Privacy Policy

---

1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and password (stored in hashed form). If you register through a third-party authentication provider (Google, Apple, Microsoft, etc.), we receive your name and email from that provider.

1.2 Company and Application Data

As a multi-tenant platform, we collect company names, application configurations, and related organizational data you provide when setting up your workspace.

1.3 Usage Data

We automatically collect information about how you interact with the Platform, including API call logs, page views, feature usage, session data, and telemetry. This helps us improve our services and diagnose issues.

1.4 AI Interaction Data

If you use Wildwood's AI features, we may process conversation data, prompts, model configurations, and the responses returned by the AI provider you have configured. AI interactions are scoped to your application and are not shared across tenants. Specifically:

• Chat and request logs — prompts, responses, token counts, and the model used are retained so you can review usage, cost, and errors in the administration portal
• AI flow runs — if you use AI Flows, the flow engine persists run state and checkpoints so that a run can be resumed or paused for human review. That state includes the conversation content passed through the flow
• Retrieval data — where you enable retrieval over your own documents, we store vector embeddings derived from that content
• Speech synthesis — if you enable text-to-speech, the text to be spoken is sent to the speech provider you have configured to generate audio

1.5 Documents and Files You Upload

If you use the Documents feature, we store the files you or your users upload, together with file metadata (name, type, size, uploader, and timestamps) and any text extracted from those files for search and retrieval. Text extraction is performed by Wildwood on our own infrastructure. Each application defines its own limits on file size, permitted file types, and total storage.

1.6 Notification and Device Tokens

If you enable push notifications, we store per-user device tokens issued by Apple Push Notification service, Firebase Cloud Messaging, or Web Push, along with the platform and device information needed to route a notification. We also store your notification delivery preferences and a record of notifications sent.

1.7 Feedback and Support Submissions

When feedback is submitted through the in-app feedback widget, we collect the message itself and, where provided, the submitter's name and email address, the page address, any screenshot or attachments, browser and diagnostic context, IP address, and user agent. This information is used to reproduce and resolve the issue reported. See Section 4 for what happens when an application forwards feedback to an external issue tracker.

1.8 Payment Information

Payment processing is handled by third-party providers (e.g., Stripe). We do not store full credit card numbers. We retain transaction identifiers and subscription status for billing purposes.

1.9 Device and Technical Information

We collect IP addresses, browser type, operating system, device identifiers, and similar technical information to ensure security and optimize performance.

1.10 Audit and Access Logs

We maintain audit records of security-relevant activity, including administrative actions (the acting user, company, application, action, affected record, IP address, and user agent), authentication and token events, AI request and skill-usage logs, and logs of calls made through our Model Context Protocol ("MCP") endpoints. These records exist for security monitoring, abuse prevention, billing accuracy, and forensic investigation.

1.11 Data Stored via the Platform

The Platform may store data generated by or submitted through connected applications, including but not limited to:

• Personally Identifiable Information ("PII")
• Financial and payment-related records
• Authentication credentials and access tokens
• Business-confidential and proprietary data
• Application logs, telemetry, and metadata

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Wildwood API Platform
• Authenticate users and enforce multi-tenant data isolation
• Process transactions and manage subscriptions
• Send administrative communications (security alerts, service updates)
• Monitor and analyze usage trends to improve our services
• Detect, prevent, and address security incidents and fraud
• Conduct audit logging for security monitoring and forensic purposes
• Deliver notifications you or your application have requested
• Store, index, and retrieve documents you upload, where you use the Documents feature
• Investigate and resolve feedback and support requests
• Provision, back up, and maintain databases you host through the Platform
• Comply with legal obligations

3. Data Isolation & Multi-Tenancy

The Wildwood API Platform is built on a multi-tenant architecture where all data is strictly isolated by company and application. Your data is never accessible to other tenants. We enforce tenant boundaries at the database, API, and application layers.

You may only access data within your own company and application scope. Any attempt to access another tenant's data constitutes a material breach of our Terms and Conditions.

4. Data Sharing & Disclosure

4.1 Categories of Recipients

We do not sell your personal information. We may share data with:

• Service providers — Third-party services that help us operate the Platform (hosting, object storage, content delivery, payment processing, email delivery, push notification delivery). See Section 4.2.
• AI providers — When you use AI features, prompts are sent to configured AI providers as necessary to deliver the service. You configure which AI providers are used within your application settings.
• Third-party applications — If you configure the Platform to pass data to third-party applications, such data transmission may fall outside Wildwood Works' direct control. We are not responsible for how third-party applications collect, process, store, or transmit data received through the Platform.
• Legal compliance — When required by law, court order, or to protect our rights
• Business transfers — In connection with a merger, acquisition, or sale of assets

4.2 Subprocessors

We engage the following categories of subprocessor to operate the Platform. The specific providers in use may change; an up-to-date list is available on request, and customers under a Data Processing Agreement receive notice of material changes as that agreement requires.

• Infrastructure hosting — compute and database hosting for the Platform
• Content delivery and network protection — edge routing, TLS termination, and denial-of-service protection for our public endpoints
• Object storage — storage of uploaded documents and of database backups
• Payment processing — card processing and subscription billing (currently Stripe)
• Email delivery — transactional email, sent through the mail provider you or we configure
• Push notification delivery — Apple Push Notification service, Firebase Cloud Messaging, and Web Push services, where you enable push notifications
• AI model providers — the providers you select and configure for your application, which may include OpenAI, Anthropic, Google, Mistral, DeepSeek, xAI, and Meta. If you configure no AI provider, no prompt data is sent to any of them.

4.3 Integrations You Enable

Several Platform features send data to systems you choose and control. Where you enable them, you are directing that transfer, and the receiving system's own privacy practices govern the data once it arrives:

• Issue tracker forwarding — if you connect an issue tracker to the feedback component, submitted feedback is used to create issues in your tracker. Depending on your configuration this can include the message, the submitter's name and email address, the page address, diagnostic context, and screenshots or other attachments. Enabling backfill additionally creates issues from feedback submitted before the integration was connected.
• Imported APIs and MCP endpoints — if you import a third-party API or expose it through a Model Context Protocol endpoint, calls made through that endpoint are proxied to the upstream API you configured, using credentials you supply. The request and response content is transmitted to that upstream provider.
• Third-party scripts — scripts you enable at the company or application level run in your users' browsers and may collect data independently of us. See Section 13.
• Authentication and CAPTCHA providers — where you enable social sign-in or CAPTCHA, the relevant provider receives the data necessary to complete that verification.

5. Data Storage & Sensitive Data Handling

5.1 Where Data Is Stored

Platform data is held in the following stores:

• Primary application database — accounts, company and application configuration, subscriptions, messaging, notifications, feedback, and audit records
• Object storage — uploaded documents and files, and database backup archives, held in an S3-compatible object store operated by our storage subprocessor
• AI flow state store — run checkpoints and retrieval embeddings for AI Flows and document retrieval
• Customer-hosted databases — where you provision a managed database through the Platform, that database and its backups are operated on your behalf and hold whatever data your application writes to it

Backups are taken on a schedule and on demand, and are retained separately from the live data. Because backups are point-in-time copies, data deleted from the live system may persist in a backup until that backup expires or is overwritten.

5.2 User Obligation to Classify Data

You are solely responsible for classifying the sensitivity of data you transmit to or store within the Platform. Before storing regulated data categories (including PHI, cardholder data, or data subject to GDPR/CCPA), you must:

• Notify Wildwood Works in writing of the data categories being stored
• Ensure that your use of the Platform is compliant with all applicable laws and regulations governing that data
• Execute any required supplemental agreements, including a Business Associate Agreement ("BAA") for HIPAA-regulated data or a Data Processing Agreement ("DPA") for GDPR-regulated data

5.3 No Warranty of Suitability for Regulated Data

Wildwood Works makes no representation that the Platform is certified or approved for use with all categories of regulated data. The Platform is not certified as HIPAA-compliant, PCI DSS Level 1-compliant, or FedRAMP-authorized unless explicitly stated in a separate written certification provided by Wildwood Works. Users who require such certifications must obtain written confirmation before storing regulated data.

6. Data Security

Wildwood Works implements commercially reasonable technical and organizational security measures designed to protect Platform data, including:

• Encryption in Transit: All data transmitted between users and the Platform is encrypted using TLS 1.2 or higher
• Encryption at Rest: Sensitive fields — including two-factor authentication secrets, AI and payment provider credentials, OAuth client secrets, CAPTCHA secret keys, push notification signing keys, issue-tracker tokens, and feedback IP addresses — are encrypted using ASP.NET Core Data Protection with database-backed key storage
• Access Controls: Role-based access control (RBAC) and tenant-scoped isolation applied at the database and API layers
• API Key Management: API credentials are encrypted and never stored in plaintext
• JWT Authentication: Token-based authentication with automatic rotation and sliding expiration
• Audit Logging: Access and activity logs are maintained for security monitoring and forensic purposes
• Vulnerability Management: Regular security assessments are conducted

These measures are subject to change as technology and threats evolve. The existence of security measures does not constitute a guarantee against all possible threats or unauthorized access.

7. Data Breach & Security Incident Notification

7.1 Risk Acknowledgment

No security system is impenetrable. Despite commercially reasonable security measures, Wildwood Works cannot guarantee that unauthorized third parties will never be able to defeat our security controls or access data stored within the Platform. You acknowledge and accept this inherent risk as a condition of using the Platform.

7.2 Breach Notification

In the event Wildwood Works becomes aware of a confirmed security breach affecting user data, we will:

• Notify affected users without undue delay and, where required by applicable law, within 72 hours of discovery
• Provide a description of the nature of the breach, categories of data affected, and remediation steps being taken
• Cooperate reasonably with your breach response and regulatory notification obligations

Notification will be provided to the primary email address on file for your account. It is your responsibility to maintain accurate and current contact information.

