Legal, Last updated: 2026-11-01

Privacy Policy.

How wrxstack collects, uses, shares, and protects personal information across the wrxstack platform, and the rights you have over it.

Effective date: 2026-11-01.

This Privacy Policy explains how wrxstack ("wrxstack", "we", "us") handles personal information in connection with the wrxstack platform, together with our websites, apps, APIs, and related services (the "Service"). wrxstack is an independent, privately owned product built and run by a small team.

If you use the Service through your employer or another organization (the "Customer"), that organization is the controller of personal information you submit and access through the Service. This Policy describes our practices as a controller for our own account and communications data, and as a processor on behalf of Customers. Where we act as a processor, our handling of personal information is governed by our Data Processing Addendum with the Customer and that Customer's own privacy notices apply.

1. Who we are and how to reach us

wrxstack is an independent, privately owned product run by a small team. For any question about this Policy or to exercise your rights, contact us at contact@wrxstack.com.

2. Information we collect

We collect personal information in the following categories:

2.1 Account information

When you sign up for an account, we collect your name, email address, and a hashed password.

2.2 Billing information

If you purchase a paid subscription, we collect the billing contact details and tax information needed to complete the transaction. We do not store full payment card numbers.

2.3 Usage information

We collect information about how you use the Service, including pages accessed, features used, timestamps, approximate location derived from IP, and aggregate performance metrics. We use this information to operate, secure, debug, and improve the Service.

2.4 Content you submit

The Service stores content you and your team create or upload ("Customer Content"). Customer Content is handled on behalf of the Customer under the terms of the applicable subscription agreement and DPA.

2.5 Device & technical information

We collect IP address, browser and operating system type and version, language, time zone, and similar technical information. We use it to deliver the Service, prevent fraud and abuse, and produce aggregate analytics.

2.6 Communications

When you contact us by email or through our contact form, we keep the content of those communications and metadata about them.

2.7 Applications

If you apply to a program we run, such as the growth consultant program described on our Careers page, we collect what you send us, for example your name, email address, location, profile link, and your answers. We use it only to assess your application and to contact you about it. Applying does not create any agreement, offer, or obligation to engage you. We keep application details only as long as we need them for that purpose or as the law requires, and then delete them.

3. How we use information

We use personal information to:

  • provide, maintain, and improve the Service;
  • create and secure accounts;
  • process subscriptions, payments, and taxes;
  • respond to support requests and operational notices;
  • send Service-related communications, which may include security alerts and notices of changes to this Policy;
  • send marketing communications where the law permits, with a way to opt out;
  • monitor and protect the Service against abuse, fraud, and security threats;
  • comply with legal obligations, respond to lawful requests, and enforce our terms;
  • generate aggregate analytics and develop new features.

4. Legal bases (EEA, UK, Switzerland)

If you are in the EEA, UK, or Switzerland, we rely on the following legal bases under Article 6 GDPR:

  • Contract, to provide the Service you have requested and to perform our contract with you or your employer.
  • Legitimate interests, to secure the Service, prevent abuse, improve our products, and run our business. We carry out balancing tests where required.
  • Legal obligation, to comply with tax, accounting, and other legal requirements.
  • Consent, where we ask for it, for example to send some marketing emails or to set non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.

5. AI & machine learning

We do not use Customer Content to train any model. Customer Content sent to a model provider for inference is transmitted under that provider's API terms, which, as we understand them, do not permit the provider to use that content to train its models. We choose providers with terms of this kind, but we do not control how a provider applies its own terms. We do not share Customer Content with model providers for training, fine-tuning, or evaluation.

We may use aggregated, de-identified usage signals to evaluate performance and improve product quality. These signals do not contain Customer Content.

6. Cookies and similar technologies

We use a small number of strictly necessary and functional cookies, and analytics. In the EEA, the UK, and Switzerland, analytics cookies are set only after you accept them; elsewhere analytics may run by default and you can decline at any time, and we treat a Global Privacy Control signal as an opt-out. We do not set advertising or cross-site tracking cookies and we do not embed third-party advertising tags. See our Cookie Policy for the full list and your controls.

