Privacy Policy

Last updated August 17, 2026

This Privacy Policy explains how Aquila Labs, Inc., doing business as Wonder ("Wonder," "we," "us," or "our"), collects, uses, discloses, and otherwise processes personal information in connection with our services (the "Services"). The Services include wonder.design, the Wonder design platform and applications, AI-assisted features, APIs and MCP tools, the Wonder Marketplace, Wonder Capture, connected services, support, marketing, events, careers, and any other Wonder property that links to this Privacy Policy.

This Privacy Policy does not govern a third-party website, application, or service's independent processing under its own privacy policy. Personal information Wonder receives through a third party and processes for its own purposes is covered by this Privacy Policy.

Our role

For account, website, billing, marketing, security, and similar business information, Aquila Labs, Inc. generally determines why and how the information is processed and acts as the controller or business.

When a customer uses Wonder to process personal information contained in its designs, prompts, repository content, comments, or other workspace content ("Customer Personal Data"), Wonder generally processes that information on the customer's behalf. Our Data Processing Agreement ("DPA") governs that processing when it applies. The customer controls its workspace and is responsible for its own privacy notices, instructions, permissions, and legal bases.

If you use an organization-controlled workspace, its owners and administrators may manage your access and the content associated with that workspace. Contact the organization first if your request concerns information it controls.

At a glance

• We collect account and profile information, User Content, billing and transaction information, communications, connected-service data, and technical and usage data as described below.
• We use personal information to provide and secure Wonder, carry out your instructions, process payments, power AI and integrations, support users, improve the Services, communicate with you, and comply with law.
• We do not sell personal information or share it for cross-context behavioral advertising.
• We do not use your designs, prompts, or AI output to train or fine-tune AI models, and we do not provide them to a third party for that purpose.
• We may use User Content and AI interaction information to provide, operate, analyze, develop, and improve the Services as described below. When the DPA applies, its customer-instruction limits control.
• We record AI requests and responses, and we use session replay, to debug and improve the product. Session replay can capture the design canvas on your screen.
• Content you make public can be viewed, indexed, cached, copied, or redistributed by others outside Wonder's control.
• Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a copy of your personal information.

Personal information we collect

The information we collect depends on the Services and features you use, the choices you make, and whether you use Wonder individually or through an organization.

Information you provide or make available to us

We may collect the following categories of information directly from you or through your use of the Services:

• Account and contact information, such as your name, email address, username, account and authentication identifiers, organization or workspace, role, and communication preferences. Authentication credentials may be collected and processed by our authentication provider rather than stored directly by Wonder.
• Profile information, such as your display name, nickname, profile picture, biography, location, website, and links to social profiles. You choose which optional profile fields to add and, where the Services provide visibility controls, whether they are public.
• Billing and transaction information, such as billing contact details, subscription tier, seats, AI or other usage, spend controls, invoice and transaction identifiers, payment status, renewal and cancellation information, and transaction history. Payment-card and bank-account details are collected directly by Stripe or its affiliates; Wonder may receive limited payment-method and transaction details from Stripe to administer billing.
• User Content, meaning content you submit to, create in, connect to, or make available through the Services. It may include designs, files, text, comments, prompts, instructions and other AI Input, code, repository content, images, video, audio, fonts, assets, settings, project metadata, Marketplace materials, and other data or materials. AI-generated Output is described separately below, consistent with the Terms of Service.
• Collaboration and sharing information, such as workspace membership and roles, invitations, collaborators, comments, permissions, file visibility, share settings, version and activity information, and the people or organizations with whom you choose to share content.
• AI interaction information, such as prompts, instructions, selected or relevant design and repository context, generated Output, feedback, and technical information needed to route and operate an AI request.
• Connected-service information, such as the third-party account you connect, authorization and installation identifiers, scopes and permissions, repository or file identifiers, source paths, branches, commits, pull requests, and content retrieved from or sent to the connected service at your direction.
• Marketplace and public-content information, such as listing title and description, tags, category, license and permission settings, preview, publish date, creator profile, public file link, moderation state, and edits or removal requests.
• Communications, feedback, and reports, including support requests, emails, survey responses, feedback, legal or privacy requests, abuse and content reports, report categories and details, and other communications you send us.
• Marketing and event information, such as communication preferences, event registration details, and your interactions with messages we send.
• Job-applicant information, such as contact information, résumé or CV, work and education history, portfolio and profile links, qualifications, application responses, interview information, work authorization, references, and other information you submit or authorize in connection with a role at Wonder.
• Information about other people. You may provide information about collaborators, invitees, customers, or other people through User Content and collaboration features. Do not provide another person's personal information unless you are authorized to do so.
• Other information you choose to provide, which we use for the purpose explained when it is collected or as otherwise described in this Privacy Policy.

