Privacy policy

This policy explains what personal data WI1 collects, why we hold it, and the choices you have. It covers the wi1.com website and the WI1 CRM application at crm.wi1.com.

Who we are

WI1 (“we”, “us”) is operated by [Registered company name], [registered address], United Kingdom. For questions about this policy or your data, email [email protected].

We are the data controller for the account and website data described below. Where you use WI1 to hold information about your own customers, you are the controller of that information and we act as your processor.

What we collect

• Account data — name, email address, hashed password, and the company (account) you belong to.
• Content you put into the CRM — contacts, tasks, notes, files, calendar entries and email you choose to connect or upload.
• Connected-service data — calendar and mailbox data from services you connect, described in detail below.
• Usage and technical data — sign-in times, actions taken in the app, and server logs including IP address, kept for security and troubleshooting.
• Website enquiries — anything you send us via the contact form or waitlist signup on wi1.com.

How we use it, and our legal bases

We use personal data to provide and secure the service (performance of our contract with you), to respond to enquiries and improve the product (our legitimate interests), and to meet legal obligations such as accounting. Where we rely on consent — marketing email, for example — you can withdraw it at any time.

We do not sell personal data, and we do not use your content or connected-service data to advertise to you.

Google user data

Connecting Google Calendar is optional. If you connect it, WI1 requests the https://www.googleapis.com/auth/calendar.events scope.

• What we access — calendar events in the connected account: their times, titles, descriptions, locations and attendees.
• Why — so WI1 knows when you are busy when it schedules or suggests times, shows your calendar alongside your CRM work, and (if you enable two-way sync) writes events you create in WI1 back to Google.
• Storage — events are mirrored into your WI1 account’s database so the app is fast and works offline from Google. OAuth access and refresh tokens are encrypted at rest.
• Sharing — Google user data is never sold, never used for advertising, and is not shared with third parties except the infrastructure providers listed under “Who else processes data”, acting on our instructions.
• Removing it — disconnect Google Calendar on the Connections page in WI1. That deletes the stored tokens and stops all further access. You can also revoke access at myaccount.google.com/permissions.

WI1’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use Google user data to train generalised artificial-intelligence or machine-learning models.

Microsoft 365 data

Connecting Microsoft 365 is optional and works the same way: we request calendar permissions through Microsoft Graph, mirror your events into your WI1 account, store tokens encrypted at rest, and stop all access when you disconnect on the Connections page. The same limits apply — no sale, no advertising, no model training on your data.

Email mailboxes

If you connect a mailbox, WI1 stores the credentials encrypted at rest and syncs messages into your account so they can be filed against contacts and acted on. Mailbox content is treated exactly like the rest of your CRM content and is removed when you delete the mailbox from WI1.

AI processing

WI1’s assistants are powered by Anthropic’s Claude models. When you ask an agent to do something — draft a reply, summarise a contact, triage a task — the relevant content is sent to Anthropic’s API to produce that result. Anthropic processes it on our behalf under their commercial terms and does not use it to train their models. Agents act within your account only, and the CRM asks before taking consequential actions.

Who else processes data

• Hosting — our dedicated server in [hosting location], which stores the application database and files.
• Anthropic — AI model processing, as described above.
• Google / Microsoft — only where you have connected those services.

Where a provider is outside the UK, transfers are covered by the UK International Data Transfer Addendum or an adequacy decision.

How long we keep it

Account and CRM content is kept for as long as your account is active. When an account is closed we delete its content within 90 days, except where we must keep records for legal or accounting reasons. Server logs are kept for a short operational period. Disconnecting a service removes its stored credentials immediately.

Security

Traffic is encrypted in transit with HTTPS. Credentials for connected services and mailboxes are encrypted at rest. Access is scoped per company account, so one customer’s data is never visible to another. Access to production systems is limited to the people who operate the service.

Your rights

Under UK GDPR you can ask for a copy of your data, correction of anything inaccurate, deletion, restriction of processing, portability, or object to processing based on legitimate interests. Email [email protected] and we will respond within one month. If you are not satisfied you can complain to the Information Commissioner’s Office at ico.org.uk.

Cookies

The CRM sets a session cookie to keep you signed in — it is required for the app to work. The marketing site uses only what WordPress needs to serve pages and protect forms from spam. We do not run advertising or cross-site tracking cookies.

Changes

If we change this policy we will update the date at the top, and tell account holders directly when the change is significant.