Privacy Policy

Warnd (“we”, “us”) operates the application at warnd.app and the related services described in this policy.

1. What we collect

Account data

• Your email address and (optionally) display name.
• The tenant/workspace(s) you belong to, your role, and your status.
• An encrypted password hash if you use email/password sign-in.

Workspace content you add

• AI tools you add to your inventory: title, vendor, website, category, status, owner, descriptions, policy fields.
• Risk-scan results (parsed from the tool's public privacy policy).
• Activity log entries — who did what, when.

Discovery connector data (optional)

If you connect Google Workspace, we read only the following via Google's Admin SDK and Token APIs:

• The list of active users in your domain (email + display name).
• Each user's third-party OAuth grants — the app's OAuth client ID, display name, and the scopes they've granted.
• Your Workspace domain and customer ID.

We never read email content, Drive or Calendar files, contacts, chat, or any user-generated content. Our requested scopes are admin.directory.user.readonly and admin.directory.user.security — both read-only.

Refresh tokens used by the connector are stored encrypted at rest. You can disconnect from Settings → Connectors at any time, which revokes the OAuth token with Google and removes our access immediately.

Operational data

• Server logs (IP, user agent, request path, timestamps) retained for security and debugging — typically 30 days.
• Error reports via Sentry, scrubbed of request bodies.
• Billing metadata (Stripe customer ID, plan, subscription status). Card details are stored by Stripe, never by us.

2. What we do not do

• We do not sell your data. To anyone. Ever.
• We do not use your data — including discovered apps and risk scores — to train AI models.
• We do not run third-party advertising or behavioural-tracking scripts.
• We do not share your discovery data with other tenants. Every read is gated by Postgres row-level security keyed on your tenant ID.

3. Where your data lives

Application data is stored in Postgres on Supabase, in the eu-west-2 (London) region. Encryption at rest is handled by the cloud provider; OAuth refresh tokens are additionally encrypted at the application layer.

We use the following processors to operate the service:

• Supabase — Postgres database, authentication, file storage.
• Vercel — application hosting + CDN.
• Stripe — billing and payments. They process card details directly; we only see the last four digits and metadata.
• Resend — transactional email (invites, approval notifications).
• Sentry — error monitoring.
• Google — only when you connect the Workspace connector; only the read scopes listed above.

We have data-processing agreements with each of these processors. For EU/UK users, our basis is the standard contractual clauses where the processor operates outside the EU/UK.

4. Retention

• Workspace content (items, activity, risk scores) is retained as long as your workspace is active.
• Audit-log entries follow your plan's retention (Free: 7 days, Team: 90 days, Business: 365 days).
• If you delete a workspace, its data is removed within 30 days.
• If you disconnect the Google Workspace connector, the refresh token is wiped immediately. Discovered apps already in your inventory are kept so you don't lose curated metadata.
• Server logs are retained for up to 30 days unless required longer for security investigations.

5. Your rights

Under the GDPR (and equivalent laws in the UK, California, and other jurisdictions), you have the right to:

• Access the data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Export your data in a portable format.
• Object to or restrict certain types of processing.

To exercise any of these rights, email privacy@warnd.app. We aim to respond within 30 days.

6. Cookies and similar technologies

We use the minimum cookies necessary to keep you signed in (httpOnly, secure session cookies via Supabase Auth) and to protect OAuth flows from CSRF (short-lived state cookies). We do not use marketing or analytics cookies. The only other cookies are two preference cookies — your language and your timezone. Because none of this is optional tracking, there is no cookie banner to click through.

7. Children

Warnd is not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we'll delete it.

8. Changes to this policy

Material changes will be announced in-app at least 14 days before they take effect. The “last updated” date at the top always reflects the current version.

9. Contact

Privacy questions, data requests, or anything you'd like us to explain: privacy@warnd.app.

Warnd is currently operated by its founder as an individual, based in Switzerland. Legal entity details (company name, registration number, registered address) will be published here upon incorporation. Data-protection contact: privacy@warnd.app.