Privacy Notice

This Privacy Notice explains what personal data WRNexus (a product of WORKROOT IT SOLUTIONS LLP) collects, how we use it, who we share it with, and how you can exercise your rights. It applies to the WRNexus platform — including wrnexus.com, sso.wrnexus.com, account.wrnexus.com and our customer-managed deployments — and to any visitors interacting with these properties.

1. Overview

WRNexus ("we", "our", or "us") is committed to protecting your privacy. We collect the minimum personal data needed to operate the service, never sell it, and provide self-serve tools for exporting or deleting your data at any time.

2. Data we collect

We collect information you provide directly:

Account data — name, email address, and password (stored as an Argon2id hash, never in plaintext).
Workspace data — workspace names, slugs, role assignments, and invite metadata.
Billing data — payment method details handled by Stripe; we store only the brand and last-4 digits, never card numbers.
Communication data — messages you send us via the contact form, sales email or in-app support.

We also collect information automatically:

Usage data — pages visited, features used, action timestamps (aggregated and pseudonymised for analytics).
Log data — IP addresses, browser type, referring URLs, retained for at most 30 days for abuse-prevention purposes.
Cookies — a single session cookie (__Secure-wrn_sid) per authenticated session; no third-party advertising cookies.

3. How we use your data

Create and maintain your account and workspaces.
Authenticate your identity, manage sessions and enforce MFA.
Process payments and issue invoices via Stripe.
Send transactional email (email verification, magic links, receipts, security alerts).
Respond to support requests and contractual notices.
Detect and prevent fraud, abuse, and unauthorised access.
Improve the platform via aggregated, anonymised analytics.

We do not sell, rent, or trade your personal data.

We share data only with the following classes of recipient:

Stripe — payment processing (US/EU).
Postmark — transactional email delivery (US).
Cloud infrastructure providers — Fly.io, Hetzner and AWS, under appropriate data processing agreements.
Law enforcement or courts — only when legally compelled, and only after consulting counsel.

A current list of subprocessors lives at /legal/subprocessors and is updated within 30 days of any change.

5. Retention & deletion

Account data is retained for as long as your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where retention is required by law (for example, tax records for seven years in the United States).

6. Your rights

Depending on your location you may have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Request deletion ("right to be forgotten").
Restrict or object to processing.
Receive your data in a portable, machine-readable format.

Exercise these rights by emailing privacy@wrnexus.com or via the data-export and deletion tools in Account → Settings → Data.

7. Security practices

We use industry-standard security controls: TLS 1.2+ in transit, AES-256 encryption at rest, HttpOnly + Secure cookies, signed session tokens, role-based access on every internal admin tool, and continuous monitoring. No method of internet transmission is 100% secure, but we publish security advisories within 24 hours of confirming any incident with potential customer impact.

8. International transfers

WRNexus processes data in the European Union and the United States. Where personal data is transferred outside the EEA we rely on Standard Contractual Clauses (SCCs) and additional technical safeguards (encryption in transit and at rest, access logging, key rotation).

9. Children

WRNexus is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to this notice

We may update this notice from time to time. Material changes are emailed to account owners at least 30 days before they take effect, and surfaced in an in-product banner. The "Last updated" date at the top reflects the most recent revision.

11. Contact us

Questions about this Privacy Notice? Reach our Data Protection Officer at privacy@wrnexus.com or via our contact form. EEA residents may also contact our EU representative listed in the EU representative page.

Company details

Legal entity: WORKROOT IT SOLUTIONS LLP
Registered office: At Post Rajapur (Shantinagar), Taluka Khatav, Dist Satara, Maharashtra 415503
PAN: AAEFW2790B
GSTIN: 27AAEFW2790B1Z7
Website: https://workroot.in/