Data Export and Portability.

Effective date: 2026-10-27.

This Data Export and Portability Policy (this "Policy") explains how you can obtain a copy of your personal data and content from wrxstack ("wrxstack", "we", "us"), how we respond to requests for access and for data portability, and how you can move your data to another provider. It applies to the wrxstack products, including Atlas at atlas.wrxstack.com and Folio, the portfolio and personal-site builder, at portfolio.wrxstack.com, and to the website at wrxstack.com (together, the "Service").

This Policy supplements our Privacy Policy, our GDPR Statement, and our California Notice. If one of those documents and this Policy differ on an export or access matter, this Policy controls for that matter. Neither document limits a right the law gives you.

The short version

You can get a copy of your data in any of the three ways below. Each one is free. You do not need to give a reason.

1. Scope and roles

This Policy covers personal data and content that wrxstack holds about you or for you in connection with the Service, including:

• your account record, such as your name, email address, profile picture, and preferences;
• profile data shared with us by a sign-in provider you chose to use, such as Google, Apple, Microsoft, or LinkedIn;
• content you create or upload in the Service, such as portfolios, pages, documents, files, and records;
• technical and usage data connected to your account, such as sign-in and activity records;
• messages you send us, including contact-form submissions and newsletter sign-ups.

Our role. For accounts you open yourself, wrxstack decides how your personal data is used and is responsible for answering your access and portability requests under this Policy. Where you use the Service through an account that your employer or another organization (the "Customer") controls, that Customer decides what happens to the data in its workspace, and we act on its instructions under our Data Processing Addendum. Section 14 explains how that changes the steps.

Who operates wrxstack. wrxstack is an independent, privately owned product run by a small team. All export and access requests are handled through contact@wrxstack.com.

2. Your rights to access and portability

Every person who uses the Service may ask us for a copy of the personal data we hold about them, wherever that person lives, and we aim to consider each request on the same basis, subject to section 20. Depending on your location, the law may also give you the legal rights listed below. Where a law gives you a stronger right than this Policy describes, we follow that law.

We will not deny you the Service, charge you differently, or treat you less favorably because you asked for a copy of your data or asked us to move it.

3. Access and portability compared

The two rights overlap but are not the same, and you do not need to name the right correctly for us to help you. We aim to read each request in the way that best fits what you asked for.

• Access covers all personal data we hold about you, whatever its source, together with information about how we use it. Its purpose is to let you see and check what we hold.
• Portability covers the data you provided to us, including content you created and data generated by your use of the Service, in a form that another service can read. Its purpose is to let you reuse your data elsewhere.

In practice, a full copy under Way 2 is intended to answer both: it is meant to contain the personal data we hold about you, subject to section 9, in machine-readable files, with an explanation of each part.

4. Way 1: Export in the product

4.1 Folio (portfolio.wrxstack.com)

The owner of a Folio workspace can download its content in one step:

1. Sign in at portfolio.wrxstack.com with the same method you used to create the account.
2. Open your workspace and go to Settings.
3. Choose Your data.
4. Select Export your data. Your browser downloads a single file containing your workspace content.

The download includes your profile and contact details, your outcomes and case studies in every status including drafts, your experience timeline, links, testimonials, skills, awards, and credentials, the messages received through your portfolio contact form, a summary of your portfolio analytics, your site, search, and theme settings, and a list of your media files. Each media item in the list carries a link to the original file you uploaded, so you can download every original.

The export is available only to the workspace owner, because it contains the names, email addresses, and messages of people who contacted you. Editors and other members see the option but cannot use it. If you are not the owner, ask the owner, or use Way 2 for the data that is about you.

Folio also lets you download the messages in the contact inbox, and lets the workspace owner download the workspace activity log, as separate spreadsheet files in CSV format. These are convenient extracts. They do not replace the full export.

The in-product export covers your workspace content. Data held at account level, such as your sign-in connections and account record, is not part of that file. Use Way 2 to receive it.

4.2 Atlas (atlas.wrxstack.com)

Sign in at atlas.wrxstack.com. Where Atlas shows an export or download option for an item or a module, you can use it to save that content. Atlas also offers a REST API, described in section 6. If you want a complete copy of your Atlas data, or the option you need is not shown to you, use Way 2 and we will prepare the copy for you. If your Atlas account belongs to an organization's workspace, read section 14 first.

