Privacy Policy

Wocker is a business assistant, operated from Nigeria. In this policy “we”, “us” and “Wocker” mean the company that operates it, and “you” means the person using the service.

For most of the data described here we are a processor acting on your instructions — it is your business’s data and you decide what happens to it. For a few categories, named in section 4, we are the controller and the responsibility is ours. We say which is which throughout, because it changes who you go to about it.

Questions about anything here go to privacy@wocker.ai, which is a monitored mailbox.

When you sign up and use Wocker we collect:

• Account details — your name, email address, business name, what your business does, your country, working hours and timezone. Working hours matter because they bound when Wocker is allowed to contact you.
• What you tell Wocker — everything you type in chat, the context you give during setup, your priorities, your writing voice, and any files or images you upload.
• Business records you create — deals, proposals, tasks, invoices, payables, content drafts and calendar entries.
• Technical data — IP address, browser and device type, pages visited and actions taken, kept as logs so we can diagnose faults and detect abuse.
• Communications — messages you exchange with the Wocker team, and feedback you submit.

We never see your card details. Payments run through Stripe or Paystack, who collect and store card data directly. We receive only a token, the last four digits, the expiry, and whether a payment succeeded.

This is the part that deserves your attention, because it is data about people who have not signed up to Wocker themselves. When you use Wocker you may upload or enter:

• Your customers and contacts — names, email addresses, phone numbers, company, and the history of your dealings with them.
• Your team — staff names, roles, contact details, tasks and, where you record them, leave and performance notes.
• Job candidates — including CVs you upload, which typically contain employment history, education and contact details.

For all of this you are the controller and we are your processor. We handle it only to provide the service to you. You are responsible for having a lawful basis to hold it and for answering those people if they ask what you hold about them — and we will help you answer.

Contact details are held with appropriate technical safeguards, including encryption, and those safeguards are reviewed as the product changes.

Where Wocker supplies you with business prospects you did not provide, the position is different: for those records we are the controller, and the responsibility for how they were obtained is ours, not yours.

For every such record we keep the source and, where one exists, a link to it, so that:

• we can answer “where did you get my details?” with a specific answer;
• we can tell prospects who never asked to hear from anyone apart from enquiries that came to us; and
• we can delete a person from the source pool on request, not merely from one campaign.

Any outreach sent through Wocker on your behalf identifies your business, carries a working one-click unsubscribe, and stops permanently the moment someone asks it to — whether they use the unsubscribe link or simply reply asking us to stop.

If you are a prospect who has received something and wants it to stop or wants their data erased, email privacy@wocker.ai and we will action it across the whole system.

• To provide the service — drafting, scheduling, reminding, tracking and reporting.
• To learn your writing voice from the edits you make, so later drafts need fewer.
• To send you the Brief, notifications and reminders, bounded to your working hours.
• To take payment, manage your trial and subscription, and send billing notices.
• To provide support, and to investigate faults you or we notice.
• To keep the service secure and detect abuse.
• To meet legal and accounting obligations.

We do not sell personal data, and we do not use it for advertising. We do not use one customer’s business data to serve another customer.

Wocker uses AI to read, draft and summarise. In practice that means the content you give it — your messages, business context, and the records relevant to a task — is sent to our AI provider to generate a response.

• Our AI provider is Anthropic, processing data under their commercial terms.
• Your data is not used to train AI models. Anthropic does not train on data submitted through their API.
• Where document parsing is used — for example reading a CV — the file is fetched into memory over a short-lived signed link, and only a short extract is retained alongside the structured result.
• AI output is a draft. Nothing is sent to a customer, published, or committed on your behalf without your approval, unless you have explicitly opted into a class of automatic action.

Our team. Wocker is not only software. When you make a request that the product does not handle on its own, our staff read that request and do the work — which means a named person may see what you asked for and the business context attached to it. Staff also access accounts to investigate faults you report and to keep the service running.

That access is limited to the people who need it, logged, and covered by confidentiality obligations in their contracts. If you would rather our team did not see something, do not put it in a request.

Service providers. We use a small number, each bound by contract to process data only on our instructions. Where a service is not configured for your account, no data reaches it.

• Anthropic — AI processing of text and documents.
• Google Cloud Platform — hosting, database, and file storage.
• Resend — sending email on our behalf and on yours.
• Stripe and Paystack — payment processing.
• Pusher — real-time updates in the app.
• Inngest — scheduling and running background work.
• Twilio — WhatsApp messaging, where enabled for your account.
• Google — your calendar and a folder of your files, only if you connect your Google account. Section 8 says exactly what that gives us.

