Privacy Policy

This Privacy Policy describes how Wrasse Technologies Inc. ("Wrasse," "we," "our," or "us") collects, uses, stores, and discloses information when you use our services at wrasse.ai (the "Service"). It applies to everyone who uses Wrasse, wherever you are.

The short version: your agent's conversations and actions are yours. We do not train models on them, we do not sell them, and we do not aggregate them with anyone else's. What we hold, we hold in order to run your agent and to give you a record of what it did. If a specific question isn't answered here, write to security@wrasse.ai and we will answer it.

1. Information we collect

Account information

When you create an account, we collect your name and email address. Payment details are collected and processed by our payment processor; full payment card numbers never reach Wrasse infrastructure and we cannot retrieve them. We store the billing metadata the processor returns — the card brand, its last four digits, its expiry, and the subscription state — so the dashboard can show you what you are paying for.

Closer Pilot Partners applications

The Closer Pilot Partners program is open to real estate agents and brokerages in Canada, the United States, the United Kingdom, Ireland, Australia, New Zealand, Singapore, the United Arab Emirates and South Africa. When you apply, we collect your answers on the application form: your name, business, country, province or state, city, business email and how you work. When you agree to be contacted about the program, we keep a record of that agreement: the wording you agreed to, when, and the IP address and browser it came from. We also keep the campaign tags and the reference code on the link you followed (never your email address), and your browser's time zone, so our emails reach you at a sensible hour.

We use your application to decide whether the program is a fit, to contact you about it, and to run your partnership if you join. Your data may be processed outside your country, including by the service providers listed below.

To see, correct or delete your application, or to withdraw your agreement to be contacted, write to partners@wrasse.ai. Your other rights are under "Your rights" below.

Agent activity

When your Wrasse agent runs, we record every tool call it makes, including when it sends emails and other messages through your connected accounts: what ran, when, the policy decision, and digests of its inputs and outputs, not their content. That record is the audit log. It exists so that you can see what your agent did, filter and export it, and so that a disputed action has a record rather than a recollection. The network log also keeps the address each web request went to, which for a plain-HTTP request includes its path and query. The agent's own replies to you on Telegram, WhatsApp and your other channels are kept in your chat transcript, not in the audit log, for now. Separately, when your policy holds an action for your approval, the request keeps what it asks you (the recipient, subject and draft) so you can decide.

Conversation content

Conversations between you and your agent are stored against your account. We use this content to serve your agent's responses and to maintain memory across sessions. We do not use it for model training, for advertising, or for any purpose other than running your agent for you.

Connected accounts

If you connect a third-party account (a calendar, a mailbox, a CRM), we store the access and refresh tokens that authorise your agent to act there. These are bearer credentials, so they are encrypted with AES-256-GCM before they are stored. You can revoke a connection at any time from your dashboard, and revoking it deletes the stored tokens.

Technical metadata

We collect standard server logs — IP address, user-agent, request timestamps — for security and reliability purposes.

We do not run third-party analytics, advertising, or tracking scripts on this website. There is no analytics tag, no advertising pixel, and no cross-site tracker on wrasse.ai. We do not set cookies for advertising or profiling; the only cookies the Service sets are the ones required to keep you signed in.

Links from this website to sign up carry a short tag naming where you clicked, such as pricing:plan, or the campaign tag you arrived with. If the link creates your account, we store that tag on it, to count which pages lead to sign-ups. A campaign tag is kept in your browser tab for the visit, and no tag goes to anyone but us.

The one exception is the bot check on our free tools that write with AI, such as the listing description generator, and on the Closer Pilot Partners application forms. On those pages only, Cloudflare Turnstile checks that a person rather than a script is using the page, and reads signals from your browser to do it. It loads only once you start using the form. It is not used for advertising or to follow you across sites. What you type into the free tools is sent to our model provider to write the result and is not stored; we keep only a count of how many times each tool was used.

2. Text messaging

If you connect a phone number to your Wrasse account, we collect that number and the content of messages exchanged between you and your assistant, so that the assistant can reply to you and deliver reminders you have asked for.

We do not share or sell your mobile opt-in information, phone number, or messaging consent to any third party. Message content is processed by the messaging provider we use to deliver messages, and by the model provider that generates your assistant's replies, solely to provide the service to you. No mobile information is shared with third parties or affiliates for marketing or promotional purposes.

Connecting a number is always something you start: you request a pairing code while signed in, then text that code from your own handset. We never add a number you did not send us a message from.

You can disconnect a number at any time by replying STOP to any message, or from the Channels page in your account. Reply HELP for assistance, or see the SMS help page. Message and data rates may apply. Message frequency depends on your own use.

3. Google user data

If you connect your Google account, you let your agent work in your Gmail, Google Calendar, Google Drive and Google Sheets for you. This section says what we access, what we do with it, and what we never do with it.

