Privacy Policy

Last updated: 22 September 2026

1. Overview

This policy explains how WrkGenie collects, uses, stores, and protects personal data when you visit wrkgenie.com or contact us. We aim to be clear and honest about what we do with your information, and we comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who we are (Data Controller)

The data controller for this website is WrkGenie Ltd, registered in England and Wales, company number 17470776.

  • Email: hello@wrkgenie.com
  • Postal address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

3. Data we collect

a) Contact form data

When you submit our contact form we collect your name, email address, and the contents of your message. This is used solely to respond to your enquiry.

When you request a downloadable template, we process your email address, marketing preference, request time and campaign information. The request also uses your IP address for abuse prevention and may store it with the request.

b) Analytics data

With your consent, we use analytics tools to understand how visitors interact with the site (pages viewed, session duration, approximate location, device and browser type). We do not use this information to identify you personally.

c) Technical data

Our infrastructure provider (Cloudflare) processes basic technical information needed to deliver the site and protect it from abuse, including IP address, browser type, request headers, and timestamps.

d) Visit notifications

If you accept optional analytics, we may receive a visit-notification email containing the page address, referring page, approximate location, browser type and a shortened hashed identifier derived from your IP and browser. A session-storage marker and, where configured, a temporary server-side deduplication record reduce repeated alerts. The visit email uses the hashed identifier rather than your raw IP address.

4. Lawful bases for processing

We rely on the following lawful bases under Article 6 of the UK GDPR:

  • Consent — for optional analytics and non-essential cookies. You can withdraw consent at any time via the cookie banner.
  • Legitimate interests — for operating, securing, and improving the website (including spam and abuse prevention).
  • Pre-contract / enquiry handling — for responding to messages you send via our contact form.

5. Third-party processors

We use a small number of trusted providers to operate the site. These providers act as data processors on our behalf:

  • Google (Google Analytics 4 and Google Ads) — website analytics and advertising measurement. Loaded only with your consent.
  • Microsoft (Clarity) — anonymised behavioural analytics and session insights. Loaded only with your consent.
  • Vercel — website hosting and request processing, plus optional Web Analytics after you accept analytics.
  • Resend — delivers website contact enquiries, requested template emails and optional visit-notification emails.
  • Amazon Web Services (including SES) — platform infrastructure and transactional email delivery, including recipient details, message content and attachments where used.
  • Upstash / Vercel KV — where configured, stores template-request details and supports rate limiting and visit-notification deduplication.
  • Meta Pixel — optional website advertising measurement after you accept analytics. This is separate from WhatsApp messaging.
  • Cloudflare — content delivery, security, and Turnstile (anti-bot challenge on forms).
  • Stripe, Inc. — payment processing. Stripe processes card transactions on our behalf, including handling billing information such as name, billing address, and payment method details. WrkGenie Ltd is the seller; Stripe does not act as Merchant of Record. You can view Stripe's Privacy Policy on their website.
  • Meta Platforms, Inc. (WhatsApp Business Platform) — messaging infrastructure used to deliver the WrkGenie WhatsApp assistant and to facilitate business communications between tenants and their customers via WhatsApp. Message content and metadata are processed by Meta in accordance with their policies. You can view Meta's Privacy Policy on their website.
  • OpenAI, L.L.C. — artificial intelligence services used to power the WrkGenie assistant features, including WhatsApp intent classification and the knowledge assistant. When you choose an AI feature, information described in section 14 may be processed by OpenAI solely to provide the requested functionality. Mobile AI writing features ask for permission before sharing it. You can view OpenAI's Privacy Policy on their website.
  • Wasabi Technologies, Inc. — cloud object storage used for storing files and assets associated with your WrkGenie account, such as uploaded documents and media.

We do not sell your personal data. If you accept optional analytics, the advertising measurement services listed above receive website interaction data. You can change this choice using Cookie settings in the footer.

6. International transfers

Some of our processors (notably Google, Microsoft, Cloudflare, Stripe, Meta, OpenAI, Resend, Vercel, and Wasabi) may process data outside the United Kingdom and European Economic Area. Where this happens, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or an adequacy decision recognised by the UK government.

7. App data (app.wrkgenie.com)

When you create a WrkGenie account and use the app at app.wrkgenie.com, we act as a data controller for your account data and as a data processor for the business data you enter (jobs, invoices, quotes, customer records, and related content) on behalf of your business.

The personal data we hold in relation to your app account includes:

  • Account data: name, email address, business name, and login credentials.
  • Subscription data: plan type, billing status, and transaction references (processed by Stripe on our behalf — we do not store full payment card details).
  • Business records: jobs, invoices, quotes, customer names, contact details, and any notes you enter. This data belongs to you.
  • Session data: a secure authentication cookie to keep you logged in.
  • Activity logs: an append-only audit trail of key actions within your account for security and debugging purposes.

App data retention: account and business records support your workspace. Cancelling a subscription is different from requesting account deletion and does not itself erase your records. Deletion requests are reviewed, including whether a shared workspace must be preserved and whether financial records must be retained. Deleted data may remain in backups for up to 30 days.

Mobile devices keep local business records and pending edits for offline use. They synchronize these records with the backend when connected. Device authentication uses securely stored session tokens; signing out is different from deleting account data.