We publish changes to this list here. We do not add a processor that receives personal data without updating it.

You can connect a Google account in Settings so that Wocker can work with your calendar and a set of files. Nothing in this section happens unless you do. One connection covers both, and you are shown what you are granting before you grant it.

Your calendar. We read your events so a worker can tell you what is on and when you are genuinely free, and we create, move and cancel events when you ask for them. An event we create carries only what you told us to put in it. We invite other people to a meeting only when you give us their address for that meeting.

Your files. We ask for the narrowest access Google offers: we can only see and work with files that Wocker itself created, or that you deliberately open with it. The rest of your Drive is invisible to us. That is a limit Google enforces, not a promise we are asking you to take on trust.

What we do with it. We use it to do the thing you asked for, and for nothing else. We do not use it for advertising, we do not sell it, and it is not used to train any AI model — ours or anyone else’s. Our staff see it only in the narrow cases described in section 7.

Who we share it with. We do not share, transfer or disclose your Google user data (the events in your calendar and the Drive files you open or create with Wocker) to anyone, except in these cases. Our hosting and storage provider Google Cloud Platform stores it on our behalf, solely to run the service. Our AI provider Anthropic, whose Claude models power Ergon, processes it when Google data appears in your conversation — for example a document you ask a worker to read, or the events it lists back to you — so that it can generate the reply; Anthropic does not use it to train its models. We also act on it when you yourself direct us to, such as adding a guest you name to an event, and where the law requires it. We share it with no other third party, we do not sell it, and we do not use it for advertising.

Wocker’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

What we keep. The connection itself — an encrypted access token, the address of the Google account you connected, and the identifier of any event we created, so we can move or cancel it later. We do not store a copy of your calendar or your files. What does persist is what any conversation persists: if a worker reads a document to answer you, that answer sits in your chat history like any other message.

Stopping it. Disconnect in Settings, or revoke access at myaccount.google.com/permissions. Either one ends our access straight away. Events we already put in your calendar stay there and files already in your Drive stay yours — disconnecting is not us taking your things back.

Wocker is operated from Nigeria and our providers are largely in the United States and Europe, so your data is transferred internationally. Those transfers rely on standard contractual clauses or an equivalent safeguard in each provider’s terms.

• While your account is open — for as long as you use Wocker, because the product’s value is continuity.
• After you close it — we delete your organisation and its records in full. Deletion is deep rather than a flag: the records themselves are removed, not hidden.
• Backups — encrypted backups may hold data for a short period after deletion before they rotate out.
• Records we must keep — invoices and payment records are retained for the period tax law requires, even after account closure.

• Data is encrypted in transit, and sensitive fields are additionally encrypted at rest.
• Access is scoped by role. A team member cannot reach the owner’s pipeline, proposals, weekly summaries or private surfaces through any screen, link or API.
• Files are stored in a private bucket, served only through short-lived signed links, and scoped per organisation so a link cannot reach another customer’s files.
• Uploads are checked against an allow-list of file types and verified by content.
• Every action Wocker takes is logged with a timestamp, so it can be audited.

No system is perfectly secure. If a breach affects your personal data we will tell you and the relevant authority without undue delay.

Under Nigeria’s Data Protection Act and, where it applies to you, the UK and EU GDPR, you may ask us to:

• tell you what we hold about you and why;
• give you a copy in a portable format;
• correct anything inaccurate;
• delete it;
• restrict or object to how we use it; and
• withdraw consent where our use rests on consent.

Email privacy@wocker.ai. We respond within 30 days. There is no charge. If we hold the data as your processor rather than as controller, we will tell you who to ask instead.

You may also complain to a supervisory authority — in Nigeria, the NDPC.

We use cookies that are necessary for the service to work — keeping you signed in and keeping your session secure. We do not use advertising cookies, and we do not track you across other websites.

Wocker is a business tool and is not intended for anyone under 18. We do not knowingly collect data from children. If you believe we have, tell us and we will delete it.

When we change this policy we update the date at the top. If a change materially affects how we handle your data, we will tell you in the app or by email before it takes effect, rather than relying on you noticing.

Write to privacy@wocker.ai. That mailbox is read by a person, and it is the right place for a question about this policy, a request for a copy of your data, a complaint, or our registered company details.

See also our Terms of Service.