User Content may contain personal or sensitive information depending on what you choose to submit. You are responsible for having the rights, permissions, and lawful basis required to provide that information and for using appropriate workspace and sharing settings. When Wonder processes Customer Personal Data on a customer's behalf, the DPA governs that processing.

Information from third-party sources

We may receive information from:

• Your organization, workspace administrators, and collaborators, such as your work email, role, workspace membership, permissions, and content or comments they share with you.
• Authentication and account providers, which may provide identity, account, security, and authentication information based on the sign-in method you choose.
• Connected services, such as GitHub, Google, or another service you authorize. The information depends on the permissions you approve and the actions you request.
• Payment, analytics, monitoring, communications, and other service providers, which provide billing status, security signals, diagnostics, usage measurements, message-delivery information, and other information needed to perform their services for Wonder.
• Recruiting sources, such as Wonder-branded Typeform application forms and, where applicable, recruiters, referrals, references, or public professional profiles.
• Public sources you direct us to use, such as a public code repository or public webpage you ask Wonder to read or import.

We combine information from these sources with other information described in this Privacy Policy when necessary for the relevant purpose.

Information collected automatically

We and our service providers may automatically collect:

• Device and network information, such as IP address, browser and device type, operating system, language, device or application identifiers, internet service provider or carrier, and general location derived from IP address. We do not intend to collect precise GPS location unless a feature clearly requests it and you permit it.
• Log and usage information, such as pages, screens, designs, or files viewed; referring page; searches; features and actions used; access dates and times; navigation; session and account events; and Marketplace view, open, remix, and download events.
• Session replay recordings, meaning a reconstruction of your on-screen activity in the product, which can include the design canvas you are working in. See Session replay below.
• AI request records, such as the prompt Input you submit, the generated Output, the model used, token counts, timing, and the account, workspace, and file identifiers needed to trace a request. See AI request logging below.
• Performance and diagnostic information, such as page-load and interaction performance, crash and error reports, system activity, request metadata, configuration information, and security events.
• Communication interaction information, such as delivery, bounce, open, and link-click information for emails we send, when the communication service and your settings make that information available.
• Marketplace engagement and abuse-prevention information. Marketplace event and reporting systems process the listing identifier, event or report type, IP address, and optional report details to calculate engagement, deduplicate events, enforce rate limits, prevent abuse, and review reports.

Cookies and similar technologies

Wonder and our providers may use cookies, local storage, pixels, web beacons, and similar technologies for:

• authentication, session management, and security;
• remembering settings and preferences;
• enabling requested features and integrations;
• measuring website and product usage and performance;
• diagnosing errors and improving reliability; and
• measuring delivery and engagement with our communications.

Our website integrates Vercel Web Analytics and Speed Insights to measure aggregated page usage and real-user performance. Vercel Web Analytics is designed to operate without third-party cookies and without associating page views with a directly identified individual. We may also use PostHog for product analytics and session replay, Sentry for error and performance monitoring, and Resend for transactional and marketing email. The exact information processed depends on the Service, provider configuration, and your interaction. Our current providers are listed on our Subprocessor List.

Session replay. In the Wonder product we use PostHog session replay, which records a reconstruction of your on-screen activity — pages and panels you view, clicks, navigation, and the design canvas you are working in. Because the canvas is recorded, a replay can contain the design content visible on your screen during the session. Password, email, telephone, and payment-card fields are masked, as are elements the product marks as non-capturable, and recorded web addresses are filtered for sensitive values before they are sent. Other text you type in the product — layer, file, and project names, search terms, and comment text, for example — is not masked and can appear in a recording. We use replay to diagnose bugs, understand how features are used, and improve the product.

