Privacy policy
Draft for legal review. Written for the v1 build, not yet reviewed by a lawyer, and not legal advice. Highlighted items in brackets are still open.
Wirehouse ("we", "us") is a platform and studio that turns approved brands into website plans and prototypes. This policy explains what we collect, why, who we share it with, how long we keep it, and what you can ask us to do with it. It covers wirehouse.dev, the Wirehouse app, and prototype review links.
The business responsible for your information is [legal entity name], [registered address]. Questions go to privacy@wirehouse.dev.
What we collect
When you apply as a designer. Your name, email, portfolio link, years of experience, and anything you write about how you'd use Wirehouse. We also keep a one-way hash of your network address (not the address itself) to stop spam.
When you send a studio brief. Your name, business, email, website, brand status, page count, target launch month, what the site should do, and any files you attach.
When you're a member. Your account email, name, studio, portfolio link and role; sign-in records, active sessions and two-factor settings; the projects, brand inputs and deliverables you create; and a record of the changes you make (our audit log).
When you review a prototype as a client. The name and email you give, your comments and where you placed them, any approval you give, and when the link was opened. We store a hash of your browser details, not your device's identity.
Cookies and local storage. We use only what the app needs to work: a sign-in session, and on review links, your name and email so you don't have to type them twice. No advertising cookies and no cross-site tracking. [If analytics are added later, list them here before launch.]
Why we use it
- To review applications and studio briefs, and reply to you.
- To run your account: sign-in, security, permissions and support.
- To build what you ask for: wireframes, prototypes, SEO playbooks, code briefs and decks.
- To show clients the prototypes you share, and pass their comments and approvals back to you.
- To keep the platform safe: spam limits, abuse prevention and the audit log.
- To meet legal obligations, such as tax and record keeping.
Where privacy law asks for a legal basis, we rely on: taking steps you asked for before a contract (applications and briefs), performing our contract with you (membership and studio work), our legitimate interest in running and securing the service (security logs and the audit log), and legal obligation. We don't sell your information and we don't use it for advertising.
Who we share it with
Only the service providers we need to run Wirehouse, each under its own data-protection terms:
| Provider | What it does for us | Where |
|---|---|---|
| Supabase | Database, accounts and file storage | United States |
| Vercel | Hosting and delivery of the site and app | United States and edge locations |
| MangoMail | Sending emails, such as confirmations and invites | [confirm region] |
| Anthropic (Claude API) | Generating wireframes, copy, SEO plans, code briefs and decks from project inputs | United States |
| Runware | Generating concept images for prototypes | [confirm region] |
Brand inputs and project content are sent to the generation providers only to produce your deliverables. [Confirm each provider's terms on training and retention before launch, and state them here.]
People you share a review link with can see that prototype and its comments. We may also disclose information if the law requires it, or to protect people from harm.
International transfers
Our providers are mostly in the United States. If you're outside the US, your information is transferred there under the safeguards those providers offer, such as standard contractual clauses. [Confirm the transfer mechanism for each provider.]
How long we keep it
| Information | Kept for |
|---|---|
| Declined applications | [12 months] after the decision, then deleted |
| Studio briefs that don't go ahead | [24 months], then deleted |
| Member accounts and projects | While the account is open. Archived accounts can be restored for 30 days, then they're deleted on request or after [12 months]. |
| Review-link comments and approvals | As long as the project exists |
| Audit log and security records | [24 months] |
| Billing records (when billing starts) | As long as tax law requires |
Your choices and rights
You can ask us to show you what we hold about you, correct it, delete it, limit how we use it, or give you a copy in a common format. You can also object to processing based on our legitimate interests. Email privacy@wirehouse.dev and we'll reply within [30 days]. We may need to confirm it's you first.
Depending on where you live (for example the EU, the UK, or California), you may have extra rights under local law, including the right to complain to your data-protection authority. We don't sell or share personal information for cross-context advertising.
Security
Every table is protected by row-level access rules, staff accounts use two-factor sign-in, sensitive actions need you to confirm it's you, and every change to accounts and projects is logged. No system is perfect: if something goes wrong that affects your information, we'll tell you and the authorities as the law requires.
Children
Wirehouse is for working professionals. We don't knowingly collect information from anyone under 18.
Changes
If we change this policy, we'll update the date at the top. For significant changes, we'll tell members by email or in the app before they take effect.
Contact
[Legal entity name], [registered address] · privacy@wirehouse.dev