Privacy Policy

Effective date: November 12, 2026 · Last updated: November 12, 2026

This Privacy Policy explains how WPrime Web Solutions LLC, an Illinois limited liability company operating under the brand name WPrime Agency (“WPrime Agency”, “WPrime”, “we”, “us”, “our”), collects, uses, shares, stores and protects personal information when you visit our website wprime.studio (the “Website”), contact us, apply for a job with us, work with us as a client, interact with our social media accounts, or use our applications and integrations, including WPrime Connect and our TikTok Shop integration. It also explains the choices and rights you have.

This version replaces our privacy policy dated October 29, 2026.

Privacy at a glance

• We do not sell personal information for money. Section 13.2 explains how advertising cookies on our Website are treated under U.S. state laws and how to opt out.
• Data we receive from TikTok Shop, Google, Meta and other platforms is used only to provide services to the client who authorized our access. We do not use it for advertising, do not combine one client’s data with another client’s data, and do not use it to train AI models.
• We only access a client’s accounts on third-party platforms through the platform’s official tools (such as APIs and user roles) and only within the permissions the client grants. A client can revoke our access at any time.
• We tell meeting participants before we record a call, and you can ask us not to record.
• We store information primarily in the United States and protect it with industry-standard safeguards.
• You can ask us to access, correct, delete or export your personal information at any time by emailing privacy@wprime.studio.

Contents

1. Who we are
2. Scope of this policy
3. Information we collect
4. Cookies and similar technologies
5. How we use information
6. Data from third-party platforms and integrations
7. Our own social media accounts
8. Artificial intelligence and automated processing
9. How we share information
10. Where we store information and international transfers
11. How we protect information
12. How long we keep information
13. Your privacy rights
14. How to ask us to delete your data
15. Job applicants
16. Children’s privacy
17. Third-party websites and services
18. Changes to this policy
19. Contact us

1. Who we are

WPrime Agency is a digital marketing and web development agency. We provide search engine optimization (SEO), local SEO, web design and development, white-label services, paid advertising, social media marketing, analytics and related services to businesses.

The company responsible for your personal information is:

WPrime Web Solutions LLC, an Illinois limited liability company operating under the brand name WPrime Agency
Mailing address: 222 W Merchandise Mart Plaza, Suite 1212, Chicago, IL 60654, USA
Privacy contact: privacy@wprime.studio
General inquiries: hello@wprime.studio · +1 (708) 887-3040

2. Scope of this policy

This policy applies to personal information that WPrime Agency handles as a business that decides why and how the information is used (a “controller” or “business”), including information about:

• visitors to our Website;
• people who contact us, request a proposal or an audit, or book a call;
• our clients and the people who work for them;
• people who interact with our own social media accounts;
• job applicants; and
• business contacts, partners and vendors.

When we act for our clients. When we process personal information on behalf of a client, for example information about the client’s customers, leads, website visitors or online store buyers, we act as the client’s service provider (a “processor”). In that case we process the information only on the client’s instructions and to provide the services the client requested, and the client’s own privacy policy governs how that information is used. This policy describes the commitments we make when we act in that role (see Section 6). If you are a customer of one of our clients and want to exercise your privacy rights, please contact that business directly. We will help them respond.

Other policies. Our internal Chrome extension has its own policy: WPrime Browser Tools Privacy Policy. Websites we build for clients are covered by those clients’ own privacy policies.

3. Information we collect

3.1 Information you give us

• Contact, quote and audit request forms. Your name, email address, phone number, your website address, the message you write, any file you attach, any promo or discount code you enter, and the page from which you sent the form. After you submit a form, we send a confirmation to the email address you provided.
• Job applications. Your name, email address, link to your LinkedIn profile, links to your portfolio or work samples, your resume or CV and anything else you choose to include (see Section 15).
• Communications. When you email, call, text or message us (for example through Telegram or WhatsApp), we receive your contact details and the content of your messages, including any files you send.
• Client information. When you become a client, we collect the business contact details of you and your team members (names, job titles, email addresses, phone numbers), billing details, contracts and electronic signatures, project requirements, brand materials and content, and feedback.
• Payment information. Payments are processed by our payment providers (such as Stripe, PayPal and our bank). We receive confirmation of payment and limited details such as the payer’s name, amount, date and payment method type. We do not store full payment card numbers.
• Access to your accounts and systems. To deliver our services, clients may give us access to their website, hosting, analytics, advertising, social media, e-commerce and other accounts. Wherever possible we ask for access through the platform’s own user roles or official integrations rather than shared passwords. When a password or API key must be shared, we keep it in an encrypted password manager or secrets vault and never ask for it to be sent by regular email or chat.

