Intra Privacy Policy

Intra is a product and brand operated by wrrk LLC (wrrk, we, us, or our). This Privacy Policy explains how we collect, use, disclose, and retain personal information through gointra.ai and the Intra service (collectively, the Service).

1. Our role

We act in two different capacities:

• For account, billing, website, sales, and business-contact information, wrrk generally determines why and how the information is processed.
• For helpdesk messages, customer records, order information, and other data a business customer connects to or submits to Intra (Customer Data), the business customer generally determines why and how that data is processed. wrrk processes it on that customer's instructions to provide the Service.

If you are an individual who communicated with one of our business customers, please direct requests concerning that communication or customer record to the business you interacted with. We will assist our customer in responding when required.

2. Information we collect

Depending on how you interact with Intra, we may collect:

Account and business information

• name, business email address, organization, role, and account permissions;
• login, session, multifactor-authentication, and security information;
• brand name, domain, products, policies, instructions, and account settings;
• invoices, payment status, purchased plan, and usage measurements; and
• communications with our sales, support, or operations teams.

Customer Data and content

At a customer's direction, the Service may process:

• helpdesk tickets, messages, attachments, notes, tags, and ticket history;
• customer names, email addresses, order references, shipping information, subscription information, and other details contained in support records;
• product catalogs, policies, standard operating procedures, uploaded documents, brand voice guidance, and approved answers;
• prompts, instructions, corrections, evaluations, and AI-generated drafts; and
• information retrieved from or written to a connected third-party service.

Our public agent endpoint is designed to receive product questions and non-identifying shopping context. Users and agents are instructed not to send names, contact information, addresses, payment data, account credentials, or other personal information through that endpoint.

Integration information

When a customer connects a third-party service, we may collect account identifiers, connection settings, encrypted credentials or tokens, webhook information, and the data the customer authorizes Intra to access. Connected services may include helpdesks, ecommerce systems, subscription platforms, order-management systems, fulfillment providers, and document or spreadsheet services.

Usage and technical information

We may collect IP address, browser and device information, timestamps, requested pages, feature interactions, session activity, error reports, performance data, and security or audit logs.

Cookies and local storage

The authenticated Service uses cookies that are necessary to sign users in, maintain sessions, prevent abuse, and protect accounts. The application may use browser local or session storage for interface preferences and unsent draft work. Necessary authentication cookies cannot be disabled through a cookie preference tool, but users can remove them using browser controls or by signing out.

The Intra marketing site does not currently use third-party advertising cookies. If we introduce non-essential analytics or advertising cookies, we will update this Policy and provide any consent or opt-out controls required by law.

Demo booking and third-party pages

Our website may link to a third-party scheduling service to book a demo. The information submitted on that service is governed by its privacy policy. Other third-party sites and connected services are likewise governed by their own privacy practices.

3. How we use information

We use personal information to:

• provide, configure, maintain, and support the Service;
• authenticate users and administer organizations, permissions, and accounts;
• retrieve, organize, analyze, and generate answers from authorized business content;
• create AI-assisted drafts, classifications, recommendations, evaluations, and reports;
• operate integrations and perform actions a customer authorizes;
• send login codes, invitations, service messages, and support communications;
• measure usage, prepare invoices, and administer subscriptions;
• secure the Service, prevent abuse, investigate incidents, and enforce our agreements;
• diagnose errors and improve reliability, safety, and product functionality;
• comply with law and protect the rights, safety, and property of wrrk, our customers, users, and others; and
• create aggregated or de-identified analytics that do not identify an individual or customer.

We do not use Customer Data to train or fine-tune models made available to other customers or third parties without the customer's prior written permission. We do not attempt to re-identify information we maintain as de-identified.

4. AI processing

To provide AI features, we may send relevant portions of authorized content to commercial AI and machine-learning service providers. Depending on the feature and configuration, these providers may include Anthropic, OpenAI, and TypeSafe AI.

We use commercial API offerings and do not knowingly opt Customer Data into general model training. Providers may retain information for limited periods for service delivery, security, abuse prevention, or legal compliance under their business terms. We limit the information sent to what we reasonably need for the requested feature.

5. How we disclose information

We may disclose personal information to:

• Service providers that host infrastructure, store data, provide AI processing, send email, monitor errors, secure systems, or otherwise help us operate the Service.
• Connected services when a customer asks Intra to retrieve information or perform an authorized action through an integration.
• The customer that controls the account, including its administrators and authorized users.
• Professional advisers, such as lawyers, accountants, auditors, insurers, and security consultants, when reasonably necessary.
• Government authorities or other parties when required by law or when reasonably necessary to protect rights, safety, property, or the integrity of the Service.
• A successor or transaction participant in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of all or part of our business, subject to appropriate confidentiality protections.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising or process it for targeted advertising.

We may publish or disclose aggregated or de-identified information that cannot reasonably be used to identify an individual or customer.

6. Retention

We retain information for as long as reasonably necessary to provide the Service, maintain security and audit records, comply with legal obligations, resolve disputes, and enforce agreements.

Retention varies by data type and customer configuration:

• Account and business records are generally retained while the account is active and afterward as needed for legal, tax, audit, and dispute purposes.
• Customer Data is generally retained for the customer relationship and then handled under the applicable Order, data processing addendum, deletion request, and our backup practices.
• Customers may request an export of available Customer Data for 30 days after termination takes effect.
• Security and integration-access audit records may be retained for up to 400 days, or longer when needed to investigate abuse or comply with law.
• Backups are deleted or overwritten on their ordinary schedule.
• De-identified information may be retained for longer, provided we maintain it in de-identified form.

Disconnecting an integration stops new routine collection from that integration but does not automatically delete information previously obtained through it. A customer may contact us to request deletion, subject to legal, security, contractual, and technical limitations.

7. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information. These include access controls, encrypted credentials, secure session cookies, multifactor-authentication support, logging controls, and measures intended to reduce personal information in error reports.

No system is completely secure. Customers and users are responsible for protecting their credentials and promptly reporting suspected unauthorized access.

8. Privacy rights and requests

Depending on where you live and subject to applicable exceptions, you may have the right to:

• confirm whether we process your personal information;
• access or obtain a portable copy of it;
• correct inaccurate information;
• request deletion;
• opt out of targeted advertising, the sale of personal information, or certain profiling; and
• appeal a decision we make concerning a privacy request.

Intra does not currently sell personal information or use it for targeted advertising.

To submit a request or appeal, email privacy@getwrrk.com with the subject line Intra privacy request. Describe your request and the email address or account involved. We may need to verify your identity and authority before acting. An authorized agent may submit a request where applicable, but we may require proof of authorization.

We will respond within the time required by applicable law. We will not discriminate against you for exercising a privacy right.

If the information is Customer Data controlled by one of our business customers, we may refer your request to that customer and assist it as required.

9. Children

The Service is intended for businesses and is not directed to children under 13. We do not knowingly collect personal information directly from children under 13. If you believe a child has provided personal information to us, contact privacy@getwrrk.com.

10. Processing in the United States

wrrk and many of our service providers operate in the United States. If you access the Service from another country, your information may be transferred to and processed in the United States and other countries where applicable service providers operate. Where required, we use contractual or other lawful transfer mechanisms.

11. Changes to this Policy

We may update this Privacy Policy as our practices or legal obligations change. We will post the updated version with a new effective date and provide additional notice when required by law.

12. Contact

wrrk LLC
Intra
Privacy requests: privacy@getwrrk.com
General questions: hello@getwrrk.com