Privacy Policy
Effective date: September 22, 2026
This Privacy Policy explains how [Company legal name] (operating as Windlass) ("Windlass", "we", "us") collects, uses, shares and protects personal data when you visit 195.58.146.102, create an account or use the Windlass hosted AI agent workspace (the "Service"). It also explains your rights and how to exercise them.
1. Who We Are
[Company legal name], [Company registered address], [Country of incorporation], is the controller of the personal data described in this Policy, except where we act as a processor on your behalf (see Section 3). Contact our privacy team at [privacy email].
2. What We Collect
2.1 Account data. Your email address, name, a hash of your password (we never store the password itself), plan and subscription status, and billing records such as invoices, transaction identifiers, and the brand and last four digits of your card. Full card numbers are handled by [Payment processor] and never reach our servers.
2.2 Workspace content. Files in your project folders, session transcripts (your prompts and the agent's responses, including commands run and their output), uploaded attachments, connector configurations, and voice recordings, which we keep only as long as needed to transcribe them.
2.3 Usage metering records. Token counts, the model used and timestamps for each request, so that we can apply your weekly usage allowance and bill correctly. Metering records do not contain prompt text.
2.4 Technical logs. IP address, user agent, request timestamps, error reports and similar diagnostic information generated when you use the website or the Service.
2.5 Communications. Messages you send us, including support requests and feedback.
We do not intentionally collect special categories of personal data. If you place such data in your workspace, you are responsible for having a lawful basis to do so.
3. Content You Put in Your Workspace
Your workspace is yours. When you upload files or share information with the agent that includes personal data about other people, for instance client records in a project folder, you are the controller of that data and we process it as your processor under our Data Processing Addendum. You decide what to place in your workspace and what to send to the model. Do not upload data you are not permitted to share.
4. How We Use Data and Our Legal Bases
Where the GDPR or UK GDPR applies, we rely on the following legal bases.
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and administering your account, providing the workspace, running the agent, storing and returning your content | Account data, workspace content, metering records | Contract (Art. 6(1)(b)) |
| Transmitting prompts, attachments and outputs to DeepSeek for model inference, and recordings to our speech-to-text provider for transcription | Workspace content | Contract (Art. 6(1)(b)) |
| Billing, invoicing, collecting payment and preventing fraud | Account data, technical logs | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Metering usage and enforcing allowances, rate limits and fair use | Metering records, technical logs | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Securing the Service, detecting abuse and investigating incidents | Technical logs, account data | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
| Sending transactional email, such as verification, receipts, usage and security notices | Account data | Contract (Art. 6(1)(b)) |
| Sending product news and marketing email | Account data | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Responding to support requests | Communications, account data | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Complying with tax, accounting and other legal obligations, including lawful requests from authorities | Account data, billing records, technical logs | Legal obligation (Art. 6(1)(c)) |
| Establishing, exercising or defending legal claims | Any of the above | Legitimate interests (Art. 6(1)(f)) |
Our legitimate interests are running, securing and improving the Service, protecting our customers and our business, and preventing abuse. Where we rely on legitimate interests, we have balanced them against your rights and interests.
We do not use your workspace content to train machine learning models, and we do not sell personal data.
5. Who We Share Data With
5.1 Sub-processors and service providers. We share data with the following providers, who process it on our behalf under contractual obligations of confidentiality and security.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd. (DeepSeek) | Model inference | Prompts, attachments sent to the model, model outputs | China |
| [Hosting provider] | Hosting of workspaces, databases and backups | All categories | [Hosting location] |
| [Payment processor] | Payment processing, invoicing, fraud prevention | Account data, billing records | As published by the provider |
| [Email provider] | Transactional email delivery | Email address, name, message content | As published by the provider |
| our speech-to-text provider | Voice transcription | Voice recordings | As published by the provider |
We publish the current list, and changes to it, at 195.58.146.102.
5.2 DeepSeek. Model inference is performed by DeepSeek under DeepSeek's API terms and privacy policy. Everything you send to the model, including any personal data in prompts or attachments, is transmitted to DeepSeek's servers. You control what you send.
