Privacy Policy

Effective date: [EFFECTIVE_DATE]

This Privacy Policy explains how Wren (entity name pending) ("Wren," "we," "us") collects, uses, and protects personal information when you use wren.rest and the Wren service (the "Service").

Important — health-related information: the answers you give in our quiz (your goals, and what you tell us about your situation, sleep, stress, or mood) are treated as consumer health data under the Washington My Health My Data Act. That data is governed by our separate Consumer Health Data Privacy Policy, which is linked prominently on our site. Where the two policies overlap, the Consumer Health Data Privacy Policy controls for consumer health data. This general policy covers everything else and provides the full picture of our practices.

The short version: we collect only what we need to run the Service. We never sell your personal data. We never share it with anyone except the service providers that operate the product for us, under contract. Payment card data goes directly to Stripe and never touches our servers. You can access, export, or delete your data at any time.

1. Information We Collect

1.1 Information you give us

1.2 Information collected automatically

1.3 Information we generate

1.4 What we do NOT collect

• Payment card numbers. Payments are processed by Stripe. Your card details are entered on and transmitted directly to Stripe's systems; card data never touches Wren (entity name pending)'s servers. We receive only a payment token, card brand, last four digits, and transaction status.
• We do not collect precise geolocation, biometric data, or government identifiers, and we do not use geofencing of any kind.
• We do not knowingly collect any data from anyone under 18 (Section 8).

2. How We Use Information

We use personal information to:

1. Provide the Service — generate your personalized sessions from your quiz answers, deliver them to your library, and operate streaming and downloads;
2. Manage your account — authentication, credit tracking, subscription management;
3. Process payments — via Stripe, including billing, renewal, refunds, tax calculation (Stripe Tax), and fraud prevention;
4. Communicate with you — transactional emails (session ready, receipts, renewal notices), support replies, and, with the ability to opt out at any time, product news and marketing emails;
5. Improve the Service — aggregate, de-identified analytics on funnel performance, feature usage, and session quality ratings. We do not use your identifiable quiz answers to train generalized AI models;
6. Safety and compliance — enforcing our Terms, running automated content guardrails on generated scripts, preventing fraud and abuse, and meeting legal obligations;
7. With your separate consent — any purpose involving consumer health data beyond what is necessary to provide the Service you requested (see the Consumer Health Data Privacy Policy).

We do not use your personal information for targeted advertising based on your health-related quiz answers, and we do not sell personal data (Section 4).

3. Processors and Subprocessors

We share personal information only with the service providers ("processors") below, which process it on our behalf under contracts that restrict their use of your data to providing services to us:

If we add or replace a processor, we will update this table. Processors that touch consumer health data are bound by contracts meeting the requirements of the Washington My Health My Data Act.

4. No Sale or Sharing of Personal Data

• We do not sell your personal data. We have not sold personal data, and we will not, in any sense of "sell" — including the broad definitions in the Washington My Health My Data Act and the California Consumer Privacy Act (exchange for money or other valuable consideration).
• We do not "share" personal data for cross-context behavioral advertising (as defined by the CCPA/CPRA).
• We disclose personal data only: (a) to the processors in Section 3; (b) if required by law, subpoena, or court order (we will notify you unless legally prohibited); (c) to protect the rights, safety, or property of you, us, or others; or (d) in a merger, acquisition, or asset sale — in which case consumer health data will only be transferred consistent with the Consumer Health Data Privacy Policy and applicable law, and you will be notified.

5. Data Retention

Deletion requests are honored as described in Section 7 and in the Consumer Health Data Privacy Policy, including instructing processors to delete.

6. Security

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including: encryption in transit (TLS) and at rest, hashed passwords, row-level security so each customer can access only their own library and quiz data, least-privilege internal access (access to identifiable quiz responses is restricted to what operating the Service requires), API keys stored in secrets managers, and processor contracts with security obligations. No system is perfectly secure; if a breach affects your personal data, we will notify you and regulators as required by law, including Washington's breach-notification statute.

