Serbia. Registered with the Serbian Business Registers Agency under registration number 21564516. Tax identification number (PIB) 111898813.
• Privacy contact: contact@editwise.io, or post to the address above marked "Data protection". The law does not require us to appoint a data protection officer, and we have not appointed one. This address reaches the person at OCTRA responsible for data protection.

The Serbian Law on Personal Data Protection applies to everything we do, because we are established in Serbia. The GDPR applies when we offer EditWise to people in the European Economic Area or observe how they use our services, and the UK GDPR does the same for the United Kingdom. We give everyone the same protection, wherever they are.

2. What this policy does not cover

Content inside a customer's workspace. Projects, files, comments, client records, request forms, time entries and everything else an agency puts into EditWise belong to that agency. The agency decides how that data is used, and we process it only on its behalf, under our Data processing agreement.

If you are an agency's client, reviewer or team member, the agency is responsible for your data in its workspace. Ask the agency first. If you write to us, we pass your request on to them.

We do act as controller for a narrow set of data about people who use EditWise: sign-in and security records, account administration, billing and aggregate usage statistics. Section 3.9 covers them.

3. What we collect, why, and on what basis

You do not have to give us personal data. Without contact details we cannot book a call with you, and without billing details we cannot sell you a subscription.

3.1 When you visit editwise.io

• What: your IP address, browser and device type, the pages you request, the page that referred you, and the date and time.
• Who processes it: our hosting provider, Vercel, to deliver the site and protect it from attacks.
• Legal basis: our legitimate interests in running a working, secure website.
• How long: in short-lived logs, generally no longer than 30 days, unless we need them to investigate an incident.
• Videos. Our videos play from YouTube in its privacy-enhanced mode. Nothing loads from YouTube until you press play. When you do, Google receives your IP address and the usual device information, and YouTube may store data in your browser under Google's own policies.

3.2 When you book a call

• The booking form: asks for your website address, your team size and the tools you use today. When you send it, we receive your answers, the page you sent them from and, if the link that brought you carried them, the campaign tags (such as utm_source and utm_campaign), the Google and Meta click identifiers (gclid and fbclid) and the first page you landed on. Web3Forms delivers them to us by email. We receive them even if you do not go on to book.
• An automatic step: if you tell us your team has fewer than five people, the site shows a page explaining that EditWise is not a fit yet. It is based only on the answer you give, it has no legal or similarly significant effect on you, and you can still write to us.
• The scheduler: Calendly asks for your name, work email, time zone and the time you pick, and shows your answers from the booking form so you can check them. If you give a phone number and ask for a WhatsApp reminder, Calendly passes it to us too. After you book, the site asks how you heard about us. Your answer, if you give one, reaches us the same way as the booking form.
• Why: to schedule and run our calls, send confirmations and reminders, prepare for the call, and learn which channels and campaigns bring bookings.
• WhatsApp: we send a WhatsApp reminder only if you gave a number and asked for one. Otherwise we remind you by email.
• Legal basis: steps you ask us to take before entering into a contract; our legitimate interests in running and measuring our sales process; your consent for WhatsApp reminders.
• Tools: Web3Forms for the booking form, Calendly for scheduling, Meta's WhatsApp Business Platform.
• How long: if you do not become a customer, 24 months after our last contact with you. Then we delete or anonymize it. Web3Forms keeps its own copy of each form you send for up to three years, under its data processing terms.

3.3 Calls and recordings

• We hold calls on Zoom.
• We record and transcribe a call, using some of the available tools, only if everyone on it agrees at the start. If you say no, we do not record.
• Why: to send you the recording, keep accurate notes, and train our team to run better calls.
• Legal basis: your consent for the recording; our legitimate interests for call notes.
• How long: recordings and transcripts are deleted 12 months after the call, or sooner if you ask. Call notes stay with your booking record and follow section 3.2.

3.4 Your demonstration workspace

• What: information published on your website, such as your company name, logo and services, the client names and project titles in your portfolio, and the names and roles of team members you list publicly, plus what you tell us on our first call.
• Why: so you can see EditWise working on your own business before you decide anything.
• Legal basis: our legitimate interests, and yours, in a demonstration that is relevant to you; steps you ask us to take before a contract.
• Who sees it: your team and ours. Nobody else.
• How long: if you do not sign, we delete it 90 days after our last contact with you, or within 5 working days if you ask. If you sign, it becomes your workspace and our Data processing agreement applies.

