Privacy Policy
Effective July 10, 2026
Scope and Controller Information
This Privacy Policy (“Policy”) describes how Wiki, a company organized under the laws of the State of Montana(“Wiki,” “Company,” “we,” “us,” or “our”), collects, uses, discloses, and otherwise processes personal information when you visit our website, use our application, contact us, participate in our affiliate program, or interact with hosted documentation published by our customers.
For personal information Wiki processes on behalf of business customers through the Service, Wiki generally acts as a processor (or service provider) and the customer acts as the controller. Such processing is governed by our Data Processing Addendumand the customer’s instructions.
Categories of Information We Collect
Depending on your relationship with Wiki and how you use the Service, we may collect:
- Identifiers and account information: name, email address, authentication identifiers, profile settings, and organization affiliation.
- Organization and workspace data: organization name, roles, membership, permissions, and configuration settings.
- Customer Content: knowledge documents, attachments, policies, documentation site configuration, test cases, and related materials uploaded or created by you or your authorized users, which may contain personal information.
- Usage and device information: pages viewed, feature interactions, browser type, operating system, IP address, approximate location derived from IP, referral source, and technical logs used to operate, secure, and improve the Service.
- Communications: information you provide when contacting support, submitting feedback, or participating in surveys.
- Commercial information: subscription tier, billing status, invoice references, and transaction history. Payment card data is processed by Stripe, Inc.; Wiki does not store full payment card numbers.
- Public documentation visitor data: when customers enable analytics, Docs Assistant, or feedback features on published sites, we may process visitor questions, search queries, session metadata, and aggregate page analytics according to customer configuration.
- Affiliate program data: partner contact information, referral attribution, commission records, and payout details for approved affiliates.
We do not knowingly collect sensitive personal information except as submitted by you or your organization within Customer Content, for which you are responsible for establishing an appropriate legal basis and safeguards.
How We Use Information
We use personal information for the following business purposes:
- Providing, operating, maintaining, securing, and improving the Service.
- Authenticating users and managing accounts, organizations, and workspaces.
- Processing subscriptions, billing, and affiliate commissions.
- Communicating about the Service, including transactional and service messages.
- Responding to inquiries, support requests, and legal process.
- Detecting, investigating, and preventing fraud, abuse, and security incidents.
- Enforcing our Terms, Acceptable Use Policy, and other agreements.
- Complying with applicable law, regulation, and legal obligations.
- Generating aggregated or de-identified analytics that do not identify individuals.
We do not sell personal information. We do not use personal information for cross-context behavioral advertising. We do not use Customer Content to train generally available machine learning models except as expressly permitted in an applicable agreement or with your explicit consent.
Legal Bases for Processing
Where the General Data Protection Regulation (“GDPR”), UK GDPR, or similar laws apply, we rely on the following legal bases:
- Contractual necessity: processing necessary to perform our contract with you, including account creation, Service delivery, billing, and support.
- Legitimate interests: securing the Service, preventing fraud, improving product functionality, and communicating about the Service, balanced against your rights and interests.
- Consent: where required for optional analytics cookies, marketing communications, or other processing for which consent is the appropriate basis.
- Legal obligation: compliance with tax, accounting, regulatory, and law enforcement requirements.
Where U.S. state privacy laws apply, we process personal information as a service provider or processor on behalf of business customers, and as a business or controller for our own account administration, website operations, and affiliate program.
Processing of Customer Content
Customer Content is processed to provide features you request, including storage, search, verification workflows, answer testing, citation generation, documentation publishing, policy evaluation, and analytics you enable. Access to Customer Content is restricted according to configured roles, permissions, and AI policies. You control what content is uploaded, published, and shared.
AI Processing
When you use answer generation, Docs Assistant, or related features, Wiki may transmit prompts, source excerpts, and configuration parameters to AI model providers to generate outputs. Processing is performed in accordance with your configuration and applicable agreements with such providers.
Wiki contractually requires AI subprocessors not to use Customer Content submitted through the Service for training of their generally available models, except where you explicitly opt in or where required by applicable law. AI provider terms and data handling practices apply to subprocessed processing as described on our Subprocessor page.
How We Disclose Information
We may disclose personal information to:
- Service providers and subprocessors who process information on our behalf under contractual confidentiality and data protection obligations.
- Business customers where you interact with customer-published documentation or submit information through customer-enabled features.
- Professional advisors including attorneys, accountants, and insurers, subject to confidentiality obligations.