4.3 Before you rely on an in-product export

• An in-product export is a snapshot of your data at the moment you download it. Later changes are not included unless you export again.
• Check the file opens and contains what you expect before you delete anything from the Service.
• If an export fails or looks incomplete, tell us at contact@wrxstack.com and ask for a copy under Way 2.

5. Way 2: Request a copy by email

Send an email to contact@wrxstack.com with the subject line Data export request. Send it from the email address on your wrxstack account if you can, because that is the fastest way for us to confirm the request is yours. Please include:

• the product or products concerned (Atlas, Folio, the website, or all of them);
• the email address on the account, and the sign-in method you use, for example Google, Apple, Microsoft, LinkedIn, or email and password;
• whether you want a full copy of everything we hold about you, or only specific data or a specific period;
• whether you want the data sent to you, or, where the law gives you that right and it is technically feasible, sent directly to another provider (see section 16).

Where we send the copy. We normally send the copy only to the email address on the account. This protects you against a person who pretends to be you and asks for your data to be sent elsewhere. If you no longer have access to that address, tell us, and we may agree a safe way to deliver it after verifying you under section 12.

If you prefer, you may send a request by any other reasonable means of contacting us. We aim to handle it in the same way, provided it is clear and we can verify it.

6. Way 3: Retrieve data through the API

Atlas provides a REST API and webhooks. With an API key issued in your account, you can read the records your role permits and copy them into another system, either once or on a regular schedule. This is often the most practical way to move a large amount of data, or to keep two systems in step while you change providers.

• The API returns data in a structured, machine-readable form that other software can process.
• The API applies the same permissions as the product. It does not give access to data your role cannot see.
• Treat API keys as secrets. Anyone who holds a key can read the data it permits. Revoke a key you no longer need.
• Use of the API is subject to the Terms of Service and the Acceptable Use Policy.

7. What a copy includes

A full copy under Way 2 is intended to include the following, to the extent we hold it about you and subject to section 9:

We do not apply a fixed look-back period, except where the law allows one. A copy reflects what we hold about you on the date we prepare it, subject to section 9.

8. Information we give with a copy

With a full copy, we also tell you, in plain language:

• why we use each category of data, and the legal basis we rely on;
• the categories of personal data we hold about you;
• the sources of the data, for example you, a sign-in provider you chose, or the organization that manages your account;
• the service providers that receive the data to run the Service, as listed on our sub-processor list;
• how long we keep the data, or the criteria we use to decide;
• that the data is stored in the United States, and the safeguards that apply to international transfers;
• your rights to correct, delete, restrict, and object, and your right to complain to a supervisory authority;
• whether we make decisions about you based solely on automated processing. We do not make decisions with legal or similarly significant effects about you in that way;
• that we do not sell your personal data or share it for cross-context behavioral advertising.

9. What a copy does not include

To protect you and other people, a copy does not include the following:

• Secrets and credentials. Password hashes, sign-in tokens, session tokens, API key values, webhook signing secrets, and recovery codes. Including them would put your account at risk if the copy were lost. You can see and manage your connections in the product.
• Other people's personal data, except where it forms part of your own content, as explained in section 15.
• Security records whose disclosure would weaken the security of the Service or help someone abuse it, such as records relating to an ongoing investigation of fraud or abuse.
• Data held only in backups. Our hosting provider keeps encrypted backups for disaster recovery. We do not restore backups to answer an access request. Data deleted from the live Service is not included.
• Data held by third parties for their own purposes, such as the records a sign-in provider keeps about the apps you have connected. Ask that provider for a copy.
• Analytics data not linked to your identity, as explained in section 18.
• De-identified and aggregated information, such as total counts of accounts, which is not personal data.
• Material protected by law, such as legally privileged communications, or information we are legally prohibited from disclosing.

Where the law requires it, we tell you which categories we left out and why.

10. Formats

We provide data in structured, commonly used, machine-readable formats that you can open with ordinary software and that another service can import.

• Structured data, such as your content, settings, and records, is provided as JSON, a widely used text format for structured data, or as spreadsheet files in CSV format where the data is a simple list.
• Uploaded files are provided in the format in which you uploaded them, or as links to those original files.
• Explanations are provided in the body of our email or as a plain text document.