3.2 Calls, meetings and recordings

We hold meetings on Zoom and on other video platforms our clients use. With notice to participants, we may record meetings and use a meeting assistant that joins the call as a visible participant to create a transcript, a summary and a list of follow-up items. We tell participants at the start of a call when it is being recorded. If you do not want a call to be recorded, tell us before or during the call and we will turn recording off. If we record a business phone call, we tell you at the start of the call. We also keep business phone call logs and voicemail messages left for us.

We use recordings and transcripts only to keep accurate project notes, follow up on what was agreed, and improve our service. We do not use recordings to create voiceprints, face templates or any other biometric identifiers.

3.3 Information collected automatically

• Device and log data. When you visit the Website, our servers and service providers receive your IP address, browser type and version, operating system, device type, language, the pages you view, the date and time of your visit and the page that referred you to us.
• Usage and interaction data. Through the analytics tools described in Section 4, we collect information about how you use the Website, such as clicks, scrolling, mouse movements and time on page, including session recordings.
• Approximate location. We determine your country from your IP address, using an IP geolocation service, to decide which cookie settings apply to you. We do not collect your precise location.
• Security signals. Google reCAPTCHA collects information about your device and how you use the Website to tell people from bots and protect our forms from spam and abuse.
• Advertising measurement. Advertising pixels described in Section 4 tell us whether visitors who saw or clicked our ads later visited the Website or contacted us.
• Email interactions. If we send you an email, our email tools may record whether it was delivered and opened and which links were clicked.

3.4 Information from our clients and from third-party platforms

When a client authorizes us to connect to its accounts on third-party platforms (such as TikTok Shop, Shopify, eBay, Google, Microsoft, Meta, LinkedIn, TikTok or Pinterest), we receive data from those platforms through their official APIs and tools, limited to the permissions the client grants. Depending on the service, this can include account and performance data, advertising data, content and comments, and information about the client’s customers and leads, such as names, contact details, inquiry content and order details. Section 6 describes this in detail.

3.5 Information from other sources

• Public sources. When we research potential clients, partners or competitors, we use publicly available business information, such as company websites, online business directories, Google Business Profiles and public professional profiles.
• Referrals. Clients and partners may refer you to us and share your business contact details.
• Social media. When you interact with our own social media accounts, we receive the information described in Section 7.

4. Cookies and similar technologies

Cookies are small text files stored on your device. The Website and the third-party tools on it use cookies and similar technologies (such as pixels, scripts and local storage) for the purposes described below.

WPrime Connect. Our WPrime Connect app uses only strictly necessary cookies, described in Section 6.11. It does not use analytics or advertising cookies.

Providers’ privacy information: How Google uses information from sites that use its services · Microsoft Privacy Statement · OpenAI Privacy Policy · Google Privacy Policy and Terms of Service (reCAPTCHA).

Your choices.

• Cookie banner. When you first visit the Website, a banner lets you choose “Allow cookies” or “Decline”. If you choose “Decline”, Google Analytics and Google advertising features run in a restricted mode that does not store cookies on your device. For visitors from the European Union, this restricted mode is on by default until they choose “Allow cookies”. To change your choice, delete the Website’s cookies in your browser and reload the page.
• Browser settings. You can block or delete cookies, including those of the other tools listed above, in your browser settings or with a content blocker. If you block cookies, some features, such as forms protected by reCAPTCHA, may not work.
• Opt-out tools. You can install the Google Analytics opt-out browser add-on and manage Google ad personalization at adssettings.google.com.
• Browser signals. The Website does not currently respond automatically to “Do Not Track” signals. To opt out of advertising cookies, use the choices above or contact us (Section 13).

5. How we use information

• To respond to you. Answer your questions, send proposals and audits, and schedule and hold calls.
• To provide our services. Plan, deliver, report on and support the services our clients request, such as building and maintaining websites, running SEO and advertising campaigns, managing social media, synchronizing orders, tracking leads and fulfillment, and preparing performance reports.
• To manage our relationship with clients. Contracts, invoicing, payments, accounting and client communications.
• To run our own marketing. Manage our social media accounts, publish content, measure the results of our marketing and advertising, and, where permitted, send you information about our services. You can unsubscribe from marketing emails at any time.
• To hire. Review job applications and communicate with candidates.
• To improve our Website and services. Understand how the Website is used and how our services perform, mostly using aggregated data.
• To keep our systems secure. Protect our Website, systems, clients and staff, and prevent fraud, spam, abuse and unauthorized access.
• To comply with the law. Meet legal, tax, accounting and regulatory obligations, respond to lawful requests, and establish, exercise or defend legal claims.

We do not use personal information for purposes that are incompatible with the purposes described in this policy without telling you first and, where required, getting your consent.

