LEGAL

Privacy Policy

Privacy and data governance terms for WellStreak AI Business Performance Operating System services.

Last updated: February 24, 2026

1.1 Scope of this Policy

This Privacy Policy applies to personal data processed through WellStreak AI websites, product interfaces, API endpoints, support operations, and related legal/compliance workflows.
This policy applies to account owners, team members, prospects, support requesters, and authorized representatives interacting with the Services.

1.2 Data Controller and Contact

For platform operations described in this policy, WellStreak AI Technologies acts as a data controller for its own business purposes and as a processor where customers provide instructions under the DPA.
Privacy contact: support@wellstreakai.com.

2.1 Data Categories We Process

Account and identity data: name, email, role, login/session metadata, and authentication identifiers.
Business operations data: company profile, workflow settings, training inputs, uploaded documents, conversation logs, support tickets, and integration metadata.
Commercial data: subscription details, invoices, payment references, and transaction event records.
Technical/security data: device metadata, audit logs, abuse prevention indicators, and service telemetry.

2.2 Sources of Data

Data is collected directly from users, workspace administrators, connected services, platform events, and support communications.
Data may also be received through authorized third-party integrations enabled by customers.

3.1 Purposes of Processing

To provide and operate core platform functionality including workspace access, AI workflow execution, routing, and analytics.
To protect service integrity through security monitoring, fraud prevention, and abuse response.
To manage billing, invoicing, legal compliance, policy enforcement, and customer support.
To improve service quality, reliability, and product operations without selling customer data.

3.2 Legal Bases (GDPR-Style Explanation)

Contractual necessity: to deliver the Services requested by users and customers.
Legitimate interests: service security, abuse prevention, product reliability, and operational reporting.
Legal obligation: compliance with applicable law, regulatory requirements, and lawful requests.
Consent (where applicable): optional communication preferences and non-essential cookie controls.

4.1 AI Processing and Model Providers

WellStreak AI uses model providers and infrastructure processors to deliver automation features. AI outputs are generated from configured customer instructions and context data.
We do not intentionally sell or broker customer personal data to third parties.
Customers remain responsible for ensuring lawful submission of data to AI workflows and for applying appropriate human review for high-risk decisions.

4.2 Third-Party Service Disclosure

We may use service providers for cloud infrastructure, model inference, communications, monitoring, and payments (for example: Supabase, model providers, messaging platforms, and payment processors).
Each provider processes data under its own terms and security posture. We apply commercially reasonable contractual controls appropriate for service delivery.

5.1 Data Retention

Data is retained only as long as needed for service delivery, account continuity, billing, dispute handling, security analysis, and legal obligations.
Retention windows differ by data category, including transaction records, support records, and security audit logs.
Where legally permissible and operationally feasible, data deletion requests are honored according to policy and contractual obligations.

6.1 Data Subject Rights

You may request access to personal data, correction of inaccuracies, and deletion of eligible data.
You may request restriction of certain processing or object where legally applicable.
You may request portability for data that can be exported in commonly used formats.
You may lodge complaints with applicable data protection authorities where permitted.

6.2 Data Access and Deletion Requests

Submit requests to support@wellstreakai.com with account identifiers and sufficient verification details.
Requests may be limited where legal retention, fraud prevention, security obligations, or rights of other parties require restricted processing.

7.1 Cookie and Tracking Controls

Essential cookies and storage mechanisms are used for authentication, session integrity, and security controls.
Non-essential preferences may be managed through cookie controls and browser settings where technically available.
Further details are available in the Cookie Policy.

8.1 Security Measures

We implement technical and organizational controls including access restrictions, authentication checks, tenant-scoped permissions, logging, and transport/application safeguards.
No security system is absolute. We continuously improve controls in response to evolving threats and operational requirements.

9.1 International Processing

Data may be processed across jurisdictions depending on infrastructure, integrations, and model providers selected for service delivery.
Where cross-border processing occurs, we apply commercially reasonable safeguards consistent with legal and contractual requirements.

10.1 Governing Law and Disputes

This policy is read with applicable service agreements governed by laws of India.
Dispute handling and arbitration framework are described in the Terms of Service.

