Privacy Policy

The Wolf Agency is a product of Red Wolf, Inc., a Delaware corporation ("we," "us," "our," or "The Wolf Agency"). We provide an AI-powered staffing platform that delivers a team of AI personas operating inside our customers' workplace tools.

Contact for privacy concerns: privacy@thewolf.agency

This Privacy Policy applies to:

• The thewolf.agency website
• The Wolf Agency application and platform
• Any integrations our customers connect (Google Workspace, Notion, Slack, GitHub, etc.)
• Communications sent by our AI personas to our customers and their authorized users

This policy describes how we collect, use, and share information when you use our services.

3.1 Information you provide directly

• Account information. When you sign up, we collect your name, email address, company name, and billing information. Billing is processed by Stripe; we do not store full payment card details on our systems.
• Configuration and content. Information you enter into the platform, including persona configurations, resource maps, scheduling preferences, and any context you provide to your AI personas.

3.2 Information from connected services (authorized by you)

When you connect a third-party service via OAuth, we access the data scopes you authorize. We never access data outside the scopes you grant. Specifically:

• Google Workspace. When you connect a Google account, we access only the scopes you authorize, which may include Google Calendar, Google Drive (read-only), and Gmail (read-only). The data accessed depends entirely on which persona's tools you enable and which scopes you grant during the OAuth flow.
• Notion. Workspace pages, databases, and content you authorize the integration to access.
• GitHub. Repository contents, issues, and pull requests within the repository you authorize.
• Slack. Messages and channel data within workspaces where our Slack app is installed, limited to channels and direct messages where our personas are participants.

3.3 Information generated by your use of the service

• Conversation history. Messages exchanged between you, your team members, and your AI personas via Slack, email, or other channels.
• Audit logs. Records of actions taken by personas on your behalf, including tool calls (such as calendar events created, documents read, or pages updated).
• Memory summaries. Daily summaries generated by personas to provide context across conversations. These summaries are scoped to your organization.
• Usage data. Standard application logs including token usage for AI calls, response times, and error rates.

3.4 Information we do not collect

• We do not collect biometric data.
• We do not use cookies or tracking pixels for advertising purposes.
• We do not sell, rent, or trade personal information to third parties.
• We do not access connected service data beyond the OAuth scopes you authorize.

We use the information we collect to:

• Provide and operate the platform, including generating AI persona responses to your messages
• Allow personas to access and act on data within services you have connected
• Generate daily memory summaries for personas (scoped to your organization only)
• Process billing and subscription management
• Send service-related communications (account notices, billing receipts, support responses)
• Improve and secure the service through aggregated usage analytics
• Detect and prevent abuse, fraud, or violations of our Terms of Service

The Wolf Agency's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We use Google user data only to provide and improve user-facing features of The Wolf Agency that are prominent in the user experience.
• We do not transfer Google user data to third parties except as necessary to provide or improve user-facing features, comply with applicable law, or as part of a merger, acquisition, or sale of assets (with notice to users).
• We do not use Google user data for advertising purposes.
• We do not allow humans to read Google user data unless we have obtained your affirmative agreement to view specific messages, doing so is necessary for security purposes (such as investigating abuse), to comply with applicable law, or for our internal operations and only when the data has been aggregated and anonymized.
• We do not use Google user data to develop, improve, or train generalized AI and machine learning models. Your data is used only to perform the specific actions you request through your AI personas.

When a persona uses your Google data (for example, to read your calendar or search your Gmail), the data is sent to Anthropic's Claude API to generate a response, and is then discarded by Anthropic per their data handling policies. We do not store the contents of your Google data in our database beyond the specific outputs you and your personas generate (such as a summary the persona produces and posts back to you).

We share information only as described below. We do not sell personal information.

6.1 Subprocessors

We rely on the following third-party service providers to deliver our service. Each is contractually bound to handle data securely:

A current list of subprocessors is maintained at thewolf.agency/subprocessors.

6.2 Required disclosures

We may disclose information if required by law, legal process, or to protect the rights, property, or safety of our users or others. We will notify you of any legal request for your data unless prohibited from doing so by law.

6.3 Business transfers

If The Wolf Agency is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a different privacy policy.

• Active account data. Retained for as long as your account is active.
• Conversation history and audit logs. Retained for the duration of your subscription, plus 90 days after termination for billing dispute and audit purposes.
• Memory summaries. Personas maintain a rolling 7-day window of summaries; older summaries are automatically deleted.
• Account closure. Upon account termination, you may request deletion of your data. We will delete personal data within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing agreements).

Depending on your jurisdiction, you may have rights including access, correction, deletion, restriction or objection to certain processing, data portability, and withdrawal of consent for OAuth-connected services (via the connected service's settings or by disconnecting the integration in our application).

To exercise any of these rights, contact us at privacy@thewolf.agency. We will respond within 30 days.

California residents have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information is collected, the right to delete personal information, and the right to opt out of the sale of personal information. We do not sell personal information.

European Economic Area, United Kingdom, and Swiss residents have rights under the GDPR and equivalent laws. The Wolf Agency acts as a data processor when handling data on behalf of our customers; our customers are the data controllers for their organization's data. Where we act as a data controller (for example, for our own account and billing information), we comply with applicable data protection law.

We implement reasonable technical and organizational measures to protect your information, including:

• TLS encryption for data in transit
• Encryption at rest for databases
• Access controls and audit logging for personnel access to systems
• OAuth tokens stored encrypted at the database layer
• Regular security reviews of subprocessors

No method of transmission or storage is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you as required by applicable law.

The Wolf Agency is not directed to children under 18, and we do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it promptly.

The Wolf Agency operates from the United States. If you access our services from outside the United States, your information will be transferred to and processed in the United States. By using our services, you consent to this transfer.

We may update this policy from time to time. We will notify users of material changes by email or through the application at least 30 days before changes take effect. The "Last Updated" date at the top reflects the most recent revision.

For questions or concerns about this policy or our privacy practices:

Red Wolf, Inc.

[Business address — to be added before publication]

privacy@thewolf.agency