3.5 When we contact you first (prospecting)

• What: business contact details: your name, job title, company, work email address and public professional profile.
• Where it comes from: company websites, professional networks and the business contact data provider Apollo.io.
• How we use it: we check that the email address works (MillionVerifier) and send messages from our outreach tool (Smartlead) to offer EditWise to businesses it may suit. We do not track whether you open these messages.
• Legal basis: our legitimate interests in business-to-business marketing.
• Your control: every message says who we are, where we got your details, and how to stop. One reply stops all further messages. We then keep your email address on a suppression list, so that we never contact you again.
• How long: 12 months after our last message if you do not reply. Suppression list entries stay for as long as we prospect.

3.6 Emails to people who signed up or booked a call earlier

• If you created an EditWise account, or booked a call with us, before the booking form on this site existed, we may send you a few emails about what has changed since, such as a feature you asked for.
• Legal basis: our legitimate interests. Every email says why you are getting it and has a one-click unsubscribe link, and we honor it the same day.
• How long: until you unsubscribe, or 24 months after your last interaction with us, whichever comes first. If you unsubscribe, your email address goes on our suppression list.
• If you book a call through this site, we email you only about your calls and your workspace, as the booking form says.

3.7 Measuring our advertising

• We do not run advertising tags on editwise.io, and we do not send your contact details to Google, Meta or any other advertising platform.
• When an ad of ours brings you to the site, its link may carry campaign tags and click identifiers. We keep them with your booking, as section 3.2 says, to learn which campaigns bring bookings.
• If we ever add analytics or advertising tags, or start measuring ads with contact details, we will update this policy first, and nothing optional will load until you accept it.

3.8 Customers: contracts, billing and account administration

• What: names and work contact details of the people who sign and of the contacts named on the Order Form (renewal notice, sub-processor changes and data protection); company details; VAT number and the result of the VIES check; invoices, payments and payment reminders; the bank details shown on your transfers; the electronic signature record (name, email address, IP address and time); support messages.
• Why: to make and perform our contract, invoice and collect payment, send renewal reminders, keep accounting records and handle disputes.
• Legal basis: performance of our contract with your company, and our legitimate interests in dealing with you as its contact; legal obligations under accounting and tax law.
• How long: for the contract, then for the periods the law sets. Serbian accounting law requires accounting documents for 5 years and ledgers for 10 years from the end of the business year. We keep contract records for 5 years after the contract ends, which covers the limitation periods for claims between businesses under Serbian law.

3.9 People who use EditWise

• What we hold as controller: sign-in records (email address, one-time sign-in codes, session and device data, IP address and last-seen time), security and audit logs, error reports and service telemetry, and aggregate usage statistics.
• Why: to keep accounts and the service secure, investigate incidents, fix errors, count seats for billing, and improve the service in aggregate.
• Legal basis: our legitimate interests in a secure and reliable service; legal obligations where they apply.
• Tools: Microsoft Azure for hosting and telemetry; Cloudflare for delivery and storage; Sentry for error tracking, with personal data removed before reports are sent; Resend for the service emails sent from a workspace.
• How long: security logs 12 months, telemetry 30 days, error reports 90 days.
• Everything else inside a workspace belongs to the customer (section 2).

3.10 Support and correspondence

• What: the messages you send us and our replies, held in Google Workspace.
• Legal basis: our legitimate interests in answering you; performance of our contract where you are a customer.
• How long: 3 years after the matter is closed, or longer if we need it for a legal claim.

3.11 Referrals

If a customer refers you to us, they give us your name and work email address. We use them to contact you once, and our first message says who referred you. Legal basis: our legitimate interests. We delete them 12 months later if you do not reply.

3.12 AI assistants our team uses

Our team uses AI assistants (Claude for Work, by Anthropic) under business terms that do not allow the provider to train models on our data. We use them to draft and summarize our own business information, which can include correspondence and call notes. We do not use them to make decisions about you.

3.13 Legal reasons

We may use personal data to comply with the law, to answer lawful requests from authorities, and to establish, exercise or defend legal claims. Legal basis: legal obligation, or our legitimate interests.

