Privacy Policy

Governs the collection, use, and protection of Personal Information processed through the Service.

Wooli Privacy Policy

Table of Contents

1 Introduction

This Privacy Policy governs how Wooli, Inc. ("Wooli," "we," "us," or "our") collects, uses, protects, and shares Personal Information and other data processed through the Wooli Subscription Service (the "Service") at apps.wooli.com. It also covers data we collect through the public Wooli marketing website at www.wooli.com (the "Wooli Website") and the free resource site Explore at explore.wooli.com (together with the Service and the Wooli Website, the "Wooli Sites"). The Service supports the upload, storage, and management of diverse data (including documents, personal information, and information on others) and features (such as task assignment, file sharing, and team coordination). Subscriptions to the Service are sold and billed by Wooli and may include content or features provided by affiliated organizations, such as Wooli Safety, Inc.

This Privacy Policy applies to all users and visitors of the Wooli Sites, including individuals and Organizations. When we Process Personal Information on a Customer's behalf, we act as a service provider (processor) under the Data Processing Agreement (DPA). We are committed to protecting your privacy and complying with applicable data protection laws. This Privacy Policy is incorporated into, and governed by, the Wooli Terms of Service (ToS). Read it together with the Acceptable Use Policy (AUP).

We offer the Service in, and intend it for users in, the United States. If you do not agree with this Privacy Policy, do not access or use the Service. For questions or to exercise your data rights, contact us as described in Section 16.

2 Definitions

These terms have the meanings given below.

2.1 Personal Information

Any information relating to an identified or identifiable individual that is processed through the Service.

2.2 Sensitive Personal Information

Categories of Personal Information that require additional protection under applicable law, such as Social Security numbers, precise geolocation, health information, biometric data, or financial account information.

2.3 User Content

Has the meaning given in the ToS: all information, data, documents, and other content that you or your Users upload, submit, store, or process through the Service, including personal information and data shared in collaborative features.

2.4 System Data

Anonymized, aggregated data (e.g., usage statistics and analytics) that is not attributable to any individual, used to operate and improve the Service. System Data does not include audit, security, or activity logs that identify, or are reasonably attributable to, a specific user. We treat those logs as Personal Information and handle them under this Privacy Policy.

2.5 Consumer

A natural person whose Personal Information is processed, as understood under applicable U.S. state privacy laws.

2.6 Data Subject

An individual whose Personal Information is processed.

2.7 Processing

Any operation performed on Personal Information, such as collection, storage, use, disclosure, or deletion, whether automated or manual.

2.8 Subprocessor

A third-party service provider that Wooli engages to process Personal Information in User Content on a customer's behalf under the DPA. The Subprocessor List identifies them.

2.9 Security Event

Unauthorized access to, acquisition of, or use of Personal Information that compromises its security and requires notification under applicable law.

2.10 Partner

A Subscription Partner (a company operating under the Wooli brand, such as Wooli Safety, Inc., whose content is included in Subscriptions) or an External Partner (an independent organization, such as an accreditation body, auditor, or consultant, that you choose to link to your Workspace), as defined in the ToS.

3 Information We Collect

We collect the following types of information to provide the Service:

3.1 Identification and Contact Data

Your email address, which is all we need to create an Account, and the name, address, title, and phone number you provide when you complete your profile or manage a Subscription. If a Workspace gives you guest access (for example, to sign a document or complete a task), the Workspace gives us your name and email address.

3.2 Financial Information

Credit card details, payment account and billing details, and payment data processed through our online payment process.

3.3 IT and Technical Data

IP addresses, approximate location derived from your IP address, cookie identifiers, browser type and version, operating system, and device identifiers collected while you use the Service.

3.4 Authentication and Security Data

Sign-in information: the email address you sign in with, your password (stored hashed) if you set one, the one-time passcodes we email to you (including for guest access and to confirm your email address before you sign a document), and identifiers from any single sign-on provider you or your Workspace use.

3.5 Usage and Interaction Data

Application logs, user activity within the Service (e.g., page views, features used, time spent), the Explore content you view or download, clickstream data, and session replays recorded by PostHog (which masks what you type into forms and fields) and by Sentry.