We do not currently use tracking technologies to serve advertisements based on your activity across unaffiliated websites or services.

How we use personal information

We may use personal information to:

• provide, operate, maintain, and administer the Services;
• create and authenticate accounts, manage workspaces, and apply roles and permissions;
• process subscriptions, payments, invoices, usage-based charges, renewals, cancellations, and taxes;
• host, store, render, transmit, export, and otherwise process User Content as you direct;
• enable collaboration, invitations, comments, sharing, public files, profiles, and Marketplace publishing;
• provide AI-assisted generation, editing, analysis, and related actions;
• connect, operate, and secure GitHub, Google, and other integrations;
• communicate about the Services, including security alerts, account and billing notices, product updates, collaboration messages, and support responses;
• remember settings and personalize your experience within Wonder;
• provide support and respond to questions, feedback, privacy requests, and content reports;
• analyze usage, troubleshoot, test, research, develop, and improve the performance, reliability, safety, and usability of the Services;
• measure and improve communications and, subject to your choices, send information about Wonder products, events, and offers;
• evaluate job applications, communicate with applicants, verify information with permission, make hiring decisions, and maintain recruiting records;
• prevent, detect, investigate, and respond to fraud, abuse, security incidents, harmful activity, policy violations, and technical problems;
• moderate content, enforce our agreements and policies, and protect our, our users', or others' rights, privacy, safety, and property;
• comply with law, valid legal process, regulatory requirements, audits, tax and accounting obligations, and enforce or defend legal claims;
• create aggregated or de-identified information as described below;
• evaluate or carry out a financing, acquisition, reorganization, sale, or other corporate transaction; and
• carry out another purpose disclosed when information is collected, with your consent where required.

Legal bases for processing

If you are in the European Economic Area ("EEA") or United Kingdom ("UK"), we rely on one or more of the following legal bases:

Withdrawing consent does not affect processing that occurred before withdrawal. Where we rely on legitimate interests, you may object as described under Your privacy rights.

If you are in Canada, we process personal information with express or implied consent as appropriate, or without consent where applicable law permits or requires it. You may withdraw consent subject to legal and contractual restrictions and reasonable notice.

Artificial intelligence

Providers

Wonder uses third-party AI and machine-learning providers to deliver AI-assisted features. Depending on the feature, the model you select, and routing, providers may include Anthropic, OpenAI, Google AI Studio or Vertex AI, Microsoft Azure AI Foundry, Amazon Bedrock, Moonshot AI, Cerebras, Fireworks AI, Relace AI, Quiver, and OpenRouter. We use OpenRouter to route a request to the provider serving the selected model, including as a fallback when a direct provider is unavailable; in that case OpenRouter forwards the request to that model's provider. The current list, purpose, and processing location appear on our Subprocessor List.

When you use an AI feature, you direct us to transmit the Input, relevant design or repository context, necessary account and technical information, and related instructions to the selected provider so it can generate Output or perform the requested action. Wonder and its providers may also process related diagnostics for security, reliability, abuse prevention, and support.

Web search and page retrieval

Some AI features can search the web or read a web page at your request. When you use one, we send the search query or the web address to our search and retrieval providers, Tavily and Firecrawl, and process what they return as part of your request.

AI request logging

We record AI requests and responses — including prompt Input, generated Output, the model used, token counts, and timing — through our AI observability provider, Langfuse, so we can debug failures, measure quality, evaluate changes, prevent abuse, and improve AI features. These records are linked to account, workspace, and file identifiers so we can trace a specific request. They are retained as described under How long we retain information.

Model training

Wonder does not use your designs, prompts, generated Output, or other User Content to train or fine-tune AI models, and we do not provide it to a third party to do so. We select and configure our AI providers so that content we send on your behalf is not used to train their models.

If this changes, we will update this Privacy Policy and provide notice before the change takes effect, and we will obtain consent or offer an opt-out where applicable law requires it. Any such change would apply only going forward.

