W3TURN AI Office — Privacy Policy

Document owner Weturn Artificial Intelligence Developing Services L.L.C Effective date [Insert effective date] Draft last updated 6 August 2026 (v3) Status Draft for qualified legal review. Not yet published.

Version 3 note. v2 was verified against the codebase on 3 July 2026. This version re-verifies against main @ bb11bb6 on 6 August 2026 and corrects statements that were inaccurate, and adds the voice channel, the inbound email channel and the public reception widget, none of which v2 covered. Corrections are itemised in docs/legal/legal-pack-v2-code-review.md. Bracketed items remain open for counsel: trade licence number, effective date, the liability floor, and confirmation of the contact domain.

---

1. Who we are and how to contact us

Weturn Artificial Intelligence Developing Services L.L.C ("Weturn", "we", "our", "us") provides W3TURN AI Office ("AI Office"), a business AI workforce platform that allows organizations to configure AI agents, assign tasks, run AI-assisted workflows, review work outputs, manage agent rosters, communicate with their own customers through connected channels, and connect selected third-party systems. W3TURN and W3LINK are trademarks of Weturn.

Registered office: Office 905, Magnum Opus Tower, Al Thanyah First, Barsha Heights, Dubai, United Arab Emirates. Trade licence number: [insert].

Privacy contact: privacy@w3turn.com. Legal contact: legal@w3turn.com. Security reports: security@w3turn.com.

Where a customer uses AI Office for its own employees, contractors, clients, leads, documents, systems or business data, the customer is generally the controller of that Customer Content and we process it as a processor under the customer agreement, order form and any applicable data processing addendum. For our own account, billing and security records we act as controller.

2. Scope

This Privacy Policy applies to AI Office websites, web applications, APIs, dashboards, the agent marketplace, Linda orchestration features, agent roster features, Work Runs, deliverables, the Call Center, connected messaging and voice channels, the public reception widget, usage analytics, support channels and related services.

It does not replace a customer organization's own privacy notices to its employees, users, clients or contacts. Customers are responsible for providing required notices and obtaining required rights, permissions and consents before submitting personal data to AI Office, including data about the customer's own clients and contacts.

W3LINK has a separate privacy policy. When AI Office is connected to W3LINK, selected W3LINK content may be transferred to AI Office only as configured or authorized by the customer, and AI Office may return results and event notifications to W3LINK.

3. Personal data we collect

Account and identity data. Name, business email, organization, role, permissions and authentication events. Sign-in is passwordless: we issue a single-use sign-in link to the email address and process that address and the resulting session token. We do not set, store or process passwords. Where an organization signs in through W3LINK, W3LINK acts as the identity provider and AI Office receives and verifies signed authentication tokens.

Organization and workspace data. Company name, team structure, departments, workspace settings, admin settings, selected agents, billing plan, roster configuration, usage limits, budgets, approval policies and connector settings.

Customer Content. Prompts, task briefs, instructions, uploaded files, documents, notes, messages, records, leads, invoices, support tickets, data source snippets, connector content and any personal data submitted by or on behalf of a customer.

Connected channel data. Where the organization enables a channel, we process the message content and the identifiers needed to deliver it:

• Web chat, through a widget the customer embeds on its own website: visitor messages, a visitor identifier, and the website the widget is embedded on.
• WhatsApp, through the Meta WhatsApp Business Platform: message content, sender and recipient phone numbers, delivery and read metadata.
• Email, where the customer routes an inbound address to AI Office: sender address, subject, message body and threading headers.
• Telephone, where the customer connects a number: the caller's telephone number, the call audio as processed by the telephony provider, a written transcript of what was said by both the caller and the AI, call duration, outcome and the resulting support ticket.

Agent knowledge. Notes and reference material a customer adds to train a particular agent, stored as text and retrieved by keyword relevance and recency. We do not currently generate vector embeddings of Customer Content and do not operate a vector database.

Connector credentials. Authentication tokens, API keys and similar credentials the customer supplies so agents can access authorized third-party systems. Stored encrypted at rest.

AI data. AI inputs, AI outputs, agent plans, Work Runs, run nodes, deliverables, artifacts, evaluation results, feedback, approvals, comments, retry history and related audit events.

Technical and usage data. IP address, device and browser details, log events, session data, API request metadata, model usage, token usage, tool-call usage, latency, errors, diagnostics, security events and feature interactions.

Billing and commercial data. Billing contact, invoice details, subscription plan, usage units, payment status, tax information, transaction references and support records. Payment card details are processed by our payment processor and are not stored by us.

Communications and support data. Emails, chat messages, support requests, call notes, implementation notes and feedback.

Cookies and similar technologies. Cookie identifiers, analytics events, preferences and marketing attribution where enabled. A separate cookie notice is used where required.

4. How we use personal data

We use personal data to:

• provide, secure, maintain and improve AI Office;
• authenticate users, including through W3LINK where enabled, and manage organizations, roles, permissions and agent rosters;
• process task briefs, run AI agents, orchestrate Work Runs, create deliverables, maintain agent knowledge and support human approvals;
• receive and answer messages and telephone calls from the customer's own customers through the channels the customer enables, and send messages on the customer's behalf;
• connect to customer-authorized systems and retrieve or update data where the customer has enabled those permissions;
• calculate usage, budgets, work units, quotas, billing and cost controls;
• provide support, onboarding, training, implementation and customer success services;
• detect abuse, fraud, security incidents, policy violations and unauthorized access;
• maintain audit logs, compliance records and dispute records;
• send service, security and administrative communications and, where permitted, marketing;
• develop aggregated, de-identified or anonymized analytics to understand reliability, performance and product usage.