You can export your customer, job and invoice lists as CSV from within the app. You can start account deletion in the mobile app under Settings, Delete account, or email hello@wrkgenie.com.

8. Data retention

  • Contact form messages: kept for up to 12 months after the enquiry is resolved, then deleted unless we need them for legal or accounting reasons.
  • Analytics data: retained according to the provider's default settings (Google Analytics 4 is configured for a maximum of 14 months).
  • Security and access logs: retained for a short period (typically up to 30 days) for troubleshooting and abuse prevention.

9. Cookies

We use a small number of cookies and similar technologies:

  • Essential cookies — required for the site to function and to remember your cookie preferences. These do not require consent.
  • Analytics cookies — used by Google Analytics, Google Ads, Microsoft Clarity and Meta Pixel only after you give consent via our cookie banner.
  • Security cookies — set by Cloudflare to protect the site against malicious traffic.

You can change or withdraw your consent at any time using the Cookie settings link in the footer, or by clearing cookies and site data in your browser. Changing your choice stops future optional measurement; it does not recall information already sent.

10. Your rights

Under UK GDPR you have the following rights:

  • Access — request a copy of the personal data we hold about you.
  • Rectification — ask us to correct inaccurate or incomplete data.
  • Erasure — ask us to delete your personal data where there is no overriding reason to keep it.
  • Restriction — ask us to limit how we use your data.
  • Objection — object to processing based on legitimate interests.
  • Data portability — request your data in a structured, machine-readable format.
  • Withdraw consent — at any time, where processing is based on consent.

To exercise any of these rights, email hello@wrkgenie.com. We will respond within one month.

To request deletion of your personal data, use our dedicated data deletion page — it explains exactly what we delete and how we confirm your request.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data properly.

11. Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. These include encrypted connections (HTTPS), access controls, hardened infrastructure, and regular review of our third-party providers. No system can be guaranteed 100% secure, but we work to minimise risk.

12. Children

WrkGenie is intended for use by businesses and adults. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. WhatsApp Business Platform

WrkGenie uses the Meta WhatsApp Business Platform to provide an AI-powered assistant feature and to enable businesses (“tenants”) using WrkGenie to communicate with their customers via WhatsApp.

When WhatsApp features are used, the following data may be processed:

  • Inbound message content: the text of messages sent to a WrkGenie-connected WhatsApp number, processed to determine intent and generate a response.
  • Sender phone number: used to identify the account owner or customer and route the message to the correct business tenant.
  • Message metadata: timestamps, message identifiers (wamid), and delivery status, retained in our event log for deduplication, auditing, and support.
  • Message logs: inbound and outbound WhatsApp messages may be stored for a limited period for support, troubleshooting, and audit purposes.

WhatsApp message data is processed in accordance with Meta's Privacy Policy as well as this policy. WrkGenie acts as a Solution Provider (ISV) managing WhatsApp Business accounts on behalf of its tenants.

14. AI assistant features

WrkGenie uses OpenAI services to power certain features, including the WhatsApp assistant and in-app AI tools. In the mobile writing assistant, after you give permission and ask it to write or improve a message, WrkGenie sends that message, the customer's name, your business name and relevant quote or invoice details such as its reference, amount and date to OpenAI to create a draft.

  • Data is sent to OpenAI solely for the purpose of generating a response to your request.
  • The mobile writing assistant does not automatically add customer email addresses, phone numbers, postal addresses, attachments, authentication details or internal IDs as structured context. Information you type or paste into the message is included, so remove sensitive details you do not want to share.
  • Other assistant features, including WhatsApp and conversational tools, process the messages and context needed for that feature. The mobile writing permission controls mobile writing requests; it is not a switch for every assistant channel.
  • OpenAI processes data in accordance with their Privacy Policy. OpenAI's API does not use customer data submitted via the API to train their models by default. OpenAI may retain API inputs and outputs in abuse-monitoring logs for up to 30 days, subject to its policies and legal or security exceptions.

AI writing assistance is optional. Its result is shown for review and is never sent to a customer automatically. Mobile users can withdraw permission under Settings, Privacy & AI without affecting ordinary quotes, invoices or messages. AI-generated responses may contain errors; you remain responsible for reviewing them before use.

15. Customer communications on behalf of tenants

WrkGenie is a multi-tenant SaaS platform. Businesses (“tenants”) use WrkGenie to manage their operations and interact with their own customers. In this context:

  • WrkGenie acts as a data processor on behalf of each tenant when processing their customers' personal data.
  • Each tenant is the data controller for the personal data of their own customers.
  • WrkGenie may send emails, invoices, quotations, appointment notifications, and other business communications on behalf of tenants to their customers.
  • WhatsApp messages may be sent on behalf of tenants to their customers via the WrkGenie-integrated WhatsApp Business number.
  • Customer data entered into WrkGenie by a tenant (such as names, email addresses, phone numbers, and job details) is processed by WrkGenie solely to provide the platform services to that tenant.

If you are a customer of a business that uses WrkGenie and you have questions about how your data is used, please contact that business directly. You may also contact us at hello@wrkgenie.com if you believe your data has been processed incorrectly.

16. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our service, our processors, or the law. When we make material changes we will update the “Last updated” date at the top of this page and, where appropriate, notify you through the website.

17. Contact

Questions about this policy or how we handle your data? Email hello@wrkgenie.com.