Other AI processing

Wonder may use AI interactions and other User Content to operate, secure, analyze, develop, and improve the Services, including AI-assisted features, as permitted by the Terms of Service and applicable law and subject to the model-training commitment above. When an AI provider acts as our subprocessor, our agreement requires it to protect Customer Personal Data and process that data for the contracted service. Where the DPA applies, Wonder and its subprocessors process Customer Personal Data under the customer's documented instructions, and the DPA controls over inconsistent terms.

Authorized Wonder personnel may access AI interactions and other User Content when reasonably necessary to provide support, investigate abuse or security issues, maintain and improve the Services, comply with law, or carry out your instructions, subject to access controls and confidentiality obligations.

Wonder does not use personal information about your account to make solely automated decisions that produce legal or similarly significant effects. Our Terms of Service restrict use of Wonder for fully automated high-impact decisions unless Wonder has approved the use in writing and legally required safeguards are in place.

Connected services

GitHub

When you connect GitHub, Wonder may process your GitHub identity, authorization and installation identifiers, repository selection and metadata, branches, commits, source paths, repository content, and pull-request information needed for the actions you request. A repository connection may be visible to and usable by collaborators with the necessary permissions on the Wonder file.

Wonder requests short-lived GitHub access tokens when access is needed and does not persist those tokens. You can change repository access, suspend or uninstall the Wonder GitHub App, or disconnect a repository through Wonder or GitHub. Disconnecting stops new access but does not automatically delete content already imported into Wonder or undo a branch or pull request you authorized.

Google APIs

Our use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements. The scopes and information processed depend on the Google feature you choose to connect.

Other connected services

If you connect another service or third-party AI agent, we and that provider exchange information as needed to authenticate the connection and perform your requested actions. The provider's independent handling of your information is governed by its terms and privacy policy. Review the requested permissions before connecting a service and use the provider's settings to revoke access when you no longer want it connected.

Wonder Capture browser extension

Wonder Capture lets you copy a selected webpage element to your clipboard as an HTML/CSS snippet for pasting into Wonder.

The extension processes the selected page content and styles locally in your browser and writes the result to your clipboard. It does not send page content, browsing history, or capture activity to Wonder or a third party and contains no analytics or tracking. Content you later paste into Wonder becomes User Content and is processed as described in this Privacy Policy.

How we disclose personal information

We may disclose personal information to the following recipients and in the following circumstances:

• Service providers and subprocessors. Providers help us with cloud hosting, storage, authentication, billing, AI inference and routing, AI observability, web search and page retrieval, analytics, session replay, error monitoring, desktop application distribution, email, support, recruiting, security, and business operations. They may process information only to perform services for Wonder under applicable contractual restrictions. See our Subprocessor List.
• Payment processors. Stripe and its affiliates collect and process payment information and provide Wonder with transaction and billing information. Stripe handles information under its Privacy Policy when acting for its own purposes.
• AI providers. We disclose Input, related context, instructions, Output, and necessary account or technical information as described under Artificial intelligence.
• Workspace owners, administrators, and collaborators. Information and User Content may be available to people who control or participate in a workspace, file, or project according to roles, permissions, and organization settings.
• Connected services and recipients you direct. We disclose information when you connect a service, share or export content, create a pull request, invite a collaborator, use a third-party agent, publish a file, or otherwise instruct us to send information to another person or service.
• Other users and the public. We disclose profiles, files, Marketplace listings, and other information you choose to make public or share with a particular audience.
• Professional advisers. Lawyers, auditors, accountants, bankers, insurers, and similar advisers may receive information when reasonably necessary for their professional services to us.
• Authorities and parties involved in legal matters. We may disclose information when we reasonably believe it is necessary to comply with law or valid legal process; respond to lawful requests; enforce our agreements; investigate fraud, abuse, or security issues; or protect rights, privacy, safety, or property.
• Corporate transactions. We may disclose information to actual or prospective investors, financing sources, counterparties, and advisers in connection with diligence, financing, an acquisition, merger, reorganization, asset sale, insolvency, or similar transaction. A successor may process information subject to this Privacy Policy or notice of materially different practices.
• With your consent. We may disclose information for another purpose that you affirmatively approve.

