Privacy Notice

1. What we collect

To register you, sign you in, authorize machines, meter subscriptions and usage, control risk and support you, we process the following, only as far as running the service requires. Exact fields are whatever the product actually collects:

• Account: email, password hash, display name, role, registration time, invitation and referral relationships, session state.
• Google sign-in, only if you choose Continue with Google: the email address, whether Google has verified it, your name, a link to your profile picture and your Google account ID. We ask Google for nothing else (no contacts, mail, files or calendar) and use this only to create your seat and sign you in, never for advertising.
• Devices and sign-ins: machine name, device identifier, sign-in IP, last seen, client and system information, authorization and revocation state.
• Subscriptions and orders: plan, price, payment method and order status, term, usage progress, redemption and discount information, plus anything you supply for a receipt.
• Request metadata and usage: time, status, model, duration, allowance consumed, which machine it came from, error information and the technical fields needed to debug.
• Support: what you send us by email; messages in the chat on this site, which runs on our own chat server at chat.wilco.run, with the name and email you give there; tickets you open in the console and the files you attach; and our replies. Chat messages may be read and answered first by our AI assistant: to draft a reply, the text of the chat conversation is sent to an AI model provider. Before sending we remove the email addresses and long numbers we can detect, we never send attachments, and we do not send messages that look like passwords, keys or card numbers. Anything the assistant cannot settle goes to a person.
• Stored in your browser: your sign-in session, a referral or promo code from a link you followed, and small interface settings (in this site's local storage), your language choice (a wilco_lang cookie), a chat session cookie if you use the chat, and the note described next. None of these are advertising cookies.
• How you found us: this browser keeps a small note of your first visit, of the latest visit that came from a campaign link, a Google ad or another website, and of up to five recent Google ad clicks. The note holds the page you landed on, the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), a Google Ads click identifier if there was one (gclid, gbraid or wbraid) with the campaign details Google adds to its ad links (gad_source, gad_campaignid), and the name of the referring website, never its full address. Each part stays in your browser for 90 days. Once you sign in, it is saved to your account. We use no advertising cookies and load no third-party tracking scripts.

2. Your code and prompts

• The service authenticates, schedules and forwards requests. What the console shows by default is metadata: usage, status, model, duration.
• To keep things stable, investigate incidents, control abuse and settle billing disputes, the system may retain necessary technical and diagnostic logs. Access is controlled and limited to those purposes.
• We do not use your source code, prompts, conversations or generated content for model training, marketing profiles, or any content analysis unrelated to running this service.
• We will not ask you for production keys, private repository credentials or other sensitive material that is not needed to debug your issue. If you send something like that to support yourself, redact it first.

3. Why we process it

• Creating and maintaining your account: sign-in, verification, machine authorization, session management.
• Activating, renewing, upgrading, pausing or ending plans, and accounting for allowance, orders and receipts.
• Account scheduling, machine limits, usage display, anomaly alerts and service quality.
• Security auditing, anti-abuse, risk control, handling violations and disputes.
• Answering support email and reasonable after-sales questions.
• Understanding which channels (search, other websites, campaign links, ads) bring people to Wilco, so we know where to spend on marketing. This uses the note described under How you found us, per account, and nothing about what you do inside the service.
• Where the law requires it, or where it is necessary to protect the service, our users or a third party's legitimate rights.

Where the GDPR or a similar law applies, we rely on: performing our contract with you (account, plans, usage, support); our legitimate interests (security, fraud prevention, service quality, and understanding which channels bring visitors); legal obligations (tax and accounting records); and your consent where we ask for it.

4. Who else processes it

We do not sell your personal information. To run the service, some information is handled by necessary providers and infrastructure:

• Payment providers, to take payment and reconcile it
• Email and notification services, for verification codes and notices
• Google, when you choose to sign in with your Google account
• Hosting, databases, object storage, logging and monitoring
• Google Fonts: our pages load their typefaces from Google, so your browser sends your IP address and browser details to Google when it fetches them
• The upstream providers of the models your requests reach (Claude, GPT and Grok models), and the infrastructure that connects to them
• An AI model provider for the support chat (currently a Grok model, reached through our model gateway), which receives the text of chat conversations so our AI assistant can draft replies; detectable email addresses and long numbers are removed first, and attachments are never sent
• Google, only if we run ads there: to credit an ad for a purchase, we may send the ad click identifier from the note above together with the time and amount of that purchase and an order reference, and later a correction if that purchase is refunded. No email address, name or content is sent.

Each processes only what its function requires. The model providers process your requests under their own data policies. The chat server is ours and is not shared with a third-party chat service; only the text needed to draft an AI reply leaves it, as described above.

Where a provider operates in a different country, information necessary to that function is processed there, including in the United States. Where the law requires safeguards for such transfers, we rely on the transfer mechanisms our providers offer, such as standard contractual clauses.

5. Retention and security

• Information is kept only as long as the purposes in this notice require. Where law, audit, tax, accounting, dispute resolution or security demands longer, that governs.
• The note of how you found us is kept while your account exists and is deleted with it.
• Chat and ticket history is kept while your account exists, or until you ask us to delete it, unless we need it for an open dispute.
• Our web servers keep standard access logs, which include IP addresses, for a limited period for security and debugging. A separate log we use to count page visits holds no IP addresses; after 30 days only daily totals remain.
• Order and payment records are kept as long as tax and accounting rules require.
• Passwords are stored hashed. Device credentials, sessions and key material are protected with access control and least privilege.
• No internet transmission or running system can be guaranteed absolutely secure. If your account or a machine looks wrong: change your password under Settings in the console (or use Forgot password on the sign-in page), use Sign out everywhere, remove the machine, and open a ticket so we can reset your access key. Write to us from the email on your account; we verify who you are before changing anything.

6. Your choices

In the console you can see and manage part of your profile, your machines, orders, subscriptions and usage directly.

You can remove the note of how you found us from this browser at any time by clearing this site's data; to have the copy saved to your account deleted, email support.

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to restrict or object to how we process it, and to withdraw consent you gave. You can also complain to your local data protection authority.

To use any of these rights, or to make another reasonable request about how your information is handled, email support; we reply within 30 days. We act on it after verifying who you are, to the extent it does not conflict with legal obligations, billing audit, security and risk control, or an open dispute.

7. Minors

The service is intended for developers, teams and organizations able to enter into a contract. It is not directed at children. If you are below the age of majority where you live, use it only with the consent and supervision of a parent or guardian.

8. Updates and contact

We may update this notice as the product, the law or the service changes. An updated version takes effect when published; continuing to register, sign in, buy or use the service means you are aware of it. We will try to flag material changes through the site or the console.

• Site: wilco.run
• Email: support@wilco.run
• Terms of service: /terms

This notice and the terms of service together form part of the agreement. Where the two say different things about the same subject, the reading that better protects your lawful interests and does not breach mandatory law prevails, unless a specific clause says otherwise.