7. Sharing personal information

We share personal information with:

  • Sub-processors who help us operate the Service (hosting, analytics, and contact-form delivery). See the current sub-processor list.
  • Professional advisors, bound by confidentiality, where reasonably needed to run our business.
  • Authorities, when required by law, by valid legal process, or to protect rights, life, or property. We may challenge a request we consider overbroad, and we may notify the affected Customer where the law permits, or where the DPA requires it.
  • In a corporate transaction, in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to confidentiality.

We do not sell personal information, and we do not "share" personal information for cross-context behavioral advertising as those terms are defined under California law.

8. International data transfers

wrxstack is operated from India, and its infrastructure is hosted in the United States through our hosting provider. Where personal information is transferred from the EEA, UK, or Switzerland to India, the US, or another country that the European Commission has not declared adequate, we rely on the Standard Contractual Clauses (Module 2 controller-to-processor; Module 3 processor-to-processor) and, for UK transfers, the UK International Data Transfer Addendum to the SCCs (UK IDTA). For Swiss transfers, we apply the Swiss FDPIC addendum.

9. Retention

We retain personal information only as long as we need it for the purposes described in this Policy, to provide the Service to the Customer, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. When a Customer subscription ends, we take reasonable steps to delete Customer Content from the live database within a reasonable period; copies in our hosting provider's backups age out on that provider's ordinary backup rotation. The Data Retention Policy has more detail.

10. Your rights

Depending on where you live, you may have the right to:

  • access the personal information we hold about you;
  • correct inaccurate personal information;
  • delete your personal information;
  • port your personal information to another service in a structured, commonly used format;
  • restrict or object to certain processing, including direct marketing;
  • withdraw consent where we rely on it;
  • opt out of "sales" or "sharing" of personal information (none performed by wrxstack);
  • limit the use of sensitive personal information;
  • lodge a complaint with your local supervisory authority.

To exercise these rights, email contact@wrxstack.com. Step-by-step deletion instructions, including for accounts created with Facebook, Microsoft, Google, Apple, or another sign-in provider, are in our Data Deletion Policy. We may need to verify your identity before we act on a request. We respond within the period the law that applies to your request requires: under the GDPR and UK GDPR this is one month, extendable by two further months where the law permits, and under the CCPA it is 45 days, extendable once by a further 45 days. Where no law sets a period, we aim to respond within a reasonable time. If your personal information is part of Customer Content, we may refer your request to the Customer (the controller), and we assist the Customer to the extent the DPA or the law requires.

11. Children

The Service is intended for users aged 16 and over and is designed for use in the workplace. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, please contact contact@wrxstack.com and we will take reasonable steps to delete it, as the law requires.

12. Security

We take reasonable steps to protect personal information. Our measures include the following: content is encrypted in transit using TLS 1.3; data at rest is encrypted using the encryption provided by our managed hosting provider; and Customer Content is not used to train models, which is enforced by the model provider's API terms. No method of transmission or storage is completely secure, and we cannot guarantee the security of any information. We do not hold any security certification or audit report. See the DPA Annex II for the same measures stated for our processor role.

13. Changes to this Policy

We may update this Policy from time to time. We will give notice of changes where the law or the Terms require it, and the effective date shows the current version.

14. Users in India

wrxstack is operated from India. For users in India, we handle personal information in line with the Information Technology Act, 2000 and the rules made under it, including the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and, to the extent its provisions are in force, the Digital Personal Data Protection Act, 2023 and the rules made under it. You may raise any concern about how we process your personal information with the Grievance Officer, wrxstack, at contact@wrxstack.com, as described in our Grievance Redressal Policy.

This Policy explains our practices. It is not a contract, and it does not create any contractual obligation, warranty, guarantee, or right for you or for any other person. The only agreements between you and wrxstack are the Terms of Service and, where it applies, the Data Processing Addendum.

Timelines and targets in this Policy are goals we aim to meet, not guarantees, except where a law that applies to us sets a deadline, in which case we follow that law. Nothing in this Policy increases wrxstack's liability. The disclaimers, the limitation of liability, and the other protections in the Terms of Service apply to everything this Policy describes. Nothing in this Policy limits a right you have under a law that cannot be limited by agreement.

16. Contact us

If you have questions, concerns, or complaints about this Policy or our practices, email contact@wrxstack.com.