WIRK Privacy Policy
Effective date: 2 October 2026
Last updated: 2 October 2026
WIRK is a product of Pebble Inc, a Delaware corporation. This policy explains how Pebble Inc ("WIRK", "we", "us"), 1320 Green Street, San Francisco, CA 94109, handles personal data when you visit the website where this policy is published (the "WIRK website"), sign up, sign in, use the WIRK service (the "Service"), pay for it or contact us. Questions and requests go to support@wirk.life.
Our two roles
- Controller. We decide how account, sign-in, billing, support and security data is used. This policy covers that data. We are also a controller when we use Customer Content and usage data to improve the Service, including to train models for WIRK's own features (section 2).
- Processor. Our customers' people and agents write work items, notes, links, proposals and files into the Service ("Customer Content"), and these can contain personal data. We process Customer Content for the customer under our Data Processing Addendum, published on the WIRK website. The customer's own privacy notice governs that data. If you ask us about personal data in a customer's Customer Content, we will pass your request to that customer and help them answer it.
1. What we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account and identity | Your email address and, if you give it, your name; the accounts and wirkspaces you belong to and your role in them. | You, the administrator who invites you, and WorkOS when you sign in. |
| Sign-in and tokens | Sign-in events through WorkOS, including multi-factor authentication, or your organization's single sign-on on Enterprise plans. Records of the access tokens issued to people and agents. | WorkOS and the Service. |
| Billing | Your plan, billing contact, and the customer and subscription records our payment processor, Stripe, returns. Stripe collects payment card details. We do not receive or store full card numbers. | You and Stripe. |
| Customer Content | Work items, notes, links, proposals and files, and a record of which person or agent wrote each one. | Customers' people and agents. |
| Security and technical logs | AWS CloudTrail records of operations on our AWS infrastructure. Records of requests to the Service, which may include IP addresses, times, client details and the person or agent making each request. | Our infrastructure providers and the Service. |
| Usage data | How people and agents use the Service, such as requests made, features used, errors and performance. It does not include the contents of Customer Content. | The Service. |
| Communications | Messages you send us, such as support requests and feedback. | You. |
| Website and cookies | The WIRK website sets no cookies and runs no analytics or third-party scripts. Signing in to the Service uses only cookies that are strictly necessary to sign you in and keep you signed in. | Your browser. |
2. Why we use it
| Purpose | Data used | Legal basis under GDPR |
|---|---|---|
| Create and run your account, sign you in and provide the Service | Account and identity, sign-in and tokens, Customer Content | Performance of our contract with the customer and with you |
| Provide the Pro plan's intelligent features, such as ranking by meaning | The text of items in Pro accounts, sent to TypeSafe's Jev classifier | Performance of the contract; processing on the customer's instructions |
| Bill for paid plans | Billing, account and identity | Performance of the contract; legal obligations such as tax records |
| Keep the Service secure, prevent abuse and investigate incidents | Security and technical logs, sign-in and tokens | Our legitimate interest in protecting the Service and its users |
| Support you and send service messages | Account and identity, communications | Performance of the contract; our legitimate interest in supporting customers |
| Improve the Service, including training and evaluating models that power WIRK's own features | Customer Content and usage data | Our legitimate interest in improving the Service. Team and Pro customers can opt out of model training. |
| Comply with the law | As required | Legal obligation |
How we use Customer Content to improve WIRK. We may use Customer Content and usage data to provide, maintain and improve the Service, including to train and evaluate models that power WIRK's own features. We never sell Customer Content, never disclose it to other customers, and never release a model or dataset that reproduces identifiable Customer Content. We may use usage data, and data that is aggregated and de-identified so that it does not identify a customer or any person or reveal any Customer Content, for any lawful purpose. Customers on the Team or Pro plan can opt out of model training by writing to support@wirk.life; the opt-out applies to training that starts after we confirm it. Enterprise contracts may exclude model training.
We do not make decisions about people with legal or similarly significant effects solely by automated means.
We do not use third-party analytics or advertising tools, and we do not send marketing email. We will update this policy before starting either.
