Privacy Policy

1. Introduction

Wakato Inc. ("Wakato," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the Wakato.io platform and all associated services (the "Service").

By accessing or using the Service, you consent to the collection and use of your information as described in this Privacy Policy. If you do not agree with this policy, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Name, email address, password, and profile details when you create an account.
  • Payment Information: Billing details and payment method information processed through Stripe. We do not store your full credit card number on our servers.
  • Workspace Data: Content you create, upload, or store within your Spaces, including documents, files, images, videos, and messages.
  • Communications: Messages you send through the platform's communication tools, including chat messages, emails, and voice calls.
  • AI Interactions: Prompts, inputs, and instructions you provide to AI tools and agents within the Service.
  • Business Information: Business details, strategies, and plans you create using the Business Architect and CRM tools.
  • Contact Information: Contact details you add to the CRM, including names, emails, phone numbers, and notes.
  • Support Communications: Information you provide when contacting our support team.

2.2 Information Collected Automatically

  • Usage Data: How you interact with the Service, including features used, pages visited, actions taken, and timestamps.
  • Device Information: Browser type, operating system, device type, screen resolution, and language preferences.
  • Log Data: IP address, access times, referring URLs, and error logs.
  • Analytics Data: We use PostHog for product analytics to understand usage patterns and improve the Service.
  • Error Tracking: We use Sentry to collect error reports and performance data to identify and fix issues.

2.3 Information from Third Parties

  • OAuth Providers: If you sign in using Google, GitHub, or other OAuth providers, we receive your name, email, and profile picture from those services.
  • Integrations: When you connect third-party services (social media platforms, email providers, etc.), we may receive data from those services as authorized by you.
  • Payment Provider: Stripe may provide us with transaction status, payment method type, and billing address for processing purposes.

2.4 Financial Account Information

If you choose to connect a bank account to Wakato, we collect financial account data through our provider Stripe Financial Connections. This is entirely optional and only happens when you explicitly connect an account and authorize the data being shared.

  • Account Details: The institution name, account type, and the last four digits of the account number. We never store your full account number or your bank login credentials.
  • Balances: Current and available balances on the accounts you connect.
  • Transactions: Transaction history including date, description, and amount.

We use this data solely to power Space Finance, the financial management feature of your workspace: displaying your transactions and balances, categorizing spending, generating cashflow reporting, and producing accounting exports. We do not use it for underwriting, lending, credit decisions, or advertising, and we do not sell it or share it with third parties.

To suggest spending categories, merchant names from your transactions are processed by our AI providers. Amounts, dates, account numbers, and balances are never included in that processing.

Financial account data is stored in the United States. You can disconnect a bank account at any time from Settings, which immediately stops any further data being retrieved. Disconnecting stops new data collection but does not by itself delete data already retrieved; to have that deleted as well, contact us at the address in Section 15 and we will remove it.

2.5 Health and Fitness Data (Apple Health and Android Health Connect)

The Wakato mobile app can read health and fitness data from Apple Health (iPhone) or Health Connect (Android) to show it to you on the app's Health screen (today's numbers and the last seven days), and so that your personal assistant can answer questions about your own activity and sleep — for example "how did I sleep this week?" or "how many steps did I walk today?". This is entirely optional. Nothing is read until you turn on the Health connector in the app and grant access in the system permission screen, and you choose which data types to allow.