Public and shared content

You control whether a file is private, shared with selected people, or public, subject to workspace-administrator permissions. By inviting collaborators, publishing a profile or Marketplace listing, or making content public, you direct Wonder to disclose that information to the selected audience.

Public content may be viewed by anyone; indexed by search engines; included in feeds, previews, thumbnails, social cards, or announcements; and copied, cached, screen-captured, downloaded, remixed, or stored outside Wonder, depending on the settings and license you choose. Other people may use public information in ways Wonder cannot control.

Changing a file to private, unpublishing a listing, or deleting content removes or restricts Wonder's active publication as described in the Services, but it cannot recall copies made by others or immediately remove third-party caches and search indexes. Marketplace licenses and permissions are governed by the Marketplace Creator Terms, and licenses already relied upon may continue after unpublishing as described there.

Aggregated and de-identified information

We may aggregate or de-identify personal information so that it no longer reasonably identifies you and use it to analyze, operate, secure, research, and improve the Services and our business. We may disclose aggregated or de-identified information for those purposes where permitted by law. We do not attempt to reidentify information we maintain as de-identified except to test whether our de-identification measures are effective or as otherwise permitted by law.

How long we retain information

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, meet legal and contractual obligations, resolve disputes, enforce agreements, and protect the Services and our users. Retention depends on the information and context:

We may retain information longer when required by law, subject to a legal hold, needed to prevent fraud or abuse, or necessary to establish, exercise, or defend legal claims. When deletion is not immediately possible because information is in a secured backup, we isolate it from ordinary use until deletion or overwrite.

Your choices

• Account and profile. You can review or update certain information through account and profile settings. You can close your account through available settings or contact us.
• Organization-controlled accounts. Your organization or workspace administrator may need to handle a request concerning information it controls.
• Public and shared content. Use file, profile, workspace, and Marketplace settings to change visibility or unpublish content. Prior copies, caches, and licenses may remain as described above.
• Connected services. Disconnect an integration in Wonder and use the provider's settings to revoke authorization. Disconnecting does not automatically delete previously imported content or undo completed actions.
• Marketing. Use the unsubscribe link in a marketing email or contact us. You may still receive non-marketing communications about your account, security, billing, support, or the Services.
• Cookies and similar technologies. Browser and device settings generally let you remove or block cookies and local storage and prevent images or pixels from loading. Blocking essential technologies may prevent authentication or other features from working. Where the Services provide additional privacy controls, you can use those controls as described at collection.
• Required information. If you do not provide information identified as required, we may be unable to create an account, process payment, provide a feature, or respond to a request. Optional fields can be left blank.

Do Not Track and universal opt-out signals

Some browsers send legacy "Do Not Track" ("DNT") signals. Because there is no uniform DNT standard, Wonder does not respond to DNT signals.

DNT is different from a legally recognized universal opt-out mechanism such as Global Privacy Control ("GPC"). Wonder does not sell personal information or share it for cross-context behavioral advertising. We honor GPC and other universal opt-out signals to the extent they apply to processing covered by applicable law.

Your privacy rights

Depending on your location and subject to applicable exceptions, you may have the right to:

• know whether and how we process your personal information;
• request access to and a copy of your personal information;
• correct inaccurate personal information;
• request deletion of personal information;
• restrict or object to processing;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent;
• request the categories or specific third parties to which we disclosed personal information, where applicable;
• opt out of targeted advertising, sale or sharing, or certain profiling where applicable;
• obtain information about and, where applicable, question or request review of certain profiling decisions;
• limit certain uses of sensitive personal information;
• appeal our refusal to act on a request; and
• receive equal service and not be discriminated against for exercising a privacy right.

To exercise a right, submit our data subject access request form or email team@wonder.so. We will respond as required by applicable law.

We may need to verify your identity and authority using information associated with your account or request. We use verification information only to process the request and for security and fraud prevention. If Wonder processes the information solely on behalf of a customer, we may direct you to that customer and assist it as required by our DPA and applicable law.

EEA, UK, and Switzerland

In the EEA, UK, and Switzerland, applicable rights may include access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right to complain to a supervisory authority. You can find EEA authorities through the European Data Protection Board, contact the UK Information Commissioner's Office, or contact the Swiss Federal Data Protection and Information Commissioner.