11.1 Policy Changes

We may update this policy from time to time to reflect legal, operational, or product changes.
Updated versions become effective on publication unless stated otherwise.

1.1 Scope of this Policy

This Privacy Policy applies to personal data processed through WellStreak AI websites, product interfaces, API endpoints, support operations, and related legal/compliance workflows.

This policy applies to account owners, team members, prospects, support requesters, and authorized representatives interacting with the Services.

2.1 Data Categories We Process

Account and identity data: name, email, role, login/session metadata, and authentication identifiers.

Business operations data: company profile, workflow settings, training inputs, uploaded documents, conversation logs, support tickets, and integration metadata.

Commercial data: subscription details, invoices, payment references, and transaction event records.

Technical/security data: device metadata, audit logs, abuse prevention indicators, and service telemetry.

3.1 Purposes of Processing

To provide and operate core platform functionality including workspace access, AI workflow execution, routing, and analytics.

To protect service integrity through security monitoring, fraud prevention, and abuse response.

To manage billing, invoicing, legal compliance, policy enforcement, and customer support.

To improve service quality, reliability, and product operations without selling customer data.

3.2 Legal Bases (GDPR-Style Explanation)

Contractual necessity: to deliver the Services requested by users and customers.

Legitimate interests: service security, abuse prevention, product reliability, and operational reporting.

Legal obligation: compliance with applicable law, regulatory requirements, and lawful requests.

Consent (where applicable): optional communication preferences and non-essential cookie controls.

4.1 AI Processing and Model Providers

WellStreak AI uses model providers and infrastructure processors to deliver automation features. AI outputs are generated from configured customer instructions and context data.

We do not intentionally sell or broker customer personal data to third parties.

Customers remain responsible for ensuring lawful submission of data to AI workflows and for applying appropriate human review for high-risk decisions.

4.2 Third-Party Service Disclosure

We may use service providers for cloud infrastructure, model inference, communications, monitoring, and payments (for example: Supabase, model providers, messaging platforms, and payment processors).

Each provider processes data under its own terms and security posture. We apply commercially reasonable contractual controls appropriate for service delivery.

5.1 Data Retention

Data is retained only as long as needed for service delivery, account continuity, billing, dispute handling, security analysis, and legal obligations.

Retention windows differ by data category, including transaction records, support records, and security audit logs.

Where legally permissible and operationally feasible, data deletion requests are honored according to policy and contractual obligations.

6.1 Data Subject Rights

You may request access to personal data, correction of inaccuracies, and deletion of eligible data.

You may request restriction of certain processing or object where legally applicable.

You may request portability for data that can be exported in commonly used formats.

You may lodge complaints with applicable data protection authorities where permitted.

8.1 Security Measures

We implement technical and organizational controls including access restrictions, authentication checks, tenant-scoped permissions, logging, and transport/application safeguards.

No security system is absolute. We continuously improve controls in response to evolving threats and operational requirements.

Privacy Policy

1.1 Scope of this Policy

1.2 Data Controller and Contact

2.1 Data Categories We Process

2.2 Sources of Data

3.1 Purposes of Processing

3.2 Legal Bases (GDPR-Style Explanation)

4.1 AI Processing and Model Providers

4.2 Third-Party Service Disclosure

5.1 Data Retention

6.1 Data Subject Rights

6.2 Data Access and Deletion Requests

7.1 Cookie and Tracking Controls

8.1 Security Measures

9.1 International Processing

10.1 Governing Law and Disputes

11.1 Policy Changes

Activating Well Streak

Privacy Policy

1.1 Scope of this Policy

1.2 Data Controller and Contact

2.1 Data Categories We Process

2.2 Sources of Data

3.1 Purposes of Processing

3.2 Legal Bases (GDPR-Style Explanation)

4.1 AI Processing and Model Providers

4.2 Third-Party Service Disclosure

5.1 Data Retention

6.1 Data Subject Rights

6.2 Data Access and Deletion Requests

7.1 Cookie and Tracking Controls

8.1 Security Measures

9.1 International Processing

10.1 Governing Law and Disputes

11.1 Policy Changes