What we access, and why

Your Google email address — to show you which account is connected, so you can check it's the right one and disconnect it, and to tell which mailbox is yours when we read your Gmail as described below.
Gmail — when you ask, or in a task you have scheduled such as a morning briefing or following up on unanswered mail, your agent searches and reads your messages, and sends the replies you ask it to send or the ones that task is set up to send. If you put the label "Wrasse" on a message, we check for unread messages with that label about every 30 seconds, pass each one to your agent, and mark it read so it isn't handled twice. Your agent does not delete mail or change your Gmail settings.
Gmail, for your CRM — while you have a paid plan, and unless you turn it off on the CRM page, we check your mailbox about every 5 minutes, going back over up to the last 14 days when it starts, when you turn it back on, or when it has fallen too far behind. To find mail to and from people who are already your contacts, we read the sender, recipients, subject and Gmail's short preview of each new message, received and sent. We keep that only for messages with a contact, on that contact's timeline, and leave out the subject and preview if your CRM is set to keep only who and when. We never fetch the body for this, and we skip newsletters and other bulk mail.
Google Calendar — your agent reads your calendars to tell you what's coming up and to find free time, and adds the events you ask it to book. If you publish a booking page, we read your calendars to leave out times you're busy, add each booking to your calendar, and move or remove that event when the booking is rescheduled or cancelled. People booking with you see only your open times, never your events.
Google Drive — your agent reads the files you ask it to read, looking a file up by its name when you don't give it a link, and saves documents it makes for you, such as a quote, to your Drive.
Google Sheets — if you connect a spreadsheet to record orders, your agent adds a row to that spreadsheet for each order. It does not open your other spreadsheets.

How it's kept

Your Google access and refresh tokens are encrypted with AES-256-GCM before they are stored. What your agent reads from Google, such as an email, an event or the text of a file, becomes part of your conversation with it, so it is kept with your conversation history, and it can end up anywhere your agent puts what it learns: its memory, a note, task or reminder, a draft it holds for your approval, a quote, invoice or other document it makes for you. Emails that reach your agent through the "Wrasse" label are also kept in your chat transcript, and the CRM keeps what it adds to your contacts' timelines. Each of these is kept and erased as §8 sets out for that kind of record, or for your account data where §8 doesn't name it; the audit log keeps digests of what your agent read and sent, not the content.

Who it's shared with

Google data goes only where it has to for your agent to work:

to the AI model providers in §5 that generate your agent's replies. A model provider is listed there, and on our subprocessors page, before it receives any;
to the channel you connected for your agent to reply to you on (or email, through our email delivery provider in §5), and to the push notification services in §5 when the Wrasse app shows you a preview of a reply or asks for your approval;
to the people and services you tell your agent to send something to, such as the recipient of an email you ask it to send, or a CRM or Slack workspace you ask it to log something in, and to a teammate you let answer your agent's approval requests for you;
to the web search providers in §5, which receive the search terms your agent writes when it searches the web for you;
to the hosting and storage providers in §5 that run your agent and store your account and files.

We do not sell Google data, use it for advertising, or use it to train AI models, ours or anyone else's. We do not share it with anyone else unless the law requires us to.

No one at Wrasse reads your Google data unless you ask us to, for example to help with a support request about a particular message; it is needed to investigate a security issue or abuse; or the law requires it.

Wrasse's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your control

You can disconnect Google from your dashboard at any time. We delete the stored tokens and ask Google to revoke our access. To be sure it is gone, check your Google Account permissions, where you can also remove Wrasse yourself. Disconnecting doesn't delete what your agent has already read; that is erased as §8 sets out, for most of it after you close your account.

4. How we use information

To operate your agent and the Service.
To process payments through our payment processor.
To send transactional communications — account notifications, security alerts, and audit-log exports you request.
To detect and respond to security incidents and abuse.
To meter usage against the plan you are on.
To improve the Service in aggregate, anonymised form.

We do not use your data to train AI models. We do not sell or share your personal data with third parties for advertising. We do not aggregate your conversation content with other users' content for any reason. We do not sell personal information as that term is defined under the California Consumer Privacy Act, and we have not done so in the preceding twelve months.

Legal bases (UK/EEA)

Where UK or EU data protection law applies, we rely on: performance of a contract for running your agent and billing you; legitimate interests for security, abuse prevention and service reliability; consent for connecting a phone number or a third-party account, which you can withdraw at any time; and legal obligation where we must retain or disclose data by law.

5. Service providers

The Service relies on the third parties below. We require each to be bound by a data processing agreement consistent with applicable data protection law, and each receives only the data needed for its function.

