Privacy Policy
1. Who We Are
W(AI)kforce, Inc. (“W(AI)kforce,” “we,” “us,” or “our”) operates the W(AI)kforce workforce automation platform, which deploys AI agents to assist enterprise customers with business workflows. We act as data controller for personal data we collect directly from platform users and data processor for personal data our customers instruct us to process on their behalf.
Privacy Contact:
Email: privacy@waikforce.com
Subject line: “Privacy Request — [Your Name]”
2. Scope
This policy applies to:
- Visitors to the W(AI)kforce website and marketing pages
- Users of the W(AI)kforce platform (tenant administrators, end users, and API consumers)
- Prospective customers and partners who interact with W(AI)kforce sales or support
It does not apply to data processed by W(AI)kforce on behalf of customers acting as data controllers — that processing is governed by the applicable Data Processing Agreement (DPA).
3. Personal Data We Collect
| Category | Examples | Source |
|---|---|---|
| Account & Identity Data | Name, work email address, job title, organization | You, at registration or SSO login |
| Authentication Data | Hashed credentials, OAuth tokens (never stored in plaintext; held in Secret Manager) | You, at login |
| Usage & Activity Data | Pages visited, features used, agent task submissions, timestamps | Automatically, via platform instrumentation |
| Agent Interaction Data | Inputs submitted to AI agents, agent responses, workflow execution logs | You, during platform use |
| Technical Data | IP address, browser type, device identifiers, session identifiers | Automatically, via server logs and analytics (GA4 — see Section 8) |
| Communications Data | Support tickets, email correspondence, in-product feedback | You, when contacting us |
4. Legal Basis for Processing (GDPR)
| Processing Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Providing the platform and fulfilling your subscription | Art. 6(1)(b) — Performance of a contract |
| Account management, authentication, billing | Art. 6(1)(b) — Performance of a contract |
| Security monitoring, fraud prevention, audit logging | Art. 6(1)(f) — Legitimate interests (securing the platform and its users) |
| Compliance with legal obligations (e.g., audit log retention) | Art. 6(1)(c) — Legal obligation |
| Product analytics and platform improvement (anonymized/aggregated) | Art. 6(1)(f) — Legitimate interests |
| Marketing communications to existing customers | Art. 6(1)(f) — Legitimate interests (with opt-out) |
| Marketing communications to prospects | Art. 6(1)(a) — Consent (opt-in at form submission) |
| Website analytics cookies (GA4) | Art. 6(1)(a) — Consent (via cookie consent banner) |
5. How We Use Personal Data
- Service delivery: Provisioning your tenant environment, routing agent tasks, processing workflow automations
- Security & integrity: Detecting unauthorized access, maintaining audit logs, incident response
- Support: Diagnosing issues, responding to support requests
- Product improvement: Analyzing aggregated usage patterns to improve features (data is anonymized before analysis)
- Communications: Sending product updates, security notices, and (where consented) marketing materials
- Legal compliance: Retaining records as required by applicable law and fulfilling regulatory requests
6. Data Sharing and Sub-Processors
We do not sell personal data. We share personal data only with:
| Recipient Category | Purpose | Safeguards |
|---|---|---|
| Google Cloud Platform (GCP) | Cloud infrastructure, audit log storage, Secret Manager | Data Processing Agreement; Standard Contractual Clauses (SCCs) for EU transfers |
| Atlassian (Jira/Confluence) | Security ticket tracking, internal documentation | DPA; SCCs |
| Payment processor | Billing and subscription management | PCI-DSS compliant processor; DPA |
| Email/communication provider | Transactional and marketing email | DPA |
| MCP-connected external services (tenant-configured) | Workflow automations as directed by the tenant | See Section 7 — MCP Sub-Processors |
| Legal, regulatory, or law enforcement | Legal obligation or valid court order | Disclosed to you where permitted by law |
7. MCP Sub-Processors and Tenant-Controlled Data Flows
Important disclosure: W(AI)kforce supports the Model Context Protocol (MCP), which allows tenant administrators to connect AI agents to external third-party services (e.g., file systems, CRMs, APIs). When a tenant configures an MCP connection, data submitted by the tenant’s users may flow to that external service.
W(AI)kforce does not control the privacy practices of MCP-connected services. Tenants are responsible for:
- Ensuring any MCP connection complies with applicable privacy law
- Notifying their own end users of third-party data flows
- Executing any required DPA with the connected service
This disclosure model is documented in ADR-021 — MCP Privacy Accountability Model. At MCP connector registration, tenants must acknowledge this disclosure. W(AI)kforce maintains an audit log of all MCP task executions (service name, timestamp, tenant ID) for security and compliance review purposes.
