Who is responsible and scope
Obra Inc is responsible for account administration, billing and operation of Wrkr. Contact support@wrkr.dev for privacy requests. Our legal-notices address is 30 N Gould St 66299, Sheridan, WY 82801, United States. This notice covers the paid service; the public website notice explains invitation requests, website examples and aggregate measurement.
For personal information you process for your own business in a workspace, you determine the purpose and lawful basis. Where Wrkr acts as your processor, a separate data-processing agreement sets out instructions, subprocessors, safeguards and assistance. It does not replace your own notice to people whose information you collect.
Information used to provide the service
| Information | Purpose |
|---|---|
| Account email, identifiers and authentication records | Sign-in, account administration, security and support. |
| Plan, subscription and processor references, receipts and transaction status | Provide paid access, handle renewals, refunds and financial records. Payment details are collected through the disclosed payment provider; do not put full card details in support messages. |
| Prompts, conversations, project files, uploads and generated work | Carry out your instructions, show results and maintain continuity through saved work. |
| Connected-service credentials and browser session state | Let your workers use services you choose, with the permissions you grant. |
| Hosted application data, where the service is included | Run the apps you choose to create and publish. |
| Backups and recovery records | Recover retained saved work and restore accounts after failures. |
| Necessary access, error, resource and security records | Operate capacity, investigate failures and abuse, protect the platform and establish delivery. |
| Support messages and request history | Respond to problems, data requests, complaints and billing questions. |
You supply some information directly; other information arises from operating your account or comes from connected providers and payment services. We do not need copies of all prompts or files merely to prove a subscription payment or cancellation.
Recipients and processing locations
The service uses the following providers for their stated roles:
| Provider | Role and processing location |
|---|---|
| Hetzner | Cloud computers in Helsinki, Finland. |
| Backblaze B2 | Encrypted workspace backups in its EU region. |
| Cloudflare | DNS and infrastructure used for operator alerts; processing may involve its global network. |
| Stripe | Card payments and subscription administration; processing may occur outside Europe. |
| Amazon Web Services SES | Service email in us-east-1, United States. Wrkr-provided app email is coming soon and excluded from launch. |
| Telegram | Operator alerts only; not the customer workspace or chat interface. Processing may occur outside Europe. |
This is the planned service-provider inventory for paid launch. We will publish the applicable processing and transfer arrangements before accepting paid subscriptions. App email is not included at launch; additional disclosures will accompany its release. Authorized Wrkr personnel may access data as needed to operate, support, secure and recover the service. We may disclose necessary information to comply with law, protect people or establish legal claims.
Your AI sign-ins and browser session state can be stored in your worker's home and included in its encrypted backups. The absence of Wrkr account-password material or payment secrets from worker computers does not mean customer credentials never exist there.
Your chosen AI provider and connected services receive instructions and data you cause workers to send. They may act under their own privacy terms, rather than solely as Wrkr subprocessors. Review those terms and permissions before connecting them. We do not sell account data or use workspace content for targeted advertising. Wrkr does not use your workspace content to train its own general-purpose AI model; connected AI providers govern their own data use.
Hosting in Europe does not mean every recipient or support person is in Europe. Where applicable law requires a transfer mechanism, the relevant contractual or other lawful safeguard must be in place; contact support for a copy or description of safeguards applicable to your data.
Retention and deletion
Workspace content remains available during active service. The Terms explain the service-end date for ordinary cancellation, unresolved nonpayment or early restriction. The seven-day export period starts at that date. We preserve data needed for an authenticated export requested on time until it is made available and you have seven calendar days to retrieve it. Active content is then deleted and retained backup copies are erased within 30 further days, subject to specific legal-preservation requirements. The Terms also explain verification and restricted exports.
Account closure removes stored provider credentials and browser session state from active systems as part of workspace erasure. Access may be revoked earlier for security. Where a provider supports revocation, we revoke the connection; otherwise we remove the stored access material and explain any action you need to take in that provider's account. The same backup erasure schedule applies to retained credentials and session state.
Routine operational logs are retained for up to 30 days unless needed to investigate an incident. Support and minimal account-administration records, excluding workspace content, credentials and browser session state, are retained for up to 12 months after closure of the request or account, unless required for an unresolved issue or legal obligation. Financial and tax records are retained for the applicable statutory period. Legally preserved records are restricted to that purpose and removed when the requirement ends. They are not restored into an active account simply because a system backup is recovered.
Immediate deletion requests require verification and confirmation of their scope. We explain what can be removed and any legal exceptions. Deleting a worker alone does not cancel billing or guarantee instant erasure of all backup versions.
Legal bases and your rights
Where a legal basis is required, we process account and service data to perform the agreement, process requested pre-contract steps, meet legal obligations, and pursue legitimate interests in secure and reliable operation, support and fraud prevention, subject to your rights. We use consent where required for separate optional purposes. Business-workspace processing follows the customer's documented instructions under the applicable agreement.
Contact support to request access, correction, deletion, restriction or portability where those rights apply. You may object to legitimate-interest processing and withdraw applicable consent without affecting earlier lawful processing. You may complain to the relevant data-protection authority. Verification is proportionate and does not require sending passwords or login codes. We respond within applicable legal deadlines and explain any lawful extension or refusal.
We do not make solely automated decisions with legal or similarly significant effects about you without the notices and safeguards required by applicable law. You can ask for human review of an account restriction. Wrkr is for adults and is not intended for children under 18.
Security and updates
We use encrypted network connections, access controls and encrypted off-server backups as applicable to the service. Operators can access systems for legitimate operational purposes; no claim of zero operator access or absolute security is made. If a personal-data breach requires notification, we will notify affected parties and authorities as applicable law requires. We will publish changes to this notice and communicate material new uses before they take effect.