3.6 Communication Data

Messages you send through the Service (e.g., chat, support requests, comments) and your communications with customer support, including support chat transcripts.

3.7 Third-Party and Integrated Service Data

Information from third-party integrations (e.g., Google, Stripe, Slack) or social media profile data, if you link those accounts.

3.8 User Content

Documents, personal information, third-party data (e.g., client information), or custom data fields you or your Users upload or share through the Service, including in collaborative features.

3.9 Metadata and Analytics Data

Analytics-derived data and anonymized or aggregated data (e.g., System Data) used to improve the Service.

3.10 Demographic Data

Age, gender, or language preference, collected only if you provide it or the Service needs it to function.

3.11 Sensitive Personal Information

Health data, biometric data, government-issued identifiers, and other Sensitive Personal Information. You may upload Sensitive Personal Information only with the consents and safeguards that applicable law requires, as described in the AUP. You must not upload Protected Health Information under HIPAA: the Service is not designed for it, and we do not sign Business Associate Agreements. You may upload nonpublic personal information under GLBA only if your Order Form expressly permits it.

3.12 Electronic Signature Data

When you send, review, or sign documents electronically, we process signatures (the image of a drawn signature or a typed name), the signing audit trail (signers' names and email addresses, IP addresses, timestamps, and each step, such as sent, viewed, and signed), completion certificates, and the documents themselves. We store only the image of a drawn signature, not how it was drawn, so we do not collect biometric data from signatures. Signing records belong to the Workspace that sent the document, and we process the Personal Information in them on that customer's behalf under the DPA.

4 How We Collect Information

We collect information in these ways:

4.1 Directly from You

When you create an Account or a Workspace, subscribe, or upload User Content, including custom data fields or documents.

4.2 Automated Collection

Through cookies, trackers, and analytics tools when you use the Service (e.g., accessing the Service, using collaborative features, or generating clickstream data). We use consent prompts (e.g., a cookie banner) for non-essential cookies.

4.3 From Partners

Contact or Subscription details that a Subscription Partner provides for content included in your Subscription, and information that an External Partner you link to your Workspace shares with you through the Service.

4.4 From Other Users

Data that other Users share in collaborative features (e.g., shared tasks, files, or chat messages), and the name and email address of a Guest that a Workspace invites, for example to sign a document or complete a task.

4.5 From Third-Party Integrations

Data from authorized integrations (e.g., Google, Stripe, Slack) or social logins, if you enable them.

5 How We Use Information

We process Personal Information and User Content for these purposes:

5.1 Service Provision

To host, store, process, and display User Content, enable collaborative features (e.g., task sharing, file storage) and electronic signatures (including signing audit trails and completion certificates), and deliver the Service as specified in your Order Form.

5.2 Authentication and Security

To let you sign in by one-time passcode, password, or single sign-on, and to keep Accounts and Workspaces secure.

5.3 Subscription Management

To process payments and manage Subscriptions, including billing and financial data.

5.4 Platform Improvement

To analyze System Data (e.g., usage statistics and analytics) to improve the Service's performance and functionality, including finding and fixing problems in the Service during its beta period and in features we label beta. Using the Service during its beta period, or a beta feature, does not change how this Privacy Policy protects your Personal Information.

5.5 Support and Maintenance

To provide technical support, respond to support requests (including chat or transcripts), and maintain the Service.

5.6 Legal Compliance

To comply with tax reporting, data protection laws, and other legal obligations.

5.7 Marketing

To send marketing emails about Wooli's products, resources, and events. We send marketing emails through ActiveCampaign, which tells us whether they are opened and which links are clicked. When you create an Account yourself, we add your email address to our marketing list. If a customer adds you to its Workspace or gives you guest access, you receive marketing emails only if you opt in. Every marketing email includes an unsubscribe link, and unsubscribing does not stop passcodes or other service emails.

We do not sell Personal Information, and we do not share it for purposes outside our direct relationship with you, except as permitted by law or the ToS. If we determine that we can no longer meet our obligations under applicable data protection law, we will promptly notify you at the email associated with your Account so you can address the issue.