6. Data from third-party platforms and integrations

6.1 Rules that apply to all platform data

We connect to third-party platforms in two situations: on behalf of a client who authorizes us to access its accounts, and for WPrime Agency’s own accounts. The following rules apply to all data we receive from platforms in either situation:

• Authorization and minimum access. We access an account only after its owner, or someone authorized by the owner, grants us access through the platform’s official sign-in, permission screen, partner tools or user roles. We request only the permissions needed for the services the client asked for.
• Purpose limitation. Data received from a client’s accounts is used only to provide services to the client who authorized our access.
• No sale, no advertising. We do not sell platform data and do not use it for advertising, ad targeting or marketing to the people it describes, except to run advertising campaigns that the client has asked us to run on its own accounts.
• No combining across clients. We do not combine one client’s data with another client’s data.
• No profiles, no AI training. We do not use platform data to build or enrich profiles of individual people, and we do not use it to train, fine-tune or otherwise develop artificial intelligence or machine learning models.
• Need-to-know access. Only WPrime staff who work on the client’s project, and service providers bound by confidentiality obligations who process data on our behalf, can access the data.
• Platform terms. We follow each platform’s developer and data terms, including any stricter limits they set on how long data may be kept and how it may be used.
• Revocation. A client can revoke our access at any time (Section 6.10). When access ends, we stop collecting new data.

6.2 TikTok Shop

When a TikTok Shop seller authorizes our application, we receive data through the TikTok Shop Open API, limited to the permissions the seller grants. This may include:

• shop information, such as the shop name, region and identifiers;
• order details, such as order IDs, products and SKUs, quantities, prices, order status and dates;
• product and inventory information;
• fulfillment, shipping and return status; and
• the order-related personal information of the seller’s customers, such as name, shipping address and phone number, that is needed to process and track orders.

How we use it. We use TikTok Shop data only to provide the services the authorizing seller requested, such as synchronizing orders, tracking fulfillment and returns, and preparing sales and performance reports for that seller. Where a feature needs only order totals and product quantities, as sales reports do, we do not store buyers’ personal information. We do not sell personal information, do not use TikTok Shop data for advertising or to contact buyers, do not combine one seller’s data with another’s, do not build profiles of individual buyers, and do not use the data to train AI models.

Sharing. We share TikTok Shop data only with the seller who owns it, with TikTok where needed to provide the service, and with service providers that host or process data on our behalf under confidentiality and data protection obligations.

Storage and security. Seller and customer data received through the TikTok Shop API is stored and processed in the United States and protected as described in Section 11.

Retention and deletion. We keep TikTok Shop data only while the seller’s connection is active and only as long as needed for the services. When a seller disconnects our application or our agreement ends, our API access is revoked immediately and the associated TikTok Shop data, including backups, is permanently deleted within 30 days.

Requests from buyers. If you bought from a TikTok Shop seller that uses our services, the seller controls your information. Please contact the seller, and we will help the seller respond to your request.

Security incidents. If a security incident affects TikTok Shop data, we will notify the affected seller, TikTok and, where required, affected individuals and authorities, as required by law and by our agreements with TikTok.

6.3 TikTok

We may receive advertising performance data from TikTok Ads Manager accounts that clients authorize us to manage. WPrime Agency’s own TikTok account (@wprime.agency) is covered by Section 7.

WPrime Connect (when available). TikTok becomes available in WPrime Connect after TikTok approves our app. Once it is available, for TikTok business accounts that clients connect through WPrime Connect, we use the TikTok API for Business (Accounts API). With the permissions the account holder grants, we may access:

• profile information: display name, username, profile picture, account type and follower, following and like counts;
• the account’s videos and photo posts, and their statistics, such as views, likes, comments, shares and watch time;
• account insights, including aggregated audience data such as age, gender and country that does not identify individual viewers;
• comments on the account’s posts, so the account holder can read them and, with the “Reports and publishing” option, ask us to reply to or hide them. We do not store who wrote a comment.

We do not access TikTok direct messages, do not publish or download videos, do not search for or rank creators, and do not share TikTok data with anyone other than the account holder and the service providers that process it for us (Section 6.13). TikTok’s own privacy policy: tiktok.com/legal/privacy-policy.

6.4 Google and YouTube

With a client’s authorization, we connect to Google services such as Google Analytics, Google Search Console, Google Ads, Google Business Profile and YouTube. We use read-only access wherever the service allows it. Depending on the service, we receive website traffic and conversion data (mostly aggregated), search performance data, advertising account and campaign data, business profile information, reviews and performance data, and channel and video data. We use it only to analyze, report on and improve the client’s online presence and campaigns.