- Law enforcement and regulators when required by law, subpoena, court order, or to protect rights, safety, and security.
- Successors in connection with a merger, acquisition, reorganization, or sale of assets, subject to this Policy.
We do not disclose personal information to third parties for their own marketing purposes.
Service Providers and Subprocessors
We engage infrastructure and service providers to operate Wiki. A current list of subprocessors, their purposes, and applicable privacy policies is maintained at our Subprocessor page. We require subprocessors to process personal information only on our instructions and in accordance with applicable data protection requirements.
Analytics
We may use first-party or product analytics to understand aggregate usage of our website and application. Analytics are configured as described in our Cookie Policy. Analytics data is used to improve the Service and is not sold to third parties.
Data Retention
We retain personal information for as long as necessary to provide the Service, fulfill the purposes described in this Policy, comply with legal obligations, resolve disputes, and enforce agreements. Retention periods vary by data category:
- Account data: retained while your account is active and for a reasonable period thereafter.
- Customer Content: retained according to your configuration and until deleted through account tools or upon termination, subject to backup retention.
- Billing records: retained as required by tax and accounting laws.
- Security logs: retained for a period consistent with security and incident response needs.
Organization owners and administrators may configure retention periods for certain operational data categories where supported. Backup copies may persist for a limited period before being overwritten in the ordinary course.
Security
We implement administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. See our Security page for an overview. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
International Data Transfers
Wiki is based in the United States. Personal information may be processed in the United States and other countries where we or our subprocessors maintain facilities. When we transfer personal information from the European Economic Area, United Kingdom, or Switzerland to countries without an adequacy determination, we implement appropriate safeguards, including:
- Standard Contractual Clauses approved by the European Commission (Module 2: Controller to Processor and Module 3: Processor to Processor, as applicable).
- The UK International Data Transfer Addendum where required for UK transfers.
- Supplementary measures as assessed through transfer impact analysis where appropriate.
A copy of applicable transfer mechanisms may be requested by contacting hello@wiki.co.
Your Privacy Rights and Choices
Depending on your location, you may have the following rights regarding your personal information, subject to applicable exceptions:
- Access: request confirmation of whether we process your information and obtain a copy.
- Correction: request correction of inaccurate information.
- Deletion: request deletion of your information, subject to legal retention requirements.
- Restriction: request restriction of processing in certain circumstances.
- Portability: receive information you provided in a structured, commonly used, machine-readable format where applicable.
- Objection: object to processing based on legitimate interests or for direct marketing.
- Withdraw consent: where processing is based on consent, withdraw consent at any time without affecting prior lawful processing.
California and U.S. state privacy rights
If you are a California resident or reside in a state with a comprehensive privacy law, you may have additional rights, including the right to know categories of information collected, request deletion, and opt out of certain processing. Wiki does not sell personal information and does not share personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA/CPRA”).
To submit a request, contact hello@wiki.co. We will verify your identity before responding and will respond within the timeframe required by applicable law (generally forty-five (45) days for CCPA/CPRA requests, extendable once where permitted). You may designate an authorized agent to submit requests on your behalf where permitted by law. If we deny a request, you may appeal by replying to our response. California residents may contact the California Attorney General with complaints regarding our handling of personal information.
EEA, UK, and Swiss rights
If you are located in the EEA, UK, or Switzerland, you have the right to lodge a complaint with your local supervisory authority. Wiki’s primary contact for GDPR inquiries is hello@wiki.co.
Customer Administrative Controls
Organization owners and administrators control workspace membership, permissions, publishing rules, retention settings, data exports, and deletion requests for their organization’s data. End users whose information is contained in Customer Content should direct requests to the relevant organization, which Wiki will assist in responding to as processor where applicable.
Public Documentation and Visitor Data
When customers publish documentation publicly, visitors may submit feedback, questions, or search queries through features the customer enables. Such data is processed to provide the requested functionality and is controlled by the publishing customer’s configuration and privacy practices.
Children's Privacy
The Service is not directed to individuals under sixteen (16) years of age, and we do not knowingly collect personal information from children. If you believe we have collected information from a child, contact hello@wiki.co and we will take appropriate steps to delete such information.
Changes to This Policy
We may update this Policy from time to time. Material changes will be posted on this page with an updated effective date and, where required, additional notice. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.
Contact
Privacy inquiries and rights requests: hello@wiki.co. General support: hello@wiki.co.