Who we are and what this covers
WikiFlai, based in California, United States, provides Wikiflai under the Wikiflai & The Alasti Company name. This policy describes information handled by Wikiflai & The Alasti Company when you visit our marketing site, use the app or a published wiki, contact us, or connect through an API or MCP client. Contact hey@wikiflai.com for privacy questions or requests.
We determine how account, billing, support, and service-security information is used. When an organization puts personal information into its documents, it generally determines the purposes of that processing and we process the content to provide the service on its behalf. For requests about an organization’s documents, contact that organization’s administrator; we can help route a request.
Information we handle
- Account and organization information: names, email addresses, profile details, identity-provider identifiers, organization membership, roles, and invitations. Google or GitHub may provide information you authorize during sign-in; we do not receive your Google or GitHub password.
- Workspace content: page text, rich document state, Markdown, page hierarchy, comments, publication settings, custom domains, editing attribution, presence, draft checkpoints, trash, published revisions, hosted files, teams, project permissions, site branding, and content-activity summaries.
- Billing information: customer and subscription identifiers, selected plans, entitlements, usage and transaction records, and contact information. Payment details submitted through a payment provider’s checkout are handled by that provider; payment availability depends on the plan and checkout configuration.
- Technical information: IP addresses and request metadata processed by hosting and security services, authentication events, and operational error information. Optional browser diagnostics are sent only after you choose to allow them.
- Communications: messages you send us, service emails, invitation recipients, and delivery information.
- Agent access information: key names, scopes, expiry, revocation, and use metadata. We store a hash of an issued agent key rather than its raw secret.
Why we use it
We use information to authenticate users, provide collaborative editing and publishing, manage organizations, deliver invitations, administer billing, respond to requests, prevent abuse, troubleshoot failures, and meet legal obligations. We do not sell personal information or share it for cross-context behavioral advertising. We do not use advertising trackers on the marketing site.
Where data-protection law requires a legal basis, we rely on performing our contract, legitimate interests in operating and securing the service and responding to requests, legal obligations, and consent for optional browser diagnostics or other processing that requires consent. Organizations are responsible for establishing a lawful basis for personal information they put into their workspaces.
When an organization enables Analytics & insights, admins can view document activity counts, contributor names and activity totals, and recent publication information derived from workspace edits, comments, and publishing. This feature does not track documentation visitors or add analytics cookies. Organization admins can turn it off in Plans & billing; existing activity records remain subject to this policy’s retention and deletion terms.
Who can receive information
We use the providers listed on our subprocessors page for hosting, authentication, databases, billing, email, and diagnostics. They receive information needed for their role. We may disclose information when legally required, to address fraud or protect rights and safety, or as part of a business transfer subject to applicable protections.
Organization members and admins can access information according to workspace permissions. Publicly published content is available to anyone. People with a site password may access password-protected content. Agents and tools you authorize can access information within their granted permissions. Their own providers may have separate data practices.
Documents can contain external images and links selected by their authors. Loading an external resource can disclose your IP address and request information to its host under that host’s policies.
Cookies, storage, and diagnostics
The marketing site serves its own fonts and does not load analytics or advertising scripts. The app uses authentication cookies and browser storage for requested functions such as sign-in, password-site access, local editing data, and your privacy choice. Optional browser error diagnostics stay off until you allow them. You can reject them and still use the service.
Use Privacy choices in the app to change your decision. Choices apply to that browser and site origin; custom-domain sites have separate browser storage. See the cookie policy for details.
Retention and deletion
We retain information while needed to provide the service, address security and support issues, keep required business records, and meet legal obligations. The retention period depends on the type of information and the purpose; provider-managed logs and backups have their own retention schedules.
Each page retains its latest 50 draft checkpoints. Published revisions remain until the page or project is permanently deleted. Trashed content has no automatic expiry: an admin must permanently delete it to remove it from active storage. Permanent-deletion jobs remove the associated documents, comments, revisions, and checkpoint bodies and hosted files. File upload reservations expire after ten minutes, and unused stored files are periodically cleaned up. Revoked agent-key metadata may remain for security and audit purposes.
Deletion from active systems does not necessarily remove existing backups immediately. We do not promise a specific backup-erasure deadline in this policy. Contact us about deletion timing, account closure, or an organization-wide request. Export important information before requesting permanent deletion.
International processing and security
Our providers may process information in the United States and other countries, including countries with different privacy laws from yours. Hosting regions and provider infrastructure affect where processing occurs. Contact us for information about relevant locations, transfer arrangements, and data-processing terms before submitting information subject to particular residency or transfer requirements.
We use access controls and technical safeguards, including organization permissions, encrypted connections, scoped agent credentials, and password hashing. No online service is completely secure. The current service is a development beta and is not offered with a guarantee of uninterrupted availability, a particular compliance certification, or a particular data-residency commitment.
Your choices and rights
Depending on applicable law, you may request access, correction, deletion, portability, or restriction of your information, object to certain processing, or withdraw consent. Send requests to hey@wikiflai.com. We may need to verify your identity and authority. If we process information for an organization, we may refer the request to its administrator.
You may also have the right to complain to your local data-protection authority. We do not discriminate against people for exercising applicable privacy rights. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no sale or advertising-sharing activity to opt out of. We do not change these settings in response to a browser’s Do Not Track signal; use Privacy choices to control optional diagnostics.
Children and updates
The service is intended for adults and organizations, not children. If you believe a child has provided personal information without appropriate authorization, contact us. We may update this policy as the service changes, publish an updated effective date, and provide further notice where required by law.