Anthropic — large language model inference. Subject to Anthropic's commercial terms; data is not retained for training under our commercial agreement.
Stripe — payment processing. Card details go to Stripe directly and are not stored by us.
Fly.io — hosting for your agent's container.
A cloud infrastructure provider — hosting for the control plane and its databases (your account, conversations, connected-account tokens and audit log). Named on request.
Cloudflare (R2) — object storage for audit and compliance exports you request, documents your agent generates, and files you upload to a chat.
DigitalOcean — static hosting for this marketing website.
MessagePipe (MangoZest Labs) — transactional email delivery, including your agent's replies when you talk to it by email, which in turn dispatches through underlying email providers.
Apple Push Notification service and Firebase Cloud Messaging — delivering notifications to the Wrasse mobile app, including a short preview of your agent's reply or of the question an approval asks.
Honeycomb — application telemetry. Operational metadata only; no message content or agent output is sent.
Web search providers — Tavily or Brave, depending on the deployment: the search terms your agent writes when it searches the web for you.
Channel providers — where you connect a channel, and only that one: Telegram, Meta (WhatsApp), Slack, or your SMS/RCS provider.

We do not currently use a third-party error-monitoring or product-analytics service, and we do not use a third-party authentication provider — sign-in links are issued and verified by Wrasse itself. Application errors are captured in our own server logs, described in §1 and retained per §8.

One exception to the agreements above: when the web search providers can't answer, your agent falls back to DuckDuckGo's public search page. DuckDuckGo receives the search terms, without any agreement with us.

The current list, with each provider's purpose and processing location, is maintained at wrasse.ai/subprocessors. We will give notice there before adding a subprocessor that processes customer content.

6. International data transfers and residency

Wrasse runs your agent in one of two regions: US East (Virginia) or London (United Kingdom). At signup we route you to a region based on your locale signal, and your agent's container is then pinned to that region — it does not move between regions on its own, and reprovisioning reuses the region already stored for you.

Your account data — your profile, conversations, connected-account tokens and audit log — is held by the control plane in a single region, which may not be your agent's region, and files in object storage are held in a single location for all accounts. Where personal data is transferred out of the UK or EEA as a result, we rely on Standard Contractual Clauses and the UK Addendum. Write to security@wrasse.ai for where your data is held.

7. Your rights

Depending on your jurisdiction, you may have the following rights:

Access — request a copy of your data. You can export your activity record from your dashboard; write to us for the rest.
Correction — correct inaccurate data.
Deletion — delete your account and associated data. Your agent stops immediately; the data is erased 30 days later, apart from what §8 says we keep or haven't yet erased, and you can cancel at any point before that.
Portability — receive your data in a machine-readable format.
Objection and restriction — object to, or ask us to restrict, certain processing.
Withdraw consent — for any processing based on consent, without affecting processing already carried out.
Non-discrimination — we will not degrade the Service because you exercised a right.

Exercise any of these by writing to security@wrasse.ai. We respond within 30 days and may need to verify your identity first. You may also authorise an agent to make a request on your behalf. If you are in the UK or EEA you have the right to complain to your supervisory authority; we would appreciate the chance to resolve it first.

8. Data retention

Account data — retained while your account is active.
Conversations, your chat transcript and memory items — retained while your account is open, and erased after you close it.
CRM contacts and their timelines — including what the CRM adds from your Gmail, kept while your account is open, and erased after you close it.
Approval requests — what a held action asked you, kept while your account is open, and erased after you close it.
Files you upload in chat, and documents your agent generates — not yet erased automatically when you close your account. We are fixing that; until then, ask us and we delete them by hand.
Audit records — each recorded action (what ran, when, the decision, and digests of its inputs and outputs) is retained for 90 days. The job that deletes older records is not yet automatic everywhere the audit log is stored, so some may be held longer until it is; we are fixing that. A copy of the audit log in our reporting database is not yet deleted on that schedule, or automatically when you close your account; until it is, ask us and we delete it by hand. We are fixing that.
Server and security logs — 90 days.
Billing records — retained as long as tax and accounting law requires, independent of account closure.

Closing your account stops your agent straight away — we cancel your subscription, unpair your channels and revoke any connected accounts at once — and then waits 30 days before erasing anything. Cancel within those 30 days and your data is still here; your subscription and channels are not, and you would set them up again. Backups age out on their own cycle and are not restored selectively.

9. Security

Every user's agent runs in its own container, on its own virtual machine, and every tool call it makes is checked against your policy before it executes. Connected-account tokens and other secrets are encrypted with AES-256-GCM, and the keys the model providers are called with never enter your container at all.

The full picture — isolation, credential custody, the audit plane, our certification roadmap and how to report a vulnerability — is on the security page.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has provided us with information, write to security@wrasse.ai and we will delete it.

11. Changes to this policy

We may update this Privacy Policy. Material changes will be communicated by email to active users at least 30 days before they take effect, and the "Last updated" date above will change. Continued use after the effective date constitutes acceptance.

12. Contact

Privacy questions, requests, or complaints: security@wrasse.ai. Wrasse Technologies Inc. is the data controller for the personal data described in this policy.