5. Legal bases

We process personal data where permitted by applicable law. Depending on jurisdiction and context the basis may include performance of a contract, steps before entering a contract, compliance with legal obligations, consent, protection of rights and security, and legitimate interests where recognized.

Where the UAE Personal Data Protection Law applies, processing may be based on consent or another permitted basis under that law. Where the EU or UK GDPR applies, we identify the lawful basis for each purpose and individuals have additional rights.

For Customer Content, including contact data used in connected channels and the content of telephone calls, the customer is responsible for establishing and documenting the legal basis, including any consent required to message, call, record or transcribe individuals.

6. AI processing, outputs and automated processing

AI Office uses AI systems to analyze inputs, generate plans, recommend agents, draft content, summarize data, classify tasks, produce reports, create deliverables, hold conversations with the customer's own customers in writing and by voice, and assist with business workflows.

AI outputs may be inaccurate, incomplete, outdated, biased or unsuitable for a specific purpose. AI Office assists human users and business teams. It is not a replacement for professional judgment, expert review or legally required human decision-making.

Unless expressly agreed in writing, AI Office is not intended to make decisions with legal or similarly significant effects on individuals without meaningful human review. A customer configuring AI Office for employment, credit, insurance, legal, medical, financial or security decisions is responsible for risk assessment, legal review and human review and appeal procedures.

Speaking with an AI. Where a customer enables the voice or chat channels, the person contacting that business is conversing with an automated system. Customers are responsible for disclosing this at the start of the interaction where required by applicable law, and the product provides configurable greetings for that purpose.

AI Office maintains audit logs, Work Run history, model usage records and output records so customers can understand what data was used, which agents acted, what was generated, what it cost, and who approved or changed a deliverable.

7. Subprocessors and third-party providers

We use the following providers to deliver the service. An up-to-date list is maintained at [subprocessor page URL].

Where third-party AI providers are used, prompts, context, files, metadata, outputs and usage information are sent to those providers as necessary to perform the requested function. We apply contractual, technical and organizational safeguards appropriate to the service and applicable law.

We do not use Customer Content to train public foundation models, and our AI providers process it under terms that exclude such training. We may use aggregated or de-identified telemetry, security metrics and performance metrics to improve reliability, safety, billing accuracy and product quality.

8. How we share personal data

We may share personal data with the customer organization and its authorized administrators and users; recipients of messages agents send on the customer's behalf; the subprocessors listed in section 7; third-party integration providers the customer authorizes, and W3LINK where enabled; payment processors, tax advisers, auditors, insurers, legal advisers and professional service providers; government authorities, courts, regulators or law enforcement where required by law or necessary to protect rights, safety or security; and buyers or successor entities in a merger, acquisition, restructuring, financing or sale of assets, subject to appropriate confidentiality protections.

9. International transfers

The application and the database run in Frankfurt, Germany (eu-central-1). Certain subprocessors, including our AI, voice, telephony and payment providers, operate in the United States and elsewhere, so some data is transferred outside the European Economic Area and outside the United Arab Emirates.

Where required we rely on appropriate safeguards, including standard contractual clauses, data processing agreements, transfer impact assessments, customer instructions and consent where applicable.

Customers with data residency or regulated-sector obligations should confirm their hosting region, subprocessors, support access rules and integration architecture before enabling production use.

10. Security

We use technical and organizational measures designed to protect personal data, including:

• isolation between customers enforced in the database itself using row-level security, so one customer's data cannot be read in another customer's context;
• passwordless authentication with signed and verified tokens, and role-based authorization;
• encryption in transit, and encryption at rest for connector credentials;
• integrity-protected webhooks between AI Office and W3LINK and from payment and channel providers;
• logging, audit trails, monitoring, rate limiting, per-customer spend limits and a kill switch;
• least-privilege access and incident response procedures;
• administrative interfaces that refuse access in production unless explicitly secured.

No system is completely secure. Customers are responsible for managing their own users, administrators, mailbox access, devices, connector permissions and credentials, sharing practices and internal approval policies.

Security reports may be sent to security@w3turn.com.

11. Retention

We retain personal data for as long as needed to provide AI Office, comply with legal obligations, resolve disputes, enforce agreements and maintain security.

Current practice, stated plainly: Customer Content, conversations, call transcripts, tickets, Work Runs, artifacts, agent knowledge and audit records are retained for the life of the customer account. We do not currently offer customer-configurable retention periods or legal hold. [Counsel: a retention schedule is in development; this section should be updated to state defined periods once implemented.]

On termination we will delete or return Customer Content, including stored connector credentials, in accordance with the applicable agreement, subject to legal obligations, backup cycles, dispute records, security records and billing records. Backups and security logs may persist for a limited period after deletion before being overwritten.

12. Your privacy rights

Depending on where you live and which law applies, you may have rights to request access, correction, deletion, restriction, portability, objection to processing, withdrawal of consent, information about automated processing, and to complain to a regulator.

Where we process Customer Content on behalf of a customer organization, including contact data and call transcripts from connected channels, we may redirect your request to that customer or cooperate with the customer so it can respond as controller.

To exercise rights, contact privacy@w3turn.com. We may need to verify your identity and your relationship with the relevant customer workspace before responding. Customers may request an export of their data at any time during the term by contacting us.

13. Children

AI Office is intended for business use and is not directed to children. Users must be at least the age of majority in their jurisdiction or otherwise authorized by their organization and applicable law.

14. Changes

We may update this Privacy Policy. We will post the updated version with a new effective date and, where required, provide additional notice or obtain consent.

15. Contact

Privacy: privacy@w3turn.com. Legal notices: legal@w3turn.com. Security: security@w3turn.com.

---