6 How We Share Information

We share Personal Information and User Content only as needed to provide the Service or to comply with legal obligations:

6.1 Service Providers and Subprocessors

We use service providers to run the Wooli Sites. They process Personal Information only on our instructions, under written agreements at least as protective as this Privacy Policy. Our current service providers for the information we collect for our own purposes are:

  • Stripe, Inc.: payment processing for Subscriptions. Processes billing and payment details in the United States.
  • PostHog, Inc.: product analytics and session replay. Processes usage and device data in the European Union.
  • Amazon Web Services, Inc. (Amazon SES): email delivery for sign-in passcodes and service notices. Processes email addresses and email content in the United States.
  • ActiveCampaign, LLC: marketing emails. Processes email addresses, any name you give us, and whether you open our marketing emails and click their links, in the United States.
  • Functional Software, Inc. (Sentry): error monitoring and session replay on the Wooli Sites. Processes technical data (e.g., IP addresses and browser details), error details, and session replays, which may include content shown on screen, in the European Union.
  • Google LLC (Google Workspace): Wooli's email and documents, including the messages you send us. Processes contact details and correspondence in the United States.

Subprocessors that process User Content on a customer's behalf under the DPA, including the providers of AI Features, are identified in the Subprocessor List.

AI Features: Certain Features use third-party artificial-intelligence providers, currently OpenAI, L.L.C., Anthropic, PBC, and X.AI LLC (xAI, provider of Grok), to process the prompts and User Content you choose to submit to AI-powered Features. These providers are Subprocessors. They are bound by written agreements consistent with the DPA and process your inputs to return results to you; under their terms, they may keep inputs for a limited period to monitor for abuse and to comply with law. We do not permit these providers to use your User Content to train their models. We send data to an AI Subprocessor only when you actively use an AI Feature.

6.2 Partners

With Subscription Partners, such as Wooli Safety, Inc., that provide content included in your Subscription, to the extent needed to provide that content and manage your Subscription. Subscription Partners see your User Content only with your permission or through the controlled access process described in the ToS.

With External Partners you link to your Workspace, such as accreditation bodies, auditors, or consultants, who see only the User Content you choose to share with them. External Partners are independent organizations: they handle that information under their own practices and your arrangements with them, not under this Privacy Policy.

6.3 Collaborative Features

Among Users in collaborative features (e.g., shared tasks, files, chat messages). You are responsible for obtaining any consents required for the Personal Information you share.

6.4 Third-Party Integrations

With integrated services (e.g., Google, Slack) that you choose to enable. You are responsible for verifying that those services comply with applicable law.

6.5 Legal Disclosures

When required by law, court order, or governmental authority, with notice to you where permitted.

6.6 Anonymized Data

We may share System Data, which is anonymized and aggregated and not attributable to any individual, for analytics or platform improvement.

7 Data Security

We use industry-standard security measures to protect Personal Information and User Content:

7.1 Technical Measures

Encryption, access controls, secure transmission protocols, and hashed passwords for authentication data.

7.2 Organizational Measures

Regular security reviews, employee training, and internal security policies.

7.3 User Responsibilities

You must use strong passwords, enable multi-factor authentication where available, and follow secure practices for your Account and User Content.

7.4 Confidentiality

Personnel authorized to process Personal Information are bound by confidentiality obligations.

The DPA describes our security practices in more detail. Report any suspected Security Event as described in Section 14.

8 Data Retention and Deletion

We retain Personal Information and User Content for the term of your Subscription. For 30 days after your Subscription ends, we keep your User Content so you can export it through the Account Management Page. After that, we delete it, except copies that the law requires us to keep and copies in backups, which are deleted on our regular backup schedule. Data shared in collaborative features (e.g., tasks, files, chat messages) may remain in other Users' Accounts, subject to their rights. At your request, we will return or destroy Personal Information, including copies, extracts, and summaries, unless the law requires us to keep it. Signed documents, signing audit trails, and completion certificates follow the same rules. You are responsible for exporting your data before your Subscription ends.