If you need the data in a different commonly used format, ask us. We may provide it at our discretion where we can do so with reasonable effort. We do not use proprietary formats that need wrxstack software to open.

11. Timelines

Where a law that applies to you sets a different deadline, we follow that law. You may ask about the status of your request at any time by replying to our acknowledgement or by emailing contact@wrxstack.com.

12. Verifying your identity

A copy of your data would be valuable to someone pretending to be you, so before we send one at an email request we confirm that the request comes from the account holder. We use the least information we need to do that.

• If you email us from the address on the account, we normally treat that as sufficient, and we may send a confirmation link or question to that address.
• If you email from a different address, or no longer have access to the account's address or sign-in provider, we may ask you to answer questions about the account that only the holder would know, or to confirm control of the account in another reasonable way.
• For a request for specific pieces of personal information, we apply a higher standard of verification than for a request that only asks which categories of data we hold.
• We do not ask for your password, a one-time code, or a payment card number.
• Information you give us only for verification is used for that purpose alone, and we aim to delete it once the request is resolved.
• If we cannot verify a request, we aim to tell you why and what would allow us to proceed. We do not send personal data on an unverified request. Where the law requires it, we will still tell you the categories of data we hold.

13. Keeping your copy secure

• In-product exports are downloaded directly over an encrypted connection using TLS 1.3, and only after you have signed in with the required role.
• Email delivery normally goes only to the email address on the account. If the copy is too large to attach, we may send a link from which you can download it, and where we can, we tell you how long the link remains available.
• Links inside a copy. A copy may contain links to your original uploaded files. Anyone who has a link may be able to open the file it points to. Treat the whole copy as confidential, and do not share it or store it where others can read it.
• Your responsibility after delivery. Once a copy reaches you, you control it. Store it securely and delete it when you no longer need it. We are not responsible for what happens to a copy after it has been delivered to you or, at your request, to another provider.

14. Accounts managed by an organization

If you use Atlas or another product through a workspace that your employer or another organization controls, including through its single sign-on, that organization is the Customer and the controller of the content in its workspace.

• Workspace content. Requests for a copy of content in an organization's workspace should go to that organization's administrator, who decides whether and how to provide it. If you send the request to us, we may forward it to the organization and assist it in responding, to the extent our Data Processing Addendum provides. We do not release workspace content to an individual member without the organization's instruction, unless the law requires it.
• Your own account data. Data we hold about you for our own purposes, such as messages you sent us or your marketing preferences, is ours to provide, and we handle that part of your request directly.
• Organization exports. A Customer may export the content of its own workspace using the tools in the product and the API. When the Customer's agreement ends, the Customer may ask us to return its data under section 11 of the Data Processing Addendum.

15. Data about other people

The right to a copy of your data must not harm the rights of other people. Your content may contain information about others, for example messages that visitors sent through your portfolio contact form, or comments by other members of a shared workspace.

• Where the information about another person is part of your own content, such as messages sent to you, we include it, because it is already yours to see. You are responsible for handling it lawfully once you have it.
• Where the information is mainly about another person and not part of your content, we leave it out or remove the details that identify them, unless that person has agreed or the law requires us to include it.

16. Moving your data to another provider

You may take your data to any other service, at any time, for any reason. We do not use contract terms or technical measures to stop you from doing so.

• Yourself. Download your data using Way 1, Way 2, or Way 3, then import it into the new service using that service's tools.
• Direct transmission. Where the law gives you that right, such as Article 20 of the GDPR, and it is technically feasible, you may ask us to send your data directly to another provider. Tell us the provider and how it accepts data. Where direct transmission is not technically feasible, for example because the provider offers no secure way to receive it, we may send the copy to you instead, so that you can pass it on.
• Your own domain. If you publish a portfolio on a custom domain, the domain remains yours at your registrar, and you can point it to a new service at any time by changing its DNS records.
• Business customers in the European Union. Where the EU Data Act's rules on switching between data processing services apply to a business's use of the Service, we follow those rules as they apply to us. We do not charge any switching or data egress fee.

We are not responsible for how another provider receives, uses, or protects your data once it has been delivered to it at your request. Check that provider's terms and privacy policy before you ask us to send it data.