5.3 Connectors you configure. If you connect MCP servers or other third-party services to your workspace, data flows between your workspace and those services at your direction and under their terms. We do not control them.
5.4 Legal and safety. We may disclose data where required by law, subpoena or court order, to protect the rights, property or safety of Windlass, our customers or others, or to enforce our Terms.
5.5 Business transfers. If Windlass is involved in a merger, acquisition, financing or sale of assets, data may be transferred as part of that transaction, subject to this Policy.
6. International Transfers
We are established in [Country of incorporation] and host the Service with [Hosting provider] in [Hosting location]. Our providers may process data in other countries, and model inference takes place in China.
Where we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with supplementary measures where needed. A copy of the relevant safeguards is available on request at [privacy email].
Transfers to DeepSeek in China happen only when you use the agent, and only for the content you choose to send. If you do not want particular data transmitted to China, do not include it in prompts or attachments sent to the model.
7. Retention
| Data | Retention |
|---|---|
| Account data | For the life of your account and up to 30 days after deletion; billing records for as long as tax and accounting law requires |
| Workspace content | While your account is active; deleted within 30 days after account deletion; copies in backups purged within 30 days after that |
| Voice recordings | Only as long as needed to produce the transcript |
| Usage metering records | For the life of your account and the period needed to resolve billing disputes and meet accounting obligations |
| Technical logs | 90 days |
| Support communications | Up to 24 months after the request is closed |
Where data is needed to resolve a dispute, enforce our agreements or comply with a legal obligation, we may retain it for as long as necessary for that purpose.
8. Security
We protect data with per-customer workspace isolation in separate containers, encryption in transit (TLS), access controls that limit who at Windlass can reach production systems, and logging and monitoring. We will notify affected customers of a personal data breach without undue delay and, where the law requires, within 72 hours of becoming aware of it. No method of transmission or storage is completely secure, so use a strong, unique password and protect your credentials.
9. Your Rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectify inaccurate or incomplete data.
- Erase your data, subject to legal retention obligations.
- Port your data to you or another provider in a machine-readable format.
- Object to processing based on legitimate interests, and to direct marketing at any time.
- Restrict processing in certain circumstances.
- Withdraw consent where processing is based on consent, without affecting processing that took place before withdrawal.
- Complain to a supervisory authority: in the EEA, the data protection authority of your country of residence or workplace; in the UK, the Information Commissioner's Office.
You can export your files and delete your account from the settings page, or email [privacy email]. We respond within one month, extendable where the law allows. We may ask you to verify your identity before acting on a request. We will not discriminate against you for exercising your rights.
10. California and Other US State Privacy Notice
This section applies to residents of California and other US states with comprehensive privacy laws.
Categories collected. In the past 12 months we have collected identifiers (name, email, IP address), commercial information (subscription and billing records), internet activity (technical logs), audio data (voice recordings, for transcription only), and any personal information you place in your workspace. Sources are you, your devices and our payment processor. We use these categories for the purposes in Section 4 and disclose them to the providers in Section 5 for business purposes.
No sale or sharing. We do not sell personal information and we do not share it for cross-context behavioral advertising. We do not use or disclose sensitive personal information for purposes other than providing the Service. We do not knowingly sell or share the personal information of anyone under 16.
Your rights. You have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to receive a portable copy; to opt out of sale or sharing (which we do not do); to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. Submit requests at [privacy email] or from your account settings. An authorized agent may submit a request on your behalf with written proof of authority. We verify requests by matching the information you provide with what we hold.
Appeals. If we deny a request, you may appeal by replying to our decision. We respond to appeals within the time your state's law requires.
11. Children
The Service is not directed to anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact [privacy email] and we will delete it.
12. Cookies
We use strictly necessary cookies only. Our Cookie Policy describes them.
13. Changes to This Policy
We may update this Policy from time to time. If a change is material, we will notify you by email or in the Service at least 14 days before it takes effect. The date at the top of this Policy shows when it was last revised.
14. Contact
- [Company legal name]
- [Company registered address], [Country of incorporation]
- Privacy: [privacy email]
- Support: [support email]