9 User Rights

Subject to applicable law, you have these rights regarding your Personal Information:

9.1 Access and Portability

Request access to, or a copy of, the Personal Information we hold about you.

9.2 Correction

Request correction of inaccurate or incomplete Personal Information.

9.3 Deletion

Request deletion of your Personal Information.

9.4 Opt-Out

Opt out of the sale or sharing of Personal Information. We do not sell Personal Information.

9.5 Request Process

Submit requests through the Account Management Page or by contacting the Privacy Contact. We respond within the time required by applicable law.

9.6 Wooli Assistance

When we act as a service provider (processor), we help Customers fulfill individual rights requests, as described in the DPA.

You represent that your instructions for Processing Personal Information comply with applicable law and that you have obtained all necessary consents and provided required notices to individuals.

10 International Data Transfers

We store and process User Content in the United States. Two service providers process data in the European Union, as listed in Section 6.1: PostHog processes product-analytics data (including session replays, with typed input masked), and Sentry processes error reports and session replays from the Wooli Sites, which may include User Content shown on screen in the Subscription Service. When we transfer Personal Information across borders, we comply with applicable data protection law and implement appropriate safeguards. To learn where your data is hosted, contact the Privacy Contact or review the DPA.

11 Cookie Policy

This Section 11 is Wooli's Cookie Policy. It explains how we use cookies and similar technologies on the Wooli Sites (the Wooli Website, Explore, and the Subscription Service) and how you can control them.

11.1 What Cookies Are

Cookies are small text files that a website stores on your device. We also use similar technologies, such as local storage and software development kits, and this Cookie Policy calls all of them "cookies." Session cookies are deleted when you close your browser; persistent cookies remain until they expire or you delete them. Cookies set by wooli.com and its subdomains are first-party cookies. Cookies set by another domain, such as our analytics provider, are third-party cookies.

11.2 Cookies We Use

We use three categories of cookies: essential and functional cookies set by Wooli, and analytics cookies set by PostHog and Sentry. We do not use advertising, marketing, or retargeting cookies, social media tracking pixels, or embedded social media content. We do not use cookies to sell or share Personal Information for cross-context behavioral advertising, to deliver targeted advertising, to combine data across unrelated services, or to profile you for marketing.

11.2.1 Essential Cookies

Essential cookies make the Wooli Sites work, so we set them without asking for consent, as applicable law permits. Examples include authentication tokens, session identifiers, anti-forgery tokens, and load-balancer cookies. If you block them in your browser, the Wooli Sites will not work correctly.

11.2.2 Functional Cookies

Functional cookies remember choices you make, such as your language, time zone, theme, accessibility settings, and recently used workspaces. They do not track you across other websites. If you turn them off, the Wooli Sites will use default settings on each visit.

11.2.3 Analytics Cookies

PostHog is our only analytics provider. We use it to understand how the Wooli Sites are used so we can improve their reliability, performance, and design, for example by measuring feature adoption, finding navigation problems, and detecting errors. PostHog session replay records how pages are used, such as clicks, scrolling, and page changes. On the Wooli Website and Explore, we turn on PostHog analytics and session replay only after you consent through the cookie banner. In the Subscription Service, session replay masks what you type into forms and fields. We do not use analytics data for advertising or to build cross-site profiles.

We also use Sentry to detect and fix errors on the Wooli Sites. Sentry can record session replays so we can see what led to an error, and it keeps a session identifier in your browser's session storage. On the Wooli Website and Explore, we turn on Sentry session replay only after you consent through the cookie banner. In the Subscription Service, we ask for consent where applicable law requires it.

11.3 Third-Party Cookies

Most cookies on the Wooli Sites are first-party cookies. PostHog and Sentry are the only third parties that set or read cookies on your device. Both process data in the European Union, are listed among our service providers in Section 6.1, and operate under data processing agreements with Wooli. Their privacy policies are available at posthog.com/privacy and sentry.io/privacy. If we add a third party that sets cookies, we will update this Privacy Policy and, where consent is required, ask for your consent again through the cookie banner.