3.14 If EditWise moves to another company

If EditWise moves to another company we control, such as a company formed to run EditWise, or is sold, the personal data described here moves with it. The new company uses it only as this policy describes, and we tell you before the move.

4. Cookies and similar technologies

• editwise.io sets no cookies of its own and runs no analytics or advertising tags.
• Your browser's session storage keeps three things while you book a call: your answers to the booking form, the campaign tags of the link that brought you, and a note that your answers reached us, so they are not sent twice. Session storage stays on your device and is deleted when you close the tab.
• Calendly sets its own cookies when the scheduler loads, and asks in the scheduler before it sets any that are not needed for booking. YouTube stores data only after you press play on a video.
• The EditWise app, including client portals and review links, uses cookies that are strictly necessary to sign you in and keep your session secure.
• The details are in our Cookie policy at editwise.io/cookies.

5. Who we share personal data with

We use the providers below to run our business. Each processes personal data on our instructions under a written data processing agreement, except where this policy says otherwise.

Providers that process data inside customer workspaces are listed at editwise.io/sub-processors.

We also share personal data with:

• Apollo.io, only in the sense that we obtain business contact details from it (section 3.5). Apollo.io is responsible for its own database.
• Our bank NLB bank and our accountants Agencija Office in Serbia, to receive payments and keep our books.
• Our lawyers, auditors and tax advisers, when we need their advice.
• Authorities, when the law requires it.
• A company that takes over EditWise, as section 3.14 describes.

We do not sell personal data.

6. How long we keep data

7. International transfers

• We are established in Serbia. Neither the European Commission nor the United Kingdom has recognized Serbia as providing adequate protection. When you give us personal data directly, the GDPR or the UK GDPR still protects it, because those laws apply to us directly, and we follow them.
• Some of our providers (section 5) process data in the United States, India and other countries. Where the destination is not recognized as adequate under the law that governs the transfer, we rely on:
  • the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), and the UK Addendum to them, included in our providers' data processing terms;
  • the EU-U.S. Data Privacy Framework and its UK Extension, for providers certified under them; and
• To get a copy of the safeguards for a transfer, write to contact@editwise.io.

8. Your rights

You have the right to:

1. access the personal data we hold about you and get a copy;
2. correct data that is wrong or incomplete;
3. delete your data, where we have no overriding reason to keep it;
4. restrict how we use it, for example while we check a complaint;
5. receive data you gave us in a common machine-readable format and have it sent to someone else (portability);
6. object to our use of your data based on legitimate interests, and object at any time to direct marketing, which we then stop;
7. withdraw consent at any time, without affecting what we did before you withdrew it;
8. not be subject to a decision based solely on automated processing that has legal or similarly significant effects on you. We make no such decisions.

How to use your rights. Write to contact@editwise.io. We may ask you to confirm your identity. We answer within one month. For complex or numerous requests, we can extend that by up to two more months, and we tell you within the first month if we do. Using your rights is free, unless a request is clearly unfounded or excessive.

Complaints. You can complain to a supervisory authority:

• in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, office@poverenik.rs, poverenik.rs;
• in the European Economic Area, the data protection authority where you live, work or think your rights were infringed;
• in the United Kingdom, the Information Commissioner's Office, ico.org.uk.

We would welcome the chance to fix a problem first, so please write to us too.

If you are in the United States. Whatever state you live in, you can ask us to access, correct or delete your personal data, and we will honor the request as this section describes. We do not sell personal data, and we do not share it for cross-context behavioral advertising.

9. Security

We protect personal data with encryption in transit and at rest, least-privilege access, logging and backups. EditWise separates every customer's workspace from every other customer's. Our security page at editwise.io/security has the detail. No system is perfectly secure. If a breach puts your rights at risk, we notify the supervisory authority within 72 hours, and we notify you without undue delay where the law requires.

10. Children

EditWise is a service for businesses. We do not knowingly collect personal data from anyone under 16. If we learn that we have, we delete it.

11. Changes to this policy

We update this policy when our practices change, and the date at the top shows the latest version. If a change is material, we email our customers about it and, where we can, publish it 30 days before it takes effect.

12. Contact

• contact@editwise.io
• OneCodeToRuleAll d.o.o., Sinđelićeva 6, 19000 Zaječar, Serbia