  • What we may read: only the data types you allow. On Android (Health Connect) that is at most six types: steps, distance, active calories burned, exercise sessions, sleep and heart rate — each one is shown on the Health screen. On iPhone (Apple Health) it may also include resting heart rate, heart rate variability, VO₂ max, weight, water, food energy, flights climbed, height, blood oxygen, blood pressure, blood glucose, body temperature, respiratory rate and mindful minutes, if you allow them.
  • Why: fitness, wellness and coaching. The Health screen shows you how active you were, how you slept and your heart rate, today and over the last week. Your assistant uses the same figures to tell you how your activity and sleep are trending and how you are doing against goals you set, and to give you personal suggestions. It does not diagnose, treat or give medical advice.
  • Read only: Wakato never writes, changes or deletes data in Apple Health or Health Connect.
  • When it is read: when you open the Health screen (the figures are drawn on your phone and are not sent anywhere), and when you ask your assistant something that needs it. The data is read on your phone and summarised there (for example a daily total or an average); raw records do not leave your device.
  • Where it goes: the summarised figures are sent with your message to your own personal assistant and kept in your private conversation with it, which only you can see. To write its answer, your assistant sends them to the AI provider that powers it (see Section 5), which processes them only to respond to you.
  • What we never do: we do not sell health data, use it for advertising or marketing, share it with data brokers or other third parties, use it to make decisions about credit, insurance or employment, or use it to train AI models. It is never shared with other members of your Spaces.
  • How long we keep it: the summarised figures stay in your private conversation with your assistant until you delete that conversation or your account; deleting either removes them. Nothing is copied into any other table, profile or analytics system.
  • How it is protected: encrypted in transit (TLS) and at rest, and readable only by your own account through database access rules (Row Level Security).
  • Your control: you can switch the Health connector off in the app at any time, or withdraw access in the Health app (iPhone) or Health Connect settings (Android); reading stops immediately. You can delete the conversation with your assistant, or your whole account, to remove figures already shared; or contact us at privacy@wakato.io.

Wakato's use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements. Data from Apple HealthKit is used only to provide the features described above, in line with Apple's HealthKit guidelines.

3. How We Use Your Information

We use the information we collect for the following purposes:

  • Providing the Service: To operate, maintain, and deliver the features and functionality of the platform.
  • AI Processing: To process your inputs through AI models and return generated content. Your AI interactions may be sent to third-party AI providers (OpenAI, Anthropic, Google) for processing.
  • Billing and Payments: To process payments, manage subscriptions, track wallet balances, and handle marketplace transactions.
  • Communication: To send you service-related notifications, security alerts, and support responses.
  • Improvement: To analyze usage patterns, identify bugs, and improve the Service's features and performance.
  • Security: To detect, prevent, and respond to fraud, abuse, and security incidents.
  • Legal Compliance: To comply with applicable laws, regulations, and legal requests.
  • Customer Support: To provide technical assistance and resolve your inquiries.

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

  • With Your Workspace Members: Information within a Space is accessible to other members of that Space based on their assigned roles and permissions.
  • AI Service Providers: Your AI inputs and prompts are shared with third-party AI providers (OpenAI, Anthropic, Google Gemini, and others) to generate responses. These providers process data according to their own privacy policies and data processing agreements.
  • Payment Processors: Payment information is shared with Stripe for transaction processing.
  • Health Data: Health and fitness data from Apple Health or Health Connect is shared with no one except the AI provider powering your own assistant, only to answer you (see Section 2.5).
  • Financial Data Providers: If you connect a bank account, Stripe Financial Connections acts as our provider for retrieving that data. We do not share your financial account data with any other third party, and we do not sell it.
  • Infrastructure Providers: We use Supabase for database hosting and Hetzner for Compute (cloud Machines). Your data is stored and processed on their infrastructure.
  • Communication Providers: If you use voice or SMS features, call data is processed through Telnyx. Email delivery is handled by Resend.
  • Analytics Providers: Anonymized usage data is shared with PostHog for analytics and Sentry for error tracking.
  • Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction.
  • With Your Consent: We may share your information with third parties when you have given us explicit consent to do so.

