wrenshipPrivacy policy
What personal data Wrenship collects about its customers, why, where it's stored and the choices you have.
This is a working draft that hasn't been reviewed by counsel yet. It is not in force. Names in [brackets] are placeholders.
Last updated: [date]
This policy covers personal data about Wrenship's customers and website visitors. When your apps on Wrenship process personal data of your users, you decide how, and we process it for you under the Data processing addendum.
Who is responsible
[Wrenship legal entity], [registered address], is the controller of the data described here. Contact: [privacy@wrenship.com].
What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Name, email, profile picture | You, or GitHub / Google when you sign in with them | To run your account and contact you about it |
| Passkey public keys | Your device | To sign you in. We never receive the private key |
| Workspaces, roles, projects, settings | You | To provide the Service |
| Billing details: name, country, tax ID, payment status | You, Paddle and Midtrans | To charge you and meet tax rules. Card numbers are handled by the payment provider, not us |
| Activity log: who did what, when, from which AI app | Your use of the Service | Security, troubleshooting and your team's audit trail |
| IP address, country, network (ASN), browser | Your requests | Security, fraud and abuse prevention, rate limits |
| Connected Git accounts and repositories | GitHub or GitLab, when you connect them | To build and deploy your code |
| Support and abuse reports | You | To answer you and act on reports. A reporter's IP is stored only as a hash |
We don't sell personal data, and we don't use it for advertising.
Legal bases
We process this data to perform our contract with you, to meet legal obligations (such as tax records), and for our legitimate interests in keeping the Service secure and preventing abuse. Where we ask for consent, for example for optional emails, you can withdraw it at any time.
Who we share it with
Service providers that help run Wrenship, under contracts that protect the data:
| Provider | Purpose |
|---|---|
| Cloudflare | Edge network, hosting of the control plane, storage |
| Neon | Control-plane database |
| Hetzner, Vultr, DigitalOcean | Infrastructure for Wrenship servers, in the region you pick |
| Paddle, Midtrans | Payments and tax |
| Resend | Account and notification emails |
| GitHub, GitLab, Google | Sign-in and repository access, when you use them |
| Google Safe Browsing | Checking site addresses for phishing and malware |
We disclose data to authorities only when the law requires it, and we push back on requests that are too broad.
Where it's stored
Account data is stored in [control-plane region]. Your apps, databases and their backups stay in the region you choose for your server. When data moves between countries, we rely on safeguards such as the EU Standard Contractual Clauses.
How long we keep it
- Account data: while your account is open, then deleted within [30] days, except what we must keep by law.
- Billing records: as long as tax law requires, typically [10] years.
- Activity and security logs: [12] months.
- Backups of your databases: until they expire (14 or 90 days).
Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict some processing, and complain to your data protection authority. Write to [privacy@wrenship.com]. We'll answer within 30 days.
Cookies
The dashboard uses a session cookie to keep you signed in and a security cookie against cross-site requests. The marketing site doesn't set tracking cookies.
Changes
We'll post updates here and email you about significant changes.