Privacy Policy

1. Two roles, one policy

Wakefield handles two kinds of personal data differently, and this policy is written in two matching parts. For your own Business account data (§2), Wakefield is the controller — we decide why and how it's processed. For data about your customers, generated when they message a business using Wakefield (§3), Wakefield is a processor acting on that business's instructions — the business itself is the controller and is responsible for its own lawful basis and notices to its customers.

2. Business account data

When you create a Wakefield account, we collect: your name and email, a hashed password (never stored in plain text), your business profile (name, type, description, tone, delivery and payment policies you provide), team member accounts and roles, billing and credit-usage history, and — for any third-party service you connect — the access credentials needed to operate it, stored encrypted, never in plain text.

3. Data processed on a business's behalf

When a customer messages a business using Wakefield — over WhatsApp, Instagram, email, or the business's own channel — Wakefield processes that conversation to generate a reply and, where authorized, to check inventory, confirm a payment, or take another configured action. This includes the message content, the sender's channel identifier (e.g. phone number), and a running conversation history kept so the agent has context across turns. Wakefield also derives durable notes from a conversation (for example, a stated preference) so an agent can recall it later.

4. How data is used

Business account data (§2) is used to operate and bill for the Service, secure accounts, and improve the product. Data processed on a business's behalf (§3) is used only to operate the Service for that business — generating replies, executing the actions it has configured, and nothing else; it is not used to train models on Wakefield's behalf, sold, or shared across unrelated businesses.

5. Who we share it with

Operating Wakefield means real data reaches a small set of real sub-processors, each only for what they're built to do:

• AI model providers (Anthropic, and — where a business's account is configured to use them — other providers reached via OpenRouter) receive conversation content to generate a reply or a routing/summarization decision.
• Voyage AI receives short text to generate the embeddings that power an agent's memory search.
• Our payment processor receives what's needed to process a business's own Wakefield billing, and, separately, a business's own connected payment gateway (e.g. for reconciling its customers' payments) operates under that business's own agreement with that provider.
• Meta's WhatsApp Business Platform (and Instagram) carries messages for any business that connects that channel.
• Any other service a business explicitly connects (its own accounting, commerce, or logistics tools) exchanges only what that connection needs.

A full, current list of named sub-processors is available on request at usewakefields@gmail.com.

6. Google user data

If a business connects its Google account, Wakefield accesses only the following, and only to provide the features that business asks for:

• The email address of the connected account, shown so the business can see which account is linked.
• Google Sheets: the rows of spreadsheets the business points the assistant to, to read them or add a row.
• Google Calendar: upcoming events, to tell the business what is coming up, and creating events (and sending invitations) when the business asks.

Anything that changes something in the business's Google account, such as adding a row or creating an event, waits for the business's approval unless the business has chosen to let it run automatically. Google sign-in tokens are stored encrypted. Information read from Google is shown to the business in its own conversation with Wakefield and is sent to our AI model providers (§5) only to produce the answer the business asked for. It is not used for advertising, not sold, and not used to train AI models. Our staff do not read it unless the business asks for support, it is needed for security or abuse investigation, or the law requires it.

A business can disconnect Google at any time from Tools in the dashboard, or from its Google account's permissions page. Disconnecting deletes the stored sign-in tokens.

Wakefield's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Retention

Conversation history, agent activity, and billing/audit records are kept for as long as the account is active, to keep agents' context and a business's own history accurate. After account closure, we retain this data for up to twelve (12) months for legal and operational purposes, after which it is deleted or anonymized, unless a longer period is required by law. A business can request deletion of its own data sooner, as described in §10.

8. Security

Passwords are hashed, never stored or logged in plain text. Session tokens are stored as one-way hashes. Connected-service credentials are encrypted at rest (AES-256-GCM) and decrypted only when Wakefield needs to make an authorized call on a business's behalf. Access to production data is limited to what operating the Service requires.

9. International transfers

Wakefield's infrastructure is hosted on Railway, primarily on cloud servers located outside Nigeria. Where data is transferred outside Nigeria — including to our hosting provider and to AI model and embedding providers such as Anthropic and Voyage AI — Wakefield relies on those providers' own contractual and security safeguards to protect it to a standard consistent with the NDPR.

10. Your rights

Subject to applicable law (including Nigeria's NDPR), you can request access to, correction of, or deletion of your Business account data, and can export your data before closing your account. Contact us as described in §15 to exercise these rights.

11. Your customers' rights

Because Wakefield acts as a processor for data described in §3, a request from an end customer about their own data should go to the business they messaged, which is the controller of that data. Wakefield will support a business in fulfilling a valid request.

12. Cookies & local storage

The Wakefield dashboard stores your session token in your browser's local storage to keep you signed in, and may keep small, per-viewer preferences the same way. This isn't used for cross-site tracking or advertising.

This website uses Vercel Web Analytics to count visits and page views. It doesn't use cookies and doesn't track you across sites or build individual profiles.

13. Children

Wakefield is a business tool and isn't directed at children. We don't knowingly collect data from children through the Service.

14. Changes to this policy

We'll post updates here and give notice of a material change before it takes effect.

15. Contact

Privacy questions or data requests: email usewakefields@gmail.com.