United States

If you live in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, applicable law may give you some or all of the rights listed above. These rights are not absolute, and the law may permit or require us to deny part of a request.

Categories of personal information

The following table describes categories of personal information Wonder has collected in the preceding 12 months. Examples describe information within a category and do not mean we collect every example about every person.

We collect these categories from you; your organization, administrators, and collaborators; connected services; authentication, payment, analytics, monitoring, communications, and other providers; and public sources you direct us to use. We use them for the purposes described under How we use personal information.

During the preceding 12 months, we disclosed the categories marked "Yes" or "Limited" for business purposes to service providers and subprocessors as necessary for their services; to connected services and other recipients at a user's direction; to workspace administrators and collaborators according to permissions; to the public when a user chose to publish information; and to advisers or authorities where legally necessary. The category depends on the service: for example, WorkOS processes authentication identifiers, Stripe processes billing and transaction information, AI providers process requested Input and context, and analytics or security providers process usage and diagnostic information.

We have not sold personal information or shared it for cross-context behavioral advertising in the preceding 12 months. We do not use sensitive personal information to infer characteristics about individuals.

Exercising US privacy rights

Submit a request through our data subject access request form or email team@wonder.so. You may designate an authorized agent where applicable. We may request proof of the agent's authority and may need to verify your identity directly.

If we deny a request and your state's law provides an appeal right, appeal by emailing team@wonder.so with the subject "Privacy Request Appeal." We will provide a written decision and information about contacting your state attorney general where required.

California Civil Code section 1798.83 ("Shine the Light") may allow California residents to request information about personal information disclosed to third parties for their direct-marketing purposes. Wonder does not disclose personal information to third parties for those third parties' own direct marketing without consent. You may nevertheless submit a request using the contact details below.

Australia, New Zealand, and South Africa

Residents of Australia, New Zealand, and South Africa may request access to or correction of personal information and may have additional rights under applicable privacy law. If you are dissatisfied with our response, you may be entitled to contact the Office of the Australian Information Commissioner, the New Zealand Privacy Commissioner, or the Information Regulator of South Africa.

Security

We use technical, organizational, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, disclosure, or access. Measures include encryption in transit and at rest through managed infrastructure, access controls, authentication protections, monitoring, secure development practices, incident response, backups, personnel confidentiality, and vendor review, as further described in our DPA.

No online service is completely secure. We cannot guarantee that unauthorized access, loss, or disclosure will never occur. You are responsible for protecting credentials, configuring workspace and public-sharing permissions, maintaining repository and endpoint security, and keeping independent copies of content you cannot afford to lose.

International transfers

Wonder is based in the United States, and we and our providers process information in the United States and other countries listed on our Subprocessor List. These countries may have privacy laws different from those where you live.

Where required for a restricted transfer from the EEA, UK, or Switzerland, we use an approved transfer mechanism such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the applicable Swiss modifications, an adequacy decision, or another lawful safeguard. Our DPA provides additional details for Customer Personal Data. Contact us to request more information about applicable safeguards.

Children

The Services are intended only for people who have reached the legal age of majority where they live and are not directed to children. We do not knowingly collect personal information from anyone who has not reached that age. If you believe an underage person has provided personal information to Wonder, contact us. If we confirm that we collected it contrary to this policy or applicable law, we will take reasonable steps to delete it.

Other websites and services

The Services may link to or interoperate with websites, applications, and services operated by others. Wonder does not control those third parties or their independent privacy practices. A link or integration does not mean we endorse the third party. Review the third party's privacy policy and permissions before providing information or connecting an account.

Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to the Services, law, security, or our practices. We will post the revised policy and update the date above. If a change materially affects how we use personal information, we will provide additional notice through the Services, by email, or by another reasonable method before the change takes effect when required by law. We will obtain consent where applicable law requires it.

Contact us

Aquila Labs, Inc. is a Delaware corporation. Privacy correspondence and requests may be sent to:

Aquila Labs, Inc. (Wonder)

Attn: Privacy

131 Continental Dr Suite 305

Newark, DE 19713

United States

• Email: team@wonder.so
• Privacy requests: Data subject access request form