Privacy Policy

wurkkin ("wurkkin", "we", "us") is responsible for the personal information described here.

This policy covers the wurkkin website, the wurkkin app (including the sign-in, the agents you hire, and pages we host for your suppliers), and any time you contact us.

Two roles. For your account and billing details, and for visitors to our website, we decide how information is used. For the business data you connect (your store, your suppliers, your invoices), we act for you: we process it to do the work you hired the agents for, on your instructions, and you stay in control of it.

Information you give us:

• Account details: your name, email address, a password (stored only as a one-way hash, never readable by anyone), your business name, your time zone and working hours.
• Waitlist and partner forms on this website: the email address and business name you enter, plus the website and note on a partner application.
• What you tell the agents: messages in chats, plans (promotions, offers, launches), notes, rules and guardrails, supplier terms and documents you upload.
• Billing: the plan and duties you choose. Card details are entered on Stripe's own pages and go to Stripe, never to us.
• Messages you send us for support.

Information from the tools you connect (only once you connect them):

• Shopify: your shop's name, currency, time zone and country; products, variants, SKUs and costs; stock levels by location; orders and order lines (what sold, when, for how much, discounts and refunds); and discounts. We do not request your customers' names, email addresses, phone numbers or addresses.
• Chat apps (Slack, Microsoft Teams, Discord), when available and connected: the workspace, the people who link their account, and the messages sent to the agent.

Information collected automatically:

• Security and service logs: IP address, browser type, the pages and actions requested, and errors, used to keep the service running and to stop abuse (for example, rate limits on sign-in).
• Cookies that keep you signed in, remember your theme and layout choices, and protect forms. We use no advertising cookies and do not sell or share data for advertising.
• An audit record of important actions in your account (for example, a decision approved or a rule changed). It records who did what and when, not the text of your chats.

• To run the agents you hire: forecasts, reorder advice, order sheets, reminders, briefings and answers to your questions.
• To run your account: sign-in, security, billing, support and service messages.
• To keep wurkkin safe: preventing fraud and abuse, enforcing our Terms, and investigating problems.
• To improve wurkkin: understanding which features are used and fixing what breaks. We use your business data to train or improve models for other companies only with your explicit permission.
• To tell you about the agents you asked to hear about (waitlists). You can unsubscribe at any time.
• To meet legal obligations, such as tax and accounting records.

If data protection law in the European Economic Area or the United Kingdom applies, we rely on:

• Contract: to provide the service you signed up for.
• Legitimate interests: to keep the service secure, prevent abuse, and improve it, balanced against your rights.
• Consent: for optional things such as waitlist emails. You can withdraw consent at any time.
• Legal obligation: where the law requires us to keep or share information.

Agents use language models to understand questions, choose which tool to use and word their answers. The figures they show come from your data and are checked by our own code before you see them; a model is never the source of a number.

When a language model is switched on, we send it only what it needs for the task in hand: the question asked (up to a set length), the short summary of the answer being worded, column headers and sample rows of a file you import, document text when you ask an agent to learn from a document, and item names and document passages for search. Our current model provider is OpenAI. Under our agreement with them, data sent through their API is not used to train their models.

Cathy's specialist training uses sales data purchased from Shopify stores that are not wurkkin customers. No customer's data is part of it, and your data is not used to train models for other companies without your explicit permission.

Agents never place orders, make payments or change your records on their own. Anything involving money, and anything your guardrails cover, waits for a person to approve it.

We do not sell personal information. We share it only with:

• Service providers who process it for us under contract: cloud hosting and storage, Stripe (payments), OpenAI (language models and search), and the form or customer tools that receive waitlist sign-ups.
• The tools you connect, when an agent acts in them at your request (for example, updating an item's cost in Shopify after you press the button).
• People you choose to share with: teammates in your account, and suppliers you send an order sheet to by link or invite. Anyone holding a share link can open that order, so share links carefully; you can revoke a link at any time.
• Authorities, when the law requires it, or to protect the rights, safety and property of our customers, our users or wurkkin.
• A buyer or successor, if wurkkin is involved in a merger or sale. This policy will continue to protect your information.

Our providers may process information outside your country, including in the United States. Where the law requires it, we use recognised safeguards such as the European Commission's Standard Contractual Clauses and the UK addendum.

• Account and business data: for as long as your account is open. When you close it, we delete or anonymise it within 90 days, except where we must keep records by law.
• Backups: removed on their normal cycle, within a further 35 days.
• Billing records: as long as tax and accounting law requires.
• Security logs: up to 12 months.
• Waitlist details: until the agent starts and you have been told, or until you ask us to remove them.

• Each company's data is kept separate in the database, enforced by the database itself as well as by our code, so one company can never read another's.
• Connection tokens and other secrets are encrypted (AES-256-GCM). Passwords are stored only as one-way hashes.
• Traffic is encrypted in transit. Sign-in, sign-up and uploads are rate limited.
• Access by our staff is limited to what is needed to run and support the service.

No system is perfectly secure. If a breach affects your personal information, we will tell you and the relevant authorities as the law requires.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict some uses, and to withdraw consent. California residents may also ask what we collect and how it is used; we do not sell or share personal information for cross-context advertising.

To use any of these rights, email info@wurkkin.com. We will answer within one month, or sooner if the law requires. We will not treat you differently for using your rights.

Inside the app you can download your forecasts and order sheets, disconnect a store or chat app (which removes its stored connection details), revoke supplier links, and ask an agent to forget anything you did not tell it directly.

If you are not happy with our answer, you can complain to your local data protection authority.

If your business uses wurkkin and you are one of its staff or suppliers, please contact that business first; we will help them with your request.

wurkkin is a service for businesses and is not meant for anyone under 18. We do not knowingly collect information from children.

We will update this policy as wurkkin grows. If a change is significant, we will tell account owners by email or in the app before it applies. The date at the top shows the latest version.

Questions about privacy: info@wurkkin.com.