8. Cookies and Analytics
We use Google Analytics 4 (GA4) on our website with Consent Mode v2 implemented. This means:
- Analytics cookies are set only after you grant consent via our cookie consent banner
- If you decline, GA4 operates in cookieless/modeled mode — no identifiable data is sent
- You can change your cookie preferences at any time via the cookie settings link in the site footer
We do not use third-party advertising cookies. We do not sell or share data with ad networks.
9. Data Retention
| Data Type | Retention Period | Basis |
|---|---|---|
| Operational / application logs | 90 days | ADR-011; security monitoring |
| Security audit logs | 1 year | SOC 2 CC7.2; ISO A.12.4 |
| EU AI Act compliance / agent decision logs | 3 years | EU AI Act Art. 12 obligation |
| Account data (active) | Duration of subscription + 30 days post-termination | Contract; data minimization |
| Account data (deleted) | 30 days (then purged from backups within 90 days) | GDPR Art. 17; erasure right |
| Financial / billing records | 7 years | Legal / tax obligation |
| Support correspondence | 3 years from ticket close | Legitimate interest; dispute resolution |
10. International Data Transfers
W(AI)kforce is incorporated in the United States. If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, your personal data is transferred to and processed in the U.S. We rely on the following transfer mechanisms:
- Standard Contractual Clauses (SCCs) — incorporated into our DPAs with sub-processors
- UK International Data Transfer Addendum (IDTA) — for transfers from the United Kingdom to the United States
A copy of the applicable SCCs is available on request at privacy@waikforce.com.
11. Your Rights
GDPR Rights (EEA, UK, Switzerland)
You have the right to:
- Access — request a copy of personal data we hold about you (Art. 15)
- Rectification — correct inaccurate data (Art. 16)
- Erasure — request deletion (“right to be forgotten”) (Art. 17)
- Restriction — limit how we process your data in certain circumstances (Art. 18)
- Portability — receive your data in a machine-readable format (Art. 20)
- Objection — object to processing based on legitimate interests (Art. 21)
- Withdraw consent — at any time where processing is consent-based (Art. 7(3))
- Lodge a complaint — with your local Data Protection Authority
CCPA/CPRA Rights (California Residents)
California residents have the right to:
- Know what personal information is collected about them
- Know whether their personal information is sold or disclosed, and to whom
- Opt out of the sale of their personal information (we do not sell personal information)
- Request deletion of their personal information
- Correct inaccurate personal information (CPRA)
- Limit use and disclosure of sensitive personal information (CPRA)
- Non-discrimination for exercising CCPA/CPRA rights
To exercise any of the above rights, contact privacy@waikforce.com. We will respond within 30 days (GDPR) or 45 days (CCPA). Identity verification may be required before we can action your request.
12. Security
W(AI)kforce maintains a security program aligned with SOC 2 Type II and ISO 27001 standards, including:
- Encryption in transit (TLS 1.2+) and at rest (AES-256 via GCP)
- Secrets stored exclusively in GCP Secret Manager — never in environment variables or code
- Role-based access controls with least-privilege IAM bindings
- Tamper-evident audit logs with WORM retention (GCS Bucket Lock)
- Regular penetration testing and vulnerability scanning
In the event of a data breach affecting your personal data, we will notify affected individuals and relevant supervisory authorities within 72 hours of discovery (GDPR Art. 33/34) or as “expeditiously as possible” (CCPA).
13. Children’s Privacy
The W(AI)kforce platform is intended for enterprise business use only. We do not knowingly collect personal data from individuals under 16 years of age. If you believe we have inadvertently collected such data, contact privacy@waikforce.com immediately.
14. Changes to This Policy
We will post any material changes to this policy on this page with an updated effective date and notify active users via email at least 14 days before the change takes effect. Your continued use of the platform after the effective date constitutes acceptance of the revised policy. For material changes that affect how we process personal data under consent-based legal bases, we will seek fresh consent or provide an opportunity to object before those changes take effect.
15. Contact Us
For any privacy-related questions, data subject rights requests, or concerns:
Privacy / Data Protection Officer Contact
Email: privacy@waikforce.com
Response SLA: 5 business days for acknowledgment; 30 days for resolution
Attn: Privacy & Legal
Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713 (Registered Agent)