Legal

Privacy policy

Last updated: 12 October 2026

This policy explains what personal data Widzy collects, why, how long we keep it and what rights you have. Widzy is a product of Maistral d.o.o. We keep data to a minimum: Widzy does not store visitors' IP addresses, does not build advertising profiles and does not sell data.

1. Who is responsible

Maistral d.o.o., Veslačka ulica 15b, 10000 Zagreb, Croatia, Tax ID HR15442964459 ("Maistral", "we"). Contact for anything about personal data: widzy@maistral.com.

Our role depends on whose data it is. For this website, demo requests and the accounts of our customers we are the controller. For the visitors of our customers' websites, where a Widzy widget is shown, our customer is the controller and we act as their processor (section 4).

2. Visitors of widzy.maistral.com

Demo and partner requests

When you ask for a demo or to become a partner, we store your email address, company, website and, if you give it, your phone number, whether you asked for a demo or a partnership, and the time of the request. Our team adds notes about our contact with you (calls, emails, meetings). We use this only to talk to you about Widzy. Legal basis: steps at your request before entering into a contract (Art. 6(1)(b) GDPR). A request that did not lead to a customer relationship is deleted 12 months after it was closed or last updated, or sooner when you ask.

Hosting and fonts

The website is served by Cloudflare, which processes your IP address to deliver the page and protect it from abuse; we do not store it ourselves. Cloudflare keeps short-lived technical logs of requests for troubleshooting, deleted after a few days. The page loads fonts from Google Fonts, so your browser sends your IP address to Google when it loads them. To limit how often one address can submit the form, we use the address for a minute as a counter key and never store it. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). This website sets no cookies.

3. Customers using the Widzy app

For people with a Widzy account (managers of organizations and agency staff) we store first and last name, email address, job title, the organizations and agencies they can access, a securely hashed password and sign-in sessions. For each organization we store its billing details (company name, address, Tax ID and the email address for invoices), its plan and add-ons, and when the terms of service were accepted. Requests and messages sent to the Widzy team in the app are kept with the organization, with who wrote them and when. When you start a free trial we email you a code and a link to confirm your email address, and when you ask for it a link to set a new password; we keep only a hashed form of the code and link until it is used or expires (15 and 30 minutes), then delete it. A session record holds a random token and the expiry time, but no IP address; expired sessions are deleted daily. The app uses one strictly necessary cookie to keep you signed in.

We also store what customers upload or enter: videos, posters, logos, calls to action and settings. When a customer connects an Instagram professional account, we store its Instagram user ID and username and an access token (encrypted), and import the account's reels with their caption, thumbnail and link; we read nothing else from Instagram. Disconnecting in Widzy, or removing Widzy in Instagram's settings, deletes the connection at once; imported videos stay until the customer deletes them. Legal basis: performance of our contract with the customer (Art. 6(1)(b) GDPR) and our legitimate interest in running and securing the service (Art. 6(1)(f) GDPR). We keep account data for as long as the account exists and delete it within 90 days after the contract ends, unless the law requires us to keep it longer (for example invoices).

4. Visitors of websites that show a Widzy widget

When a website shows a Widzy widget, we process data on behalf of the website's owner, under their instructions and our data processing agreement. The website owner decides whether and when the widget runs and is responsible for informing visitors and, where needed, asking for their consent.

• What the widget records: that the widget was shown, that the player was opened, which videos were watched and for how long, and which calls to action were tapped. If the website reports a conversion (for example a purchase, with its name, value and currency), Widzy checks whether the same visit watched a video or opened the player in the two days before.
• Identifier: a random ID kept in the browser's session storage for the current browser tab, so that one visit is not counted twice. It is not a cookie, contains nothing about you and disappears when the tab is closed. Links in the widget's calls to action carry this ID (as a wz_sid parameter) so the website owner's other pages can recognise the same visit. Websites that ask for consent can keep the widget from storing anything until the visitor agrees.
• No IP addresses: we do not store visitors' IP addresses. To stop automated abuse we use the address for a minute as a counter key, then discard it. Traffic from known crawlers is ignored.
• Retention: the per-visit records used to avoid double counting and to attribute conversions are deleted within three days; only daily totals and conversions without any visit ID remain.

Visitors who want to exercise their rights should contact the owner of the website they visited; we will help them respond.

5. Who else processes data

• Cloudflare, Inc. (hosting, database, file storage, content delivery). Cloudflare may process data outside the EU; such transfers rely on the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
• Google LLC (Google Fonts on this website only, as described in section 2).
• Meta Platforms Ireland Ltd. (only for customers who connect Instagram: Widzy reads their reels through Instagram's API).
• n8n GmbH (Germany) and Microsoft Ireland Operations Ltd. (Microsoft 365) send account emails (email confirmation codes and password reset links) on our behalf from widzy@maistral.com; they receive the recipient's email address, first name and the email's contents.

We do not sell personal data and do not share it for advertising.

6. Your rights

You can ask us for access to your personal data, its correction or deletion, restriction of processing, data portability, and you can object to processing based on our legitimate interest. Customers can download their own data and their organization's data, and delete their account or organization, themselves in the Widzy app (Account and the organization's Overview page). Otherwise write to widzy@maistral.com; we reply within one month. You can also lodge a complaint with the Croatian data protection authority, Agencija za zaštitu osobnih podataka (AZOP), azop.hr, or the authority where you live.

7. Security

Data is encrypted in transit, passwords are stored only as hashes, each customer's data is separated from every other customer's, and access inside Maistral is limited to the people who run the service.

8. Changes

When this policy changes we update the date at the top. We tell customers about significant changes by email in advance.