WrkOS — a product of Deliverables Agency FZCO Effective Date: [Date] · Last Updated: [Date]
1. Who We Are
WrkOS ("WrkOS," "we," "us," "our") is a content management platform for blogs, API documentation, and product guides, operated by Deliverables Agency FZCO, a free zone company licensed by IFZA with registered office at Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates.
This Privacy Policy describes how we collect, use, share, and protect personal information in connection with the WrkOS web application, APIs, and related services (the "Service"), available at wrkos.com.
For any privacy matter, contact: team@wrkos.com.
2. Scope and Our Role
WrkOS is a business-to-business (B2B) service. When organizations and teams (each a "Customer") subscribe to WrkOS:
WrkOS acts as a data controller for personal information relating to the account itself — registration data, billing data, usage logs, security records, and direct communications with us.
WrkOS acts as a data processor for personal information contained within Customer content created or uploaded into a workspace (drafts, posts, documentation pages, comments, collaborator details). The Customer is the data controller of that content and is responsible for the lawful basis on which it is collected and processed. A Data Processing Addendum is available on request at team@wrkos.com.
3. Information We Collect
3.1 Information You Provide
Account data: workspace name, member name, work email, password (hashed and salted, never stored in plain text), role, and team-collaboration metadata.
Billing data: billing contact, business address, VAT/tax identifiers, plan selection, and invoice history. Card details are entered directly with Stripe and are not stored on WrkOS servers.
Customer content: anything you write, upload, sync, or publish through WrkOS — posts, documentation, drafts, attachments, images, comments, and inline collaboration data.
Support communications: messages, screenshots, and attachments you send to team@wrkos.com.
3.2 Information Collected Automatically
Technical data: IP address, browser type and version, operating system, device type, time zone, referring URL, and language preference.
Usage data: pages viewed in the app, actions taken (e.g., publish, save, sync), session duration, feature usage, and timestamps.
Cookies and similar technologies: see our separate Cookie Policy below.
3.3 Information from Integrations
When you connect GitHub for content synchronization, we receive your GitHub username, the repositories you authorize, commit metadata, and the content of synced files — strictly limited to the scope you grant during OAuth authorization. We do not request access beyond what the sync feature requires.
3.4 What We Do NOT Collect
WrkOS does not place analytics, advertising, or tracking cookies on the end-readers of sites published through WrkOS (custom domains or sub-paths). Visitor sites served by WrkOS remain tracker-clean unless the Customer adds their own analytics.
4. How We Use Information
We process personal information to: (a) provide and operate the Service, (b) authenticate users and secure the platform, (c) store, render, and publish Customer content, (d) sync content with GitHub when enabled, (e) deliver AI-powered editing and content assistance via OpenAI when invoked, (f) process subscriptions, trials, renewals, and refunds via Stripe, (g) provide customer support, (h) send service-critical notifications (security alerts, billing, policy changes), (i) detect and prevent fraud, abuse, and security incidents, (j) measure and improve product performance, and (k) comply with legal and regulatory obligations.
5. Legal Bases (GDPR / UK GDPR)
Where the GDPR applies, we rely on: performance of a contract (delivering the Service to the Customer); legitimate interests (security, fraud prevention, product analytics, direct B2B communication with administrators — balanced against your rights); consent (optional cookies and any opt-in marketing); and legal obligation (tax, accounting, and lawful requests).
For data subjects in the UAE, we comply with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data. For data subjects in India, we operate consistently with the Digital Personal Data Protection Act, 2023.
6. AI Features and OpenAI
When you use AI-assisted features inside the WrkOS editor, the minimum content necessary to fulfill the request (for example, the text being edited or the prompt you supply) is transmitted to OpenAI via the OpenAI API for processing. Under our OpenAI API terms, content submitted via the API is not used to train OpenAI's models. AI outputs may be inaccurate or incomplete and should be reviewed before publication.
If you do not wish to use AI features, do not invoke them; the rest of WrkOS functions normally without them.
7. Subprocessors
We engage the following subprocessors to deliver the Service:
| Subprocessor | Purpose | Region |
|---|---|---|
| DigitalOcean | Application hosting, databases, object storage | Bangalore, India (BLR) |
| Stripe | Subscription billing and payment processing | United States / Global |
| OpenAI | AI-assisted content generation, on user request | United States |
| GitHub | Optional content synchronization, on user authorization | United States |
We maintain written contracts with each subprocessor requiring appropriate security and confidentiality. An updated list is available on request.
8. Data Hosting and International Transfers
Customer content and account data are primarily hosted on DigitalOcean's Bangalore (India) infrastructure. When data is transferred to Stripe, OpenAI, GitHub, or to our personnel located outside India or the UAE, we rely on lawful transfer mechanisms — including Standard Contractual Clauses (for EU/UK transfers) and the subprocessor's own approved transfer safeguards. By using WrkOS, you understand that your data may be processed in jurisdictions other than the one in which you reside.
9. Data Retention
We retain account and Customer content for as long as the workspace is active. After workspace closure or account deletion:
Customer content is deleted from production systems within 30 days.
Encrypted backups are purged on a rolling cycle of up to 90 days.
Billing records, invoices, and tax-related documents are retained for the period required by UAE and applicable tax law (typically 5 years).
Anonymized, aggregated usage statistics may be retained indefinitely.
Customers may request earlier deletion in writing at team@wrkos.com.
10. Your Rights
Subject to applicable law, you may have rights to access, correct, delete, port, restrict, or object to processing of your personal data, to withdraw consent, and to lodge a complaint with a supervisory authority (e.g., the UAE Data Office, an EEA Data Protection Authority, or the relevant authority under India's DPDP Act).
To exercise rights, write to team@wrkos.com from the email associated with your account. We verify identity before fulfilling requests and respond within statutory timelines (typically 30 days). Where you are a member of a Customer's workspace, requests concerning Customer content should be directed to that Customer; we will assist as a processor.
11. Security
To exercise rights, write to team@wrkos.com from the email associated with your account. We verify identity before fulfilling requests and respond within statutory timelines (typically 30 days). Where you are a member of a Customer's workspace, requests concerning Customer content should be directed to that Customer; we will assist as a processor.
12. Children
WrkOS is a B2B service and is not directed to individuals under 18. We do not knowingly collect personal data from minors.
13. Marketing Communications
We may send service-related communications (security, billing, terms, downtime, feature releases tied to your plan) without separate consent, as they are necessary to operate the Service. Optional marketing communications, where offered, will be sent only with your consent and may be withdrawn at any time via the unsubscribe link.
14. Changes to This Policy
We may update this Policy from time to time. Material changes will be notified by in-app banner or email to your workspace administrators at least 14 days before they take effect.
15. Contact
Deliverables Agency FZCO Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates Email: team@wrkos.com
