Privacy Policy

WWO (whatworked.online) is operated by Leogacy International FZE ("we", "us"), a free zone company registered in the United Arab Emirates, at Block B, B27-021, Sharjah Research, Technology and Innovation Park (SRTIP), Sharjah, United Arab Emirates. We are the controller (under India's DPDP Act, the data fiduciary) responsible for your personal data.

This policy explains what we collect when you use the site, why, and the choices you have. We collect the minimum needed to run the product, and we do not sell or share personal data for advertising.

• Account data — when you sign in with Google we receive your name, email address and profile picture.
• Product activity — favorites, collections, support messages, plan and credit usage, and the queries you run in the research tools (keywords, domains). These are stored so the product works and so cached results don't cost you credits twice.
• Feedback — if you use the feedback form: your message and rating, and a name and email only if you give them.
• Payment data — payments are handled entirely by Stripe, our payment processor. We store only your subscription status and plan; we never see or store card numbers.
• Technical data — standard server logs (IP address, user agent) kept by our hosting providers for security and debugging. For abuse limits on public forms and for cookie consent records we store a one-way hash of your IP address, never the address itself.
• Usage statistics — aggregated, cookie-free figures for public pages: pages viewed, referring sites, country, device type and counts of actions such as running a free check. Signed-in areas are excluded.

We use strictly necessary cookies and browser storage to keep you signed in (via our auth provider, Supabase) and to remember settings you choose, such as dark mode. One optional cookie remembers a referral link, and we set it only if you allow it. We do not use analytics, advertising or cross-site tracking cookies, and we honour Global Privacy Control signals. The full list, and how to change your choice, is in our Cookie Policy.

• To provide the service — sign-in, saved items, research tools, plan features and billing. Basis: performing our contract with you.
• To keep the service safe — metering credits, rate limiting, preventing abuse and keeping server logs. Basis: our legitimate interest in a secure, fairly used service.
• To improve the site — understanding which public pages are useful through usage statistics. Basis: our legitimate interest in improving the product.
• To answer you — support requests and feedback. Basis: contract, or our legitimate interest in improving the product.
• Transactional email about your account or subscription. Basis: contract. We never send marketing email without your consent.
• Optional cookies — only with your consent, which you can withdraw at any time. We keep a record of each choice to show that consent was given (legal obligation and legitimate interest).
• Tax and accounting records for payments. Basis: legal obligation.

• Supabase — database, authentication and storage;
• Vercel — application hosting, server logs and usage statistics;
• Google — sign-in (OAuth);
• Stripe — checkout, subscription billing and invoicing, as payment processor;
• SEO data providers — the keywords and domains you look up are forwarded to third-party SEO data APIs to fetch metrics. No personal account data accompanies those requests.

Each provider processes data on our instructions and under its own security and privacy commitments.

We are based in the UAE and our providers run servers in several countries, including the United States and the European Union, so your data may be processed outside the country where you live. Where the law requires it, these transfers rely on the providers' data processing agreements and recognised safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.

Account and product data are kept while your account exists. Cached tool results are kept for short periods (days to weeks) to avoid re-billing credits. Server logs rotate on our providers' standard schedules. Payment records are kept as long as tax law requires. Feedback and consent records are kept only as long as they are useful for running the service or showing that consent was given. When your account is deleted, associated personal data is removed from the production database.

You can update your name in settings and change your cookie choice at any time. For anything else, email accounts@leogacy.io. We respond within 30 days and never treat you differently for using your rights. Depending on where you live:

• EU, EEA and UK (GDPR): access, correction, deletion, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent. You can also complain to your local data protection authority.
• United States, including California (CCPA/CPRA): the right to know what we collect, and to access, correct and delete it. We do not sell or share personal information or use it for targeted advertising, and we honour Global Privacy Control. You may use an authorised agent; we will verify the request.
• India (DPDP Act, 2023): access to a summary of your data, correction, completion and erasure, grievance redressal, and nominating someone to act for you. If our response doesn't resolve your grievance, you may approach the Data Protection Board of India.
• United Arab Emirates (PDPL): access, correction, erasure, restriction, objection and withdrawal of consent. You can also complain to the UAE Data Office.

Grievance Officer: Grievance Officer, Leogacy International FZE, Block B, B27-021, Sharjah Research, Technology and Innovation Park (SRTIP), Sharjah, United Arab Emirates — accounts@leogacy.io.

Data is encrypted in transit (TLS) and at rest by our providers. Access to production data is restricted to the operator. Database access is enforced with row-level security so users can only read their own private data. No method of storage is 100% secure; if a breach affects your personal data we will notify you and the relevant authorities as required by law.

The service is not directed at children under 18 and we do not knowingly collect their data.

We will post any changes to this policy here and update the date above; material changes will be announced on the site. Privacy questions or requests: Leogacy International FZE, Block B, B27-021, Sharjah Research, Technology and Innovation Park (SRTIP), Sharjah, United Arab Emirates — accounts@leogacy.io. For help with the product, use the support form.