Last updated 30 October 2026
Privacy policy
This policy explains what information WrightDesk (“we”, “us”) collects when you use the WrightDesk service at wrightdesk.com and app.wrightdesk.com (the “Service”), how we use it, and the choices you have. WrightDesk is operated by the operator of WrightDesk, whose legal name and registered address we disclose on request (write to compliance@wrightdesk.com).
Information we collect
Account information. When you create an account we store your name, email address, a hashed password (if you sign in with a password), and, if you enable two-factor authentication, the secret needed to verify your codes. If you sign in with Google, Microsoft or GitHub, we receive your name, email address and profile picture from that provider.
Billing information. If you subscribe to a paid plan, we store the billing details you give us (the name to invoice, address, state, optional GST number and billing email), the plan, the status and dates of your subscription, and a record of each payment (amount, date, the payment and subscription ids that Razorpay returns, and the invoice we issue). Your card, UPI or bank details are entered on Razorpay’s checkout and are processed by Razorpay; we never see or store them.
Content you create. Pages, collections, forms, form responses, comments, uploaded files (images, diagrams, documents) and Agent Mode conversations are stored so that the Service can show them back to you and the people you share them with.
Usage and technical information. Our servers keep standard logs (IP address, browser type, the pages requested and when) for security and troubleshooting. We use cookies for signing in, for security tokens, and to remember small preferences such as the workspace you last opened and your theme.
Analytics and cookies on the public website. On wrightdesk.com, docs.wrightdesk.com and support.wrightdesk.com we use Google Analytics to understand how the public website, the help site and the support form are used (we do not send it what you type into a form, and a form embedded in another site does not use it). It runs only if you accept it in the cookie banner; until then nothing from Google is loaded and no analytics cookies are set. If you accept, Google Analytics sets its own cookies (_ga and _ga_…) and receives your page views, the pages you came from, and technical details such as your browser and approximate location, never your name or email address. You can change your mind at any time with Cookie settings in the footer, which also removes the cookies it set; a browser that sends the Global Privacy Control signal is treated as declining. WrightDesk application itself (app.wrightdesk.com) does not use Google Analytics. We may also use Cloudflare Web Analytics, which does not use cookies or track individuals across sites.
Information from forms. When someone submits a form published through the Service, the responses belong to the workspace that owns the form. If you submit a form, the workspace owner decides how that information is used; this policy covers our role in storing and delivering it.
How we use information
- To provide the Service: sign you in, bill you for a paid plan and issue invoices, store and display your content, deliver form responses and notifications, and send emails you have asked for (invites, password resets, form notifications, budget alerts).
- To operate Agent Mode: when you send a message, the text of that message, the relevant parts of your workspace, and any files or images you attach are sent to the AI model provider configured for the Service so that it can respond. Those providers process the content to generate the reply. See “Third-party providers” below.
- To keep the Service secure: detect abuse, enforce rate limits, and investigate incidents.
- To improve the Service: aggregate, non-identifying usage statistics.
We do not sell your information, and we do not use your content for advertising.
Who we share information with
We share information only with providers that help us run the Service, and only to the extent needed:
- Hosting, database and storage. The application, its database and uploaded files run on cloud infrastructure providers, currently Railway and its storage buckets. Amazon Web Services and DigitalOcean are planned infrastructure providers for upcoming managed services and may be used for them. Data may be stored in regions outside India, including Singapore and the United States.
- Payments. When you subscribe to a paid plan, payments are processed by Razorpay, which receives your billing details and payment instrument, tells us whether the payment succeeded, and sends us signed notifications about your subscription.
- Email delivery. Transactional email is sent through Zoho ZeptoMail.
- AI models. Agent Mode requests are sent through OpenRouter, which routes them to the underlying model providers, to be processed by the model that answers.
- Web search. Agent Mode’s web search runs through a search service operated by us; queries are not sent to advertising networks.
- Network and analytics. Cloudflare provides DNS, proxying and, where enabled, web analytics.
We may also disclose information if required by law, or to protect the rights, safety or property of our users, the public or ourselves.
Third-party providers
We rely on independent companies to run parts of the Service. They process data on their own systems under their own terms, security practices and privacy policies, which we do not control. You can review how each one describes its security and compliance at its trust center:
| Provider | What it does for the Service | Trust center |
|---|---|---|
| OpenRouter | AI gateway: receives Agent Mode requests (your message, the workspace content and attachments needed to answer it) and routes them to the underlying AI model providers | trust.openrouter.ai |
| Railway | Application hosting, database and file storage | trust.railway.com |
| Razorpay | Payment processing for paid plans: collects and processes your payment details and billing information at checkout and notifies us of the result | razorpay.com/privacy |
| Amazon Web Services | Planned cloud infrastructure and storage for upcoming managed services | aws.amazon.com/compliance |
| DigitalOcean | Planned cloud infrastructure for upcoming managed services | digitalocean.com/trust |
Content you send to Agent Mode leaves our systems and is handled by OpenRouter and by the AI model provider that answers the request. We select providers carefully and prefer ones whose terms do not permit training on your data, but each provider’s handling of data, including its retention, location and security, is governed by that provider’s own terms and policies. To the fullest extent permitted by law, we are not responsible for what these third parties do with data once it is in their systems. Do not send content to Agent Mode that you are not willing to have processed in this way.
Sharing you control
Pages and collections are private to their creator until they are shared with a workspace, published to a link, or published on a custom domain. Anything you publish is public and may be cached or indexed by third parties. Form responses are visible to members of the workspace that owns the form, and are sent to any notification email or webhook that workspace has configured.
If you connect an MCP client such as claude.ai to a workspace, that client can read and write the workspace’s content under your account, as far as your role allows, until you revoke its token in Settings.
Retention
Your content is kept for as long as your account or workspace exists. Deleted pages go to the trash and can be restored; permanently deleted content is removed from our database, though copies may persist in backups for up to 30 days. Agent Mode conversations are kept until you delete them. Server logs are kept for up to 90 days.
When a workspace or account is deleted, its content is deleted with it, subject to the same backup window.
Security
We use HTTPS everywhere, store passwords hashed, encrypt stored secrets such as API keys, support two-factor authentication, and sign webhook deliveries so recipients can verify them. No system is perfectly secure; if you believe your account has been compromised, contact us immediately at support@wrightdesk.com.
Your rights
You can view and edit your profile, change your email or password, and export your content (Markdown, HTML, CSV) from within the Service. You can delete pages, forms, conversations, workspaces you own, and your account. To exercise any right you cannot exercise in the Service, including access, correction, deletion or a copy of your data, email compliance@wrightdesk.com and we will respond within 30 days.
If you are in a jurisdiction with specific data-protection laws (including the Digital Personal Data Protection Act in India, or the GDPR), you may have additional rights, and we will honour them as they apply.
Children
The Service is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has provided us information, contact us and we will delete it.
Changes
We will post any changes to this policy on this page and update the date above. Material changes will also be announced in the Service.
Contact
WrightDesk. The legal name and registered address of the operator are disclosed on request. Email: compliance@wrightdesk.com for privacy and data requests and for the operator’s details, support@wrightdesk.com for account help, hello@wrightdesk.com for everything else.