GDPR at Wellence

Wellence Ltd, a company registered in England and Wales (company number 15287383), 167-169 Great Portland Street, 5th Floor, London W1W 5PF. We're registered with the UK Information Commissioner's Office (registration ZC084891). Data protection contact: legal@wellence.me.

Your company is the controller of the personal data it puts into Wellence: its people, teams, goals, tasks, messages, files and what its agents produce. Wellence is the processor: we process it only to run the service, on your instructions, under our Data Processing Agreement.

Wellence is the controller for a small amount of data we use to run our own business: website visits, early-access requests, sales conversations, billing and support. Our Privacy Policy covers that.

• Account details: name, work email, role and team.
• The work your company puts in: goals, tasks, messages, files and workflows.
• What agents produce, and the ratings and feedback people give.
• Usage and cost records, answers to the AI diagnostic, and Get help conversations.

Product analytics hold no names, emails or content, only an internal id, and respect Global Privacy Control and Do Not Track.

Agents, the agent builder and Get help run on Anthropic's Claude, through Anthropic's API. To do their work, agents receive the context your company has set up and the task in hand, which can include people's names and work content. Anthropic doesn't use data sent through its API to train its models.

No decision with legal or similarly significant effects is made about anyone by AI alone: agents ask a named person before anything is sent, posted or changed, and every agent has an owner accountable for its work.

We tell customers at least 30 days before adding or replacing a subprocessor, so they can object.

Where data goes outside the UK or the EEA (for example to the United States), the transfer is covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, or by the UK and EU adequacy decisions for the EU-US Data Privacy Framework where the provider is certified.

People have the right to access, correct, delete, restrict, object to and port their personal data.

• Companies: an admin can download everything the company has in Wellence, or delete the company and all its data, from Settings at any time. Deletion is immediate and can't be undone.
• People at a customer: your company is the controller, so ask its admin first. You can also ask us in the app's Get help, or email legal@wellence.me, and we'll work with your company to respond, within one month.
• You can complain to the UK Information Commissioner's Office at ico.org.uk, or your local data protection authority in the EU.

Each company's data is kept separate; people see their own team and what's shared with them; sign-in is by single-use, expiring email links with no passwords; files are private and opened through short-lived links; a company's own Anthropic key is stored encrypted. More on our security page.

If a personal data breach affects your data, we tell you without undue delay, and within 72 hours of becoming aware of it, with what we know and what we're doing about it.

Your company's data is kept while its account is active. It's deleted straight away when an admin deletes the company, and within 30 days of a contract ending unless the law requires otherwise. Backups roll off on our database provider's schedule.

Our Data Processing Agreement sets out these commitments as contract terms (UK GDPR and EU GDPR Article 28). For a countersigned copy, email legal@wellence.me.