5. AI Data Processing

Given the central role of AI in our Service, we want to be transparent about how your data is processed by AI systems:

  • Input Processing: When you use AI features, your prompts and inputs are sent to third-party AI providers for processing. We do not control how these providers may use data for model training unless covered by our data processing agreements.
  • No Training on Your Data: Wakato does not use your content to train our own AI models. Your workspace data remains your own.
  • API Gateway: All AI requests are routed through our API Gateway, which logs usage metadata (model used, token count, cost) for billing purposes. The content of your prompts and responses is not stored in usage logs.
  • Data Retention: AI conversation histories are stored within your workspace and are subject to the same data retention policies as other workspace content.

6. Data Security

We implement appropriate technical and organizational measures to protect your information:

  • Encryption: Data is encrypted in transit using TLS/SSL and at rest using industry-standard encryption.
  • Access Controls: Row Level Security (RLS) policies enforce data isolation between Spaces and users at the database level.
  • Authentication: We support secure authentication methods including email/password with hashing and OAuth integrations.
  • API Security: All API keys for third-party services are stored securely on the server side and are never exposed to the client.
  • Infrastructure: Our infrastructure is hosted on Supabase (PostgreSQL with enterprise-grade security) and Hetzner cloud servers.
  • Monitoring: We use error tracking and monitoring tools to detect and respond to security incidents promptly.

While we strive to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

7. Data Retention

We retain your information for as long as your account is active or as needed to provide the Service. Specifically:

  • Account Data: Retained for the duration of your account and for a reasonable period after deletion to allow for account recovery and comply with legal obligations.
  • Workspace Content: Retained as long as the Space exists. When a Space is deleted, its content is removed after a 30-day grace period.
  • Billing Records: Retained for at least 7 years to comply with financial and tax regulations.
  • Usage Logs: Aggregated analytics data is retained indefinitely. Detailed usage logs are retained for 90 days.
  • Compute Data: Data on Machines is retained only while the Machine is active. When a Machine is terminated, data is not preserved unless you have exported it.

8. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

  • Access: You can request a copy of the personal information we hold about you.
  • Correction: You can update or correct inaccurate personal information through your account settings or by contacting us.
  • Deletion: You can request deletion of your personal information. We will comply unless we have a legal obligation to retain it.
  • Data Portability: You can request an export of your data in a machine-readable format.
  • Opt-Out: You can opt out of non-essential communications and marketing emails.
  • Restrict Processing: You can request that we limit how we process your personal information in certain circumstances.
  • Withdraw Consent: Where processing is based on consent, you can withdraw your consent at any time.
  • Disconnect a Bank Account: You can disconnect any connected bank account at any time from Settings, which immediately stops further data being retrieved. To also delete financial data already retrieved, contact us and we will remove it.

To exercise any of these rights, please contact us at privacy@wakato.io. We will respond to your request within 30 days.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve the Service:

  • Essential Cookies: Required for authentication, security, and core functionality. These cannot be disabled.
  • Analytics Cookies: Used by PostHog to collect anonymized usage data to help us understand how the Service is used.
  • Preference Cookies: Store your settings and preferences (theme, language, layout).

You can control cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service.

10. Children's Privacy

The Service is not intended for users under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a minor, please contact us at privacy@wakato.io.

11. International Data Transfers

Your information may be transferred to and processed in countries other than your own, including the United States, Germany (Hetzner infrastructure), and other countries where our service providers operate. We ensure that appropriate safeguards are in place for international data transfers, including Standard Contractual Clauses where applicable.

12. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

  • The right to know what personal information is collected, used, shared, or sold.
  • The right to delete personal information held by us and our service providers.
  • The right to opt-out of the sale of personal information. We do not sell personal information.
  • The right to non-discrimination for exercising your CCPA rights.

13. European Privacy Rights (GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have additional rights under the General Data Protection Regulation (GDPR):

  • Legal Basis: We process your personal data based on: (a) your consent, (b) performance of a contract, (c) compliance with legal obligations, or (d) our legitimate interests.
  • Data Protection Officer: You may contact our data protection team at privacy@wakato.io.
  • Supervisory Authority: You have the right to lodge a complaint with your local data protection authority.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service at least 30 days before the changes take effect. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us: