Privacy Notice

This Privacy Notice explains what personal data WRNexus (a product of WORKROOT IT SOLUTIONS LLP) collects, how we use it, who we share it with, and how you can exercise your rights. It applies to the WRNexus platform — including wrnexus.com, sso.wrnexus.com, account.wrnexus.com and our customer-managed deployments — and to any visitors interacting with these properties.

1. Overview

WRNexus ("we", "our", or "us") is committed to protecting your privacy. We collect the minimum personal data needed to operate the service, never sell it, and provide self-serve tools for exporting or deleting your data at any time.

2. Data we collect

We collect information you provide directly:

Account data — name, email address, and password (stored as an Argon2id hash, never in plaintext).
Workspace data — workspace names, slugs, role assignments, and invite metadata.
Billing data — payment method details handled by Stripe; we store only the brand and last-4 digits, never card numbers.
Communication data — messages you send us via the contact form, sales email or in-app support.

We also collect information automatically:

Usage data — pages visited, features used, action timestamps (aggregated and pseudonymised for analytics).
Log data — IP addresses, browser type, referring URLs, retained for at most 30 days for abuse-prevention purposes.
Cookies — a single session cookie (__Secure-wrn_sid) per authenticated session; no third-party advertising cookies.

If you use our WhatsApp Business messaging feature, we process — as a processor acting on behalf of your workspace — the data needed to deliver and meter those messages:

Recipient phone numbers you send messages to, in E.164 format.
Message content and metadata — message bodies, templates, media identifiers, message type and billing category.
Delivery events — sent / delivered / read / failed statuses and timestamps returned by Meta's WhatsApp Cloud API.
Inbound messages sent to your WhatsApp number, and consent records (opt-ins and STOP opt-outs) with their source.

WhatsApp messaging is delivered through Meta's WhatsApp Cloud API. Meta processes message content to transmit it to recipients under its ownWhatsApp Business Messaging Policy. We do not use WhatsApp message content for advertising and we send only to recipients who have opted in.

3. How we use your data

Create and maintain your account and workspaces.
Authenticate your identity, manage sessions and enforce MFA.
Process payments and issue invoices via Stripe.
Send transactional email (email verification, magic links, receipts, security alerts).
Deliver and meter WhatsApp Business messages you send, and process inbound replies and consent (opt-in / STOP) on your behalf.
Respond to support requests and contractual notices.
Detect and prevent fraud, abuse, and unauthorised access.
Improve the platform via aggregated, anonymised analytics.

We do not sell, rent, or trade your personal data.

We share data only with the following classes of recipient:

Stripe — payment processing (US/EU).
Postmark — transactional email delivery (US).
Meta Platforms — delivery of WhatsApp Business messages via the WhatsApp Cloud API, when you use the WhatsApp feature.
Cloud infrastructure providers — Fly.io, Hetzner and AWS, under appropriate data processing agreements.
Law enforcement or courts — only when legally compelled, and only after consulting counsel.

A current list of subprocessors lives at/legal/subprocessors and is updated within 30 days of any change.

5. Retention & deletion

Account data is retained for as long as your account is active. If you delete your account, we delete or anonymise your personal data within 30 days, except where retention is required by law (for example, tax records for seven years in the United States).

6. Your rights

Depending on your location you may have the right to:

Access the personal data we hold about you.
Correct inaccurate or incomplete data.
Request deletion ("right to be forgotten").
Restrict or object to processing.
Receive your data in a portable, machine-readable format.

Exercise these rights by emailingprivacy@wrnexus.comor via the data-export and deletion tools inAccount → Settings → Data.

7. Security practices

We use industry-standard security controls: TLS 1.2+ in transit, AES-256 encryption at rest, HttpOnly + Secure cookies, signed session tokens, role-based access on every internal admin tool, and continuous monitoring. No method of internet transmission is 100% secure, but we publish security advisories within 24 hours of confirming any incident with potential customer impact.

8. International transfers

WRNexus processes data in the European Union and the United States. Where personal data is transferred outside the EEA we rely on Standard Contractual Clauses (SCCs) and additional technical safeguards (encryption in transit and at rest, access logging, key rotation).

9. Children

WRNexus is not directed at children under 16. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to this notice

We may update this notice from time to time. Material changes are emailed to account owners at least 30 days before they take effect, and surfaced in an in-product banner. The "Last updated" date at the top reflects the most recent revision.

11. Contact us

Questions about this Privacy Notice? Reach our Data Protection Officer atprivacy@wrnexus.comor via our contact form. EEA and UK residents who remain unsatisfied may also lodge a complaint with their local data-protection supervisory authority.

Company details

Legal entity: WORKROOT IT SOLUTIONS LLP
Registered office: At Post Rajapur (Shantinagar), Taluka Khatav, Dist Satara, Maharashtra 415503
PAN: AAEFW2790B
GSTIN: 27AAEFW2790B1Z7
Website: https://workroot.in/