We do not sell personal information, and we do not share it for cross-context behavioural advertising.
3. Who we share it with
We share personal data only with the service providers (subprocessors) below, and only for the purposes listed.
| Subprocessor | What it does for WIRK | Personal data involved |
|---|---|---|
| Amazon Web Services (AWS) | Hosts the Service on EC2 and stores files in S3 in the United States, with encryption keys in AWS KMS and audit logging in CloudTrail. | All data held in the Service. |
| Cloudflare | Edge network and DNS for the WIRK website and the Service. | Data in transit, including IP addresses. |
| WorkOS | Sign-in (AuthKit), multi-factor authentication and enterprise single sign-on. | Email addresses and sign-in data. |
| Stripe | Billing and payments. | Billing contacts and payment data. |
| TypeSafe AI, Inc. | Provides the Jev classifier behind the Pro plan's intelligent features, such as ranking by meaning. We send it the text of items only for Pro accounts, and it processes them in the United States. | The text of items in Pro accounts, which can contain personal data. |
We may also disclose personal data to our professional advisers under confidentiality, to authorities when the law requires it, and to an affiliate or a successor if WIRK, or the business or assets that provide it, is transferred through a merger, reorganization or sale. In that case personal data may transfer to the new entity, which will handle it under the commitments in this policy, and we will tell account owners by email. Within a customer's account, the people and agents the customer admits can see its data according to the access the customer gives them.
4. International transfers
We store Service data with AWS in the United States. If you are in the European Economic Area, the United Kingdom or Switzerland, your personal data is transferred to the United States. Where the law requires a transfer mechanism, we rely on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum and the Swiss amendments.
5. How long we keep it
| Data | How long |
|---|---|
| Account and identity | While your account is active, then deleted with the account's Customer Content, as in the next row. |
| Customer Content | While the customer's account is active. After termination, we delete it within 30 days after the export window in our Terms of Service ends. After a deletion request, we delete it as described in section 6. Earlier versions of files kept by our file storage are deleted at the same time. |
| Billing records | 7 years, as tax and accounting law requires. |
| Security and technical logs | Up to 1 year. |
| Communications | Up to 2 years after the conversation ends. |
Deleted data can remain in our backups until they expire on their regular schedule, and is not used for any other purpose in the meantime. Deleting Customer Content does not remove what models trained earlier learned from it.
6. Deletion on request
You can ask us to delete your personal data by writing to support@wirk.life. Account owners can ask us the same way to delete a wirkspace or their whole account. We will confirm your identity, then delete the data within 30 days of the request, including earlier file versions in storage. We may keep data that the law requires us to keep, such as billing records, and security logs until their retention period ends. If the data is part of a customer's Customer Content, we will pass the request to that customer and act on its instructions.
7. Your rights
Everyone. You can contact us at support@wirk.life about any of the rights below. We will not treat you differently for using them.
EEA, UK and Switzerland (GDPR and equivalents). You have the right to access your personal data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent where we rely on consent. You may complain to your data protection authority. We respond within one month, extendable where the law allows.
California (CCPA as amended by the CPRA). In the past 12 months we have collected the following categories of personal information, from the sources and for the purposes described in sections 1 and 2:
- identifiers, such as email address and account identifiers;
- commercial information, such as plan and billing records;
- internet or other electronic network activity, such as security and technical logs;
- professional or employment-related information that appears in Customer Content.
We disclose these categories for business purposes to the service providers listed in section 3. You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of its sale or sharing; and to limit the use of sensitive personal information. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. You may use an authorized agent. We verify requests before acting on them and respond within 45 days, extendable where the law allows.
8. Security
We protect personal data with the measures described on the security page of the WIRK website, including TLS for data in transit and a separate encryption key for each account's files.
9. Children
The Service is for businesses and is not directed to children. We do not knowingly collect personal data from anyone under 18.
10. Changes to this policy
We will post updates here and change the "Last updated" date. For material changes, we will notify account owners by email 30 days before they take effect.
11. Contact
Pebble Inc, 1320 Green Street, San Francisco, CA 94109. Privacy questions and requests: support@wirk.life.