11.4 Your Choices

  • Cookie banner: When you first visit a Wooli Site, a cookie banner lets you accept all cookies, reject all non-essential cookies, or choose by category. We store your choice in an essential cookie.
  • Cookie Settings: You can change your choices at any time in Cookie Settings. Changes take effect immediately on the device and browser you are using.
  • Browser settings: Most browsers let you view, block, or delete cookies. Blocking third-party cookies stops PostHog cookies without affecting the core Wooli Sites.
  • Browser privacy signals: Because we do not sell or share Personal Information or use cookies for targeted advertising, a Do Not Track or Global Privacy Control signal has nothing to opt you out of. We do not currently respond to those signals; please use the cookie banner or Cookie Settings instead.

Withdrawing consent does not affect processing that took place before you withdrew it. Where Wooli processes data for a Customer under the DPA, the Customer is responsible for any consents required from its Users.

12 Third-Party Services and Integrations

Section 6.1 lists the service providers we use, and the Subprocessor List identifies our Subprocessors. Partners, such as Wooli Safety, Inc., may provide content included in your Subscription and see your User Content only as described in Section 6.2. You are responsible for verifying that any third-party integrations you enable comply with applicable law. We require our service providers and Subprocessors to meet data protection standards at least as protective as this Privacy Policy.

13 Children's Data

The Wooli Sites are intended for adults, and you must be at least 18 to create an Account. We do not knowingly collect Personal Information from, or set non-essential cookies for, children under 13, consistent with the Children's Online Privacy Protection Act (COPPA). If you believe we have collected Personal Information from a child under 13, contact the Privacy Contact to request deletion.

14 Breach Notification

If a Security Event occurs, we will:

  • Notify you at the email associated with your Account without undue delay after we become aware of it, and within the time required by applicable law.
  • Investigate promptly and, if required by law or at your direction, notify affected individuals.
  • Provide information reasonably necessary to demonstrate our compliance.

You must report any suspected Security Event to us via the Privacy Contact without undue delay.

15 Changes to the Privacy Policy

We may update this Privacy Policy to reflect changes in the Service, legal requirements, or our business practices. We will notify you of material changes (for example, new data uses or sharing practices, a new cookie category, or a new third party that sets cookies) by email and through in-Service notifications, and we will ask for your consent again through the cookie banner where a change requires it. If you continue to use the Service after a change takes effect, you accept the updated Privacy Policy. If you do not agree to a change, you may stop using the Service and cancel your Subscription as described in the ToS.

16 Contact Information

For privacy inquiries, data rights requests, or to report an issue, contact us at:

  • Privacy Contact (email): privacy@wooli.com
  • Address: Wooli, Inc., PO Box 39, Estero, FL 33929
  • Online: through the Wooli Website

Wooli is responsible for responding to your privacy inquiries. You can also manage some data and privacy settings through the Account Management Page.

17 Jurisdiction-Specific Provisions

We designed this Privacy Policy to comply with applicable U.S. data protection laws.

  • United States: To the extent the California Consumer Privacy Act (CCPA) applies to you, you have the right to know what Personal Information we collect and how we use and disclose it, to request access, correction, and deletion, and to opt out of the sale or sharing of Personal Information. We do not sell Personal Information. You may exercise these rights through the Account Management Page or by contacting the Privacy Contact. We will not discriminate against you for exercising them. These rights cover Personal Information collected through cookies; because we do not sell or share Personal Information for cross-context behavioral advertising, the right to opt out of sale or sharing does not apply to our cookies.
  • Other U.S. states: Residents of other U.S. states with privacy laws (e.g., Virginia, Colorado, and Connecticut) have similar rights under those laws.

Where applicable law requires stricter handling than this Privacy Policy describes, we follow the stricter requirement.

For jurisdiction-specific questions, contact the Privacy Contact.

18 Reference Links

Where this Privacy Policy refers to a Wooli website, page, or policy by name, it means the resource listed below; contact details are in Section 16. Wooli may update these links without changing the substance of this Privacy Policy.