7. Your Rights and Choices

Everyone, regardless of location, can exercise these rights by emailing support@wren.rest or using the tools in account settings:

• Access / know: get a copy of the personal data we hold about you.
• Export: receive your data (including your generated sessions, which you can download directly from your library) in a portable format.
• Correction: fix inaccurate account data.
• Deletion: delete specific quiz responses/sessions or your entire account. We delete from our systems and instruct our processors to delete. See the Consumer Health Data Privacy Policy for the specific timelines applicable to consumer health data.
• Marketing opt-out: every marketing email contains an unsubscribe link; transactional emails (receipts, session-ready notices) continue while you have an account.

We verify requests using your account email. We will respond within 45 days (extendable once by 45 days with notice, where the law allows). We will never discriminate against you — in price, quality, or service — for exercising a privacy right.

7.1 Washington residents (and residents of other states with consumer health data laws)

Your quiz responses and related data are consumer health data. You have specific rights — to know, access, withdraw consent, delete (including from processors), appeal a refusal, and not be discriminated against — under the Washington My Health My Data Act. These are described in full, with how to exercise them and our appeal process, in the Consumer Health Data Privacy Policy. Residents of Nevada (SB 370) and other states with similar consumer-health-data laws may exercise the same rights through the same channels.

7.2 California residents (CCPA/CPRA)

If you are a California resident, you have the right to: know/access the personal information we collect, use, and disclose; delete it; correct it; receive it in a portable format; opt out of sale or sharing (we do not sell or share personal information); limit use of sensitive personal information (we use sensitive information — your quiz answers — only to provide the Service you requested, which is a permitted purpose that does not require a "limit" option); and be free from discrimination for exercising your rights. Categories collected are listed in Section 1; purposes in Section 2; disclosures to service providers in Section 3. We do not use or disclose personal information for cross-context behavioral advertising. Submit requests to support@wren.rest; you may use an authorized agent with written authorization. We are not required to be, and this section serves as our CCPA notice at collection.

7.3 Visitors from the EU/EEA, UK, and Switzerland

The Service is directed to U.S. customers. If GDPR (or UK GDPR) nonetheless applies to your use, note: our legal bases are contract performance (providing the Service), consent (health-related quiz data and marketing — withdrawable at any time), and legitimate interests (security, fraud prevention, service improvement); your data is processed in the United States, which may not provide the same level of protection as your home jurisdiction, and we rely on our processors' standard contractual clauses and safeguards for any transfers; and you have rights of access, rectification, erasure, restriction, portability, and objection, plus the right to lodge a complaint with your supervisory authority. Contact support@wren.rest to exercise any of these.

8. Children

The Service is for adults and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it and close the account. Parents or guardians who believe a minor has provided us data should contact support@wren.rest.

9. Cookies and Similar Technologies

We use:

• Strictly necessary cookies — login sessions, security, checkout. These cannot be disabled.
• Functional cookies — remembering preferences (e.g., voice and soundscape defaults).
• Analytics — [ANALYTICS], configured for aggregate statistics without cross-site tracking or advertising use.

We do not use third-party advertising cookies, and we do not permit third parties to collect data on our site for their own advertising purposes. We honor Global Privacy Control (GPC) signals where legally required (and since we don't sell or share data, there is nothing further to opt out of). Browser settings let you block or delete cookies; blocking necessary cookies may break login and checkout.

10. Do Not Track

We treat Global Privacy Control as described above. Because we do not track users across third-party sites, legacy "Do Not Track" browser signals do not change our behavior.

11. Changes to This Policy

We will post updates here and revise the effective date. For material changes — and for any new use of consumer health data — we will notify you by email and, where the law requires (including under the Washington My Health My Data Act), obtain your fresh consent before applying new practices to previously collected data.

12. Contact Us

Privacy questions, requests, and complaints:

Wren (entity name pending)
[MAILING_ADDRESS]
Email: support@wren.rest

We respond to all privacy inquiries within 45 days.