Privacy notice

Who we are

This notice covers the Wardyn service at app.getwardyn.com and mcp.getwardyn.com, provided by [to be supplied: Wardyn legal entity name and address]. Effective [to be supplied: publication date].

Companies add their own skills and invite their own people. Your company decides what content to add and whom to invite, and controls that information; Wardyn processes it on your company’s behalf to provide the service. Wardyn is responsible for the account, sign-in and security records it needs to run and protect the service.

What we collect

• Account data: your work email address, display name, the workspaces you belong to and your role.
• Content your company adds: skills, their instructions and supporting files, and the settings of the managed connections it issues.
• Activity records: which skills were requested through a managed connection, when, by which account and with what result. We do not collect your conversations.
• Skill reports people choose to send: the note they write, the skill and version it concerns, and when.
• Security data: sign-in events; keyed, one-way codes derived from email and network addresses for rate limiting; and email delivery events such as bounces.
• Security check: the sign-in and sign-up pages use Cloudflare Turnstile to tell people from automated abuse. Cloudflare processes information about your browser and connection to do this.

How we use it

To provide the service, keep it secure, prevent abuse, send sign-in links and invitations, and answer support requests. We do not sell personal data or use it for advertising.

AI providers

Wardyn sends content to an AI model provider only when someone in your company who may review a skill’s reports asks for a correction to be drafted. The skill’s text files and the report notes they selected then go to OpenAI to propose a change, with OpenAI’s request-storage option turned off. Wardyn adds no names or email addresses, but a note goes as its author wrote it. A person reviews every proposal, and nothing changes until an administrator publishes it.

Your company’s own AI assistant receives a skill only when one of your people asks for it through a managed connection. That assistant is your company’s own service, under your company’s arrangement with its provider.

Where it is stored and for how long

Wardyn stores data in the United States (Supabase, us-east-1; Railway, United States).

• Company content and workspace data, including the history of administrative actions and managed connections: while the workspace exists.
• Your sign-in account: while it belongs to a workspace. An account that never joined a workspace, or no longer belongs to one, is kept until you ask us to delete it.
• Skill activity records: Wardyn's operator clears records older than 30 days once a week, so they are kept for up to 37 days.
• Skill reports: the operator clears reports older than 90 days once a week, so they are kept for up to 97 days.
• Correction proposals drafted from reports: while the workspace exists, so the history of reviewed changes stays available. They are deleted with the workspace.
• On request, we delete a company’s workspace data, including uploaded files, within 30 days. Copies in our backups are gone within a further 14 days.
• Some records are not tied to one company and are not yet cleared on a fixed schedule: email delivery events (which can include an invited person’s address), records of addresses we must not email again, sign-in safety counters and records of support requests. You can ask us to delete those that relate to you, unless we need one to avoid emailing you again.

If we learn of a security incident affecting your data, we email your workspace’s administrators without undue delay and tell them what we know.

Subprocessors

• Supabase, Inc.: Database, sign-in and file storage. Data: All account data and company content. Location: United States (us-east-1).
• Railway Corporation: Runs the web app, managed-connection gateway, background worker and virus scanner, and stores nightly backups of uploaded files. Data: Data passing through for processing. Location: United States.
• Resend (Plus Five Five, Inc.): Sends sign-in and invitation emails. Data: Recipient address, email content, delivery events. Location: United States.
• OpenAI, L.L.C.: Proposes a skill correction when an authorized reviewer asks for one. Data: The skill’s text files and the selected report notes. Location: United States.
• Cloudflare, Inc. (Turnstile): Security check on the sign-in and sign-up pages. Data: Browser and connection signals from the visitor. Location: Global network.

Before a new subprocessor starts receiving personal data, we update this list and email each workspace’s administrators at least 30 days in advance. If we must replace a provider urgently for security or availability, we tell you as soon as we can instead.

Your rights and contact

Ask your company’s Wardyn administrator, or write to privacy@getwardyn.com. Wherever you are, you can ask us to access, correct or delete your personal data, to give you a copy of it, or to restrict or object to how we use it. We reply within 30 days and say what we did, or why we could not. If your company added the information, we may first ask its administrator to act, because your company controls that content. You can also complain to your local data-protection authority.

[to be supplied: review of this notice by counsel]