Google API Services. WPrime Agency’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

YouTube API Services. WPrime Connect uses YouTube API Services. By connecting a YouTube channel to WPrime Connect, you agree to be bound by the YouTube Terms of Service. Google’s handling of data is described in the Google Privacy Policy. WPrime Agency’s own YouTube channel is covered by Section 7.

When a channel owner connects a YouTube channel, and with the permissions the owner grants, we may access:

• your Google account’s unique identifier, through the openid permission, used only to identify who connected the channel; we do not receive your email address or Google profile;
• channel information: channel name, ID, description, profile image and subscriber, view and video counts;
• the channel’s videos and their metadata (titles, descriptions, tags, thumbnails, privacy status and publication time);
• YouTube Analytics reports for the channel, such as views, watch time, traffic sources and aggregated audience demographics that do not identify individual viewers;
• comments on the channel’s videos, with the commenter’s public channel name, profile image and channel ID;
• if the owner chose the “Reports and publishing” option, the ability to reply to comments on the channel’s videos as the channel, only with replies that a WPrime team member approved after confirming them with the owner. WPrime Connect does not upload, edit or delete videos.

How we use YouTube data. We use it only to show the channel owner and the WPrime staff assigned to the owner the channel’s own data, to prepare reports for the owner, to help our team draft replies and analyze the channel’s performance, and to post the replies the owner approved. To help our team draft replies and analyze performance, the text of a comment the owner wants to answer (without the commenter’s name, image or ID) and the channel’s own content and statistics may be sent to Anthropic, our AI service provider (Section 6.13). Anthropic processes it only to provide this service to us and does not use it to train its models. We do not use YouTube data to train AI models, do not sell it, do not use it for advertising, and do not combine one channel owner’s data with another channel owner’s data. We do not download video or audio content from YouTube. We share YouTube data only as described in Sections 6.13 and 9. WPrime Connect’s cookies are described in Section 6.11.

Revoking access. You can disconnect a channel at any time on your WPrime Connect link page or dashboard (Section 6.14). You can also remove WPrime Connect’s access on the Google security settings page at myaccount.google.com/connections (also available at security.google.com/settings/security/permissions). How long we keep YouTube data and when we delete it is described in Section 6.12.

6.5 Meta: Facebook and Instagram

For Facebook Pages, Instagram professional accounts and Meta ad accounts that clients connect through WPrime Connect (Facebook Login for Business) or authorize us to manage in another way, we may access through Meta’s official APIs, with the permissions the client grants:

• the list of Pages, Instagram accounts and ad accounts the person chose to share, with their names and IDs;
• the posts, photos, videos and Reels published by those Pages and accounts;
• Page and account insights, such as reach, views, engagement and aggregated audience demographics that do not identify individuals;
• comments and replies on the Page’s or account’s content, with the name or username and the user ID Meta provides for the person who wrote them, so the client can read them and ask us to reply to or hide them;
• advertising performance data for the ad accounts the client selected;
• if the client chose the “Reports and publishing” option in WPrime Connect: on a Facebook Page, the ability to publish text, link and photo posts, to edit and delete Page posts, and to reply to and hide comments; on Instagram, the ability to publish single-photo posts and to reply to and hide comments. We take these actions only after a WPrime team member approves them after confirming them with the client.

WPrime Connect does not request access to Messenger or Instagram Direct messages. WPrime Agency’s own Facebook Page and Instagram account are covered by Section 7.

Meta’s own privacy policy: facebook.com/privacy/policy. To have data we received from Facebook or Instagram deleted, see Section 14 and our Data Deletion page.

6.5.1 Threads

For Threads profiles that clients connect through WPrime Connect, we may access through the Threads API, with the permissions the profile owner grants: the profile’s name, username and profile picture; the profile’s own posts and their insights, such as views, likes, replies, reposts and quotes; and replies to the profile’s posts, with the username Meta provides for the person who replied. If the owner chose the “Reports and publishing” option, we can also publish text and photo posts, reply to replies and hide replies, only after a WPrime team member approves the action after confirming it with the owner. WPrime Connect does not delete Threads posts. We use this data only to show the owner its own posts and statistics, prepare reports for the owner, and publish and manage the content the owner approved. WPrime Agency’s own Threads profile is covered by Section 7.

6.6 LinkedIn

For LinkedIn Pages that a client connects through WPrime Connect, we use LinkedIn’s Community Management API. WPrime Connect accepts only Pages where the person connecting is a Super admin. With the permissions that person grants, we may access:

• the connecting member’s name and member ID, only to show who connected the Page. We do not fetch their profile photo;
• the list of Pages where that member is a Super admin, so the member can choose which Pages to share;
• the Page’s own posts; with the client’s approval we publish, edit and delete Page posts;
• comments on the Page’s posts, so the Page can read and reply to