17. Requests made on someone else's behalf

• Authorized agents. Where the law allows it, you may use an authorized agent to make a request for you. We may ask the agent for written permission signed by you, and we may ask you to confirm your identity with us directly. We normally send the copy to you at the email address on the account. We may send it to the agent where you instruct us in writing and the law allows it.
• Parents and guardians. A parent or legal guardian may ask us for the data of a child in their care, as explained in section 22.
• Deceased users. A legal representative of a person who has died, such as an executor, may ask for that person's data where the law gives them that right. We may ask for reasonable evidence of the death and of the requester's authority, and we provide only what the law allows.

18. Website visitors without an account

• Contact-form messages. Messages sent through our contact forms reach us by email through our form-delivery provider. Ask us and we will send you a copy of the messages and contact details we hold from you.
• Newsletter. Ask us and we will confirm whether your email address is on our newsletter list and send you the details held with it.
• Analytics. Analytics on the website load only with your consent and are linked to a random identifier in your browser, not to your name or email address. Because analytics data is not tied to your identity, we generally cannot find it from an email address. If you give us the identifier, and the analytics provider's tools allow it, we will ask that provider for the associated data and send it to you. You can manage consent in the cookie settings described in our Cookie Policy.

19. After an account is closed

Export your data before you delete your account or before a subscription ends. Once data has been deleted from the live Service under our Data Deletion Policy, we cannot provide a copy of it, and we do not restore backups to recover it. If you ask for a copy after deletion, we tell you what, if anything, we still hold, such as records we must keep by law, and provide a copy of that, subject to section 9.

20. When we may decline or limit a request

We may decline or limit a request where the law allows, including where:

• we cannot verify that the request comes from the account holder or a person authorized to act for them;
• providing the data would harm the rights of another person, as described in section 15;
• the law requires or permits us to withhold the data, as described in section 9;
• the data is controlled by an organization, in which case we forward the request as described in section 14;
• the request is manifestly unfounded or excessive, for example a high volume of repetitive requests intended to disrupt the Service.

If we decline or limit a request, we tell you, as the law requires, the reason unless the law prohibits it, and how to raise a complaint. Where we can, we provide the parts of the request we are able to.

21. No fees and no compensation

We do not charge any fee to provide a copy of your data, to send it to another provider, to verify a request, or to answer questions about it, and this applies to repeat requests as well. A request, an export, a transfer, or anything else described in this Policy does not create any right to a payment, credit, reimbursement, reward, or compensation of any kind, for either you or us. This Policy describes how export and portability work. It does not change any other right or obligation under the Terms of Service.

22. Children

The Service is intended for people aged 16 and over. We do not knowingly collect personal data from anyone younger. If you are the parent or legal guardian of a child under 16 who has given us personal data, email contact@wrxstack.com. After verifying your authority, we will take reasonable steps to tell you what we hold and, at your choice, provide a copy, delete it, or both.

23. Questions and complaints

If you are not satisfied with how we handled your request, reply to our message or email contact@wrxstack.com and we will consider it again. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work, or where you believe an infringement took place. In the United Kingdom, this is the Information Commissioner's Office. In California, you may contact the California Privacy Protection Agency. You do not have to contact us before going to an authority.

24. Changes to this Policy

We may update this Policy to reflect changes to the Service, to the export options in each product, or to the law. We will give notice where the law or the Terms require it, and the effective date at the top shows the current version.

25. Legal effect of this Policy

This Policy explains our practices. It is not a contract, and it does not create any contractual obligation, warranty, guarantee, or right for you or for any other person. The only agreements between you and wrxstack are the Terms of Service and, where it applies, the Data Processing Addendum.

Timelines and targets in this Policy are goals we aim to meet, not guarantees, except where a law that applies to us sets a deadline, in which case we follow that law. Nothing in this Policy increases wrxstack's liability. The disclaimers, the limitation of liability, and the other protections in the Terms of Service apply to everything this Policy describes. Nothing in this Policy limits a right you have under a law that cannot be limited by agreement.

26. Contact

For any export or access request, or any question about this Policy, email contact@wrxstack.com. Related documents: Privacy Policy, Data Deletion Policy, GDPR Statement, California Notice, Data Processing Addendum, Sub-processor List, and Data handling.