7.3 User-Caused Incidents

Wildwood Works is not responsible for security incidents caused by or attributed to:

• Compromise of your API credentials, passwords, or access tokens
• Misconfigured permissions or access controls set by you
• Insecure third-party applications connected by you
• Phishing, social engineering, or unauthorized access via your own systems

8. Data Retention

8.1 Active Accounts

We retain your account data for as long as your account is active. Usage logs and analytics data are retained for up to 12 months.

8.2 Retention by Data Type

Beyond the general rule above, the Platform applies automated retention to specific categories. These periods reflect current practice and may be adjusted as the Platform evolves:

• Two-factor authentication data — expired verification codes and expired or deactivated trusted devices are purged automatically; used recovery codes are purged after 90 days
• API traffic and configuration snapshots — purged automatically on a rolling schedule
• Documents and uploaded files — retained until deleted by you or until the owning application or account is removed
• Backups — retained according to the backup schedule for the relevant store, then expired
• Audit and access logs — retained as long as needed for security monitoring and to meet legal obligations

8.3 Data Retention Upon Termination

When your account or subscription ends, you have 30 days to export your data, and we will help you do it. After that, Wildwood Works may delete your data at any time; residual copies persist in backups until those backups expire, as described in Section 5.1. Wildwood Works is under no obligation to retain or restore data after the export window. Section 10 of the Terms and Conditions describes the retention windows of each Platform service in detail.

8.4 Deletion Requests

You may request deletion of your account and associated data at any time by contacting us. Deletion removes data from the live system; residual copies may persist in backups until those backups expire, as described in Section 5.1.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Data portability
• Withdraw consent where processing is based on consent

To exercise these rights, contact us at [email protected].

10. GDPR Compliance

If you are located in the European Economic Area ("EEA") or the United Kingdom, or if you store or process the personal data of EEA or UK residents, the following applies:

• Wildwood Works acts as a data processor with respect to personal data you store in the Platform, and you act as the data controller
• A Data Processing Agreement ("DPA"), compliant with Article 28 of the GDPR, is available upon request and must be executed before processing personal data of EEA residents
• You are responsible for ensuring you have a lawful basis for processing personal data and for honouring data subject rights requests
• Cross-border transfers of personal data outside the EEA are governed by appropriate transfer mechanisms, including Standard Contractual Clauses ("SCCs")

11. CCPA / CPRA Compliance

If you are a business subject to the California Consumer Privacy Act ("CCPA") or California Privacy Rights Act ("CPRA"), Wildwood Works acts as a service provider as defined under the CCPA with respect to personal information you store in the Platform. Wildwood Works does not sell or share personal information received from you for cross-context behavioural advertising purposes.

12. HIPAA

If you intend to store or process Protected Health Information ("PHI") on the Platform, you must execute a Business Associate Agreement ("BAA") with Wildwood Works prior to doing so. Storing PHI without an executed BAA is a material breach of the Terms and Conditions and is strictly prohibited.

13. Cookies, Consent & Third-Party Scripts

13.1 Wildwood's Own Cookies

On the Wildwood website and administration portal we use cookies for authentication session management and platform preferences such as your selected theme. These are essential cookies and are required for the Platform to function. Wildwood Works does not use third-party advertising cookies on its own properties and does not sell or share personal information for cross-context behavioural advertising.

13.2 Consent Management

The Platform provides a consent component that customer applications can use to present a cookie banner and record each end user's choices by category (for example strictly necessary, functional, analytics, and advertising). We record the consent decision, the version of the consent configuration it was given against, and when it was given, so that consent can be demonstrated and re-requested when the configuration changes.

13.3 Third-Party Scripts in Customer Applications

Customers may configure third-party scripts — analytics, tag managers, support widgets, and similar — at the company or application level. Each script is assigned a consent category and is only served to an end user's browser when consent for that category permits it.

Scripts configured by a customer are that customer's responsibility. Once loaded, they run in the end user's browser and may set their own cookies and collect data under the script provider's privacy policy, not ours. If you enable such scripts, you are responsible for disclosing them in your own privacy notice and for having a lawful basis for them.

14. Children's Privacy

The Wildwood API Platform is not directed at children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us.

15. International Data Transfers

Wildwood Works operates the Platform on infrastructure provided by the subprocessors described in Section 4.2, and your data may be processed in countries other than your own. In particular, the AI providers, payment processor, push-notification services, and any third-party integrations you enable may process data in jurisdictions of their own choosing.

We ensure appropriate safeguards are in place for international transfers in compliance with applicable data protection laws, including Standard Contractual Clauses where required. If you need confirmation of the processing location for a specific component before storing regulated data, contact us at [email protected] and we will confirm it in writing.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the effective date. Where required by law, we will provide at least 30 days' notice before material changes take effect. Your continued use of the Platform after changes constitutes acceptance of the updated policy.

17. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at:

• Email: [email protected]
• Security Incidents: [email protected]
• Website: wildwoodworks.io