Effective date: 2026-05-18.
This Privacy Policy explains how wrxstack ("wrxstack", "we", "us") handles personal information in connection with the wrxstack platform, together with our websites, apps, APIs, and related services (the "Service"). wrxstack is an independent product built by a very small team.
If you use the Service through your employer or another organization (the "Customer"), that organization is the controller of personal information you submit and access through the Service. This Policy describes our practices as a controller for our own account and communications data, and as a processor on behalf of Customers. Where we act as a processor, our handling of personal information is governed by our Data Processing Addendum with the Customer and that Customer's own privacy notices apply.
1. Who we are and how to reach us
wrxstack is operated by the individual who runs it. For any question about this Policy or to exercise your rights, contact us at contact@wrxstack.com.
2. Information we collect
We collect personal information in the following categories:
2.1 Account information
When you sign up for an account, we collect your name, email address, and a hashed password.
2.2 Billing information
If you purchase a paid subscription, we collect the billing contact details and tax information needed to complete the transaction. We do not store full payment card numbers.
2.3 Usage information
We collect information about how you use the Service, including pages accessed, features used, timestamps, approximate location derived from IP, and aggregate performance metrics. We use this information to operate, secure, debug, and improve the Service.
2.4 Content you submit
The Service stores content you and your team create or upload ("Customer Content"). Customer Content is handled on behalf of the Customer under the terms of the applicable subscription agreement and DPA.
2.5 Device & technical information
We collect IP address, browser and operating system type and version, language, time zone, and similar technical information. We use it to deliver the Service, prevent fraud and abuse, and produce aggregate analytics.
2.6 Communications
When you contact us by email or through our contact form, we keep the content of those communications and metadata about them.
3. How we use information
We use personal information to:
- provide, maintain, and improve the Service;
- create and secure accounts;
- process subscriptions, payments, and taxes;
- respond to support requests and operational notices;
- send Service-related communications, including security alerts and changes to this Policy;
- send marketing communications where permitted by law, with an easy way to opt out;
- monitor and protect the Service against abuse, fraud, and security threats;
- comply with legal obligations, respond to lawful requests, and enforce our terms;
- generate aggregate analytics and develop new features.
4. Legal bases (EEA, UK, Switzerland)
If you are in the EEA, UK, or Switzerland, we rely on the following legal bases under Article 6 GDPR:
- Contract, to provide the Service you have requested and to perform our contract with you or your employer.
- Legitimate interests, to secure the Service, prevent abuse, improve our products, and run our business. We carry out balancing tests where required.
- Legal obligation, to comply with tax, accounting, and other legal requirements.
- Consent, where we ask for it, for example to send some marketing emails or to set non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
5. AI & machine learning
We do not use Customer Content to train any model. Customer Content sent to a model provider for inference is transmitted under that provider's API terms, which prohibit using the content to train models. We do not share Customer Content with model providers for training, fine-tuning, or evaluation.
We may use aggregated, de-identified usage signals to evaluate performance and improve product quality. These signals do not contain Customer Content.
6. Cookies and similar technologies
We use a small number of strictly necessary and functional cookies, and, with your consent, analytics. We do not set advertising or cross-site tracking cookies and we do not embed third-party advertising tags. See our Cookie Policy for the full list and your controls.
7. Sharing personal information
We share personal information with:
- Sub-processors who help us operate the Service (hosting, analytics, and contact-form delivery). See the current sub-processor list.
- Professional advisors, bound by confidentiality, where reasonably needed to run our business.
- Authorities, when required by law, by valid legal process, or to protect rights, life, or property. We resist overbroad requests and notify Customers where lawful.
- In a corporate transaction, in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality.
We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under California law.
8. International data transfers
wrxstack is based in the United States and its infrastructure is hosted there through our hosting provider. Where personal information is transferred from the EEA, UK, or Switzerland to the US or another country that the European Commission has not declared adequate, we rely on the Standard Contractual Clauses (Module 2 controller-to-processor; Module 3 processor-to-processor) and, for UK transfers, the UK International Data Transfer Addendum to the SCCs (UK IDTA). For Swiss transfers, we apply the Swiss FDPIC addendum.
9. Retention
We retain personal information only as long as we need it for the purposes described in this Policy, to provide the Service to the Customer, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. When a Customer subscription ends, Customer Content is promptly deleted from the live database; copies in our hosting provider's backups age out on that provider's ordinary backup rotation and are then removed.
10. Your rights
Depending on where you live, you may have the right to:
- access the personal information we hold about you;
- correct inaccurate personal information;
- delete your personal information;
- port your personal information to another service in a structured, commonly used format;
- restrict or object to certain processing, including direct marketing;
- withdraw consent where we rely on it;
- opt out of "sales" or "sharing" of personal information (none performed by wrxstack);
- limit the use of sensitive personal information;
- lodge a complaint with your local supervisory authority.
To exercise these rights, email contact@wrxstack.com. We respond within 30 days, extendable by a further 60 days for complex requests. If your personal information is part of Customer Content, we will forward your request to the Customer (the controller) and assist them in responding.
11. Children
The Service is intended for users aged 16 and over and is designed for use in the workplace. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact contact@wrxstack.com and we will delete it.
12. Security
We protect personal information with these measures: content is encrypted in transit using TLS 1.3; data at rest is encrypted using the encryption provided by our managed hosting provider; and Customer Content is not used to train models, which is enforced by the model provider's API terms. We do not hold any security certification or audit report. See the DPA Annex II for the same measures stated for our processor role.
13. Changes to this Policy
We may update this Policy from time to time. If we make material changes, we will provide reasonable notice, at least 30 days for changes that adversely affect your rights, through the Service, by email, or by other appropriate means. The "Effective date" above will reflect the most recent version. Continued use of the Service after the effective date constitutes acceptance.
14. Contact us
If you have questions, concerns, or complaints about this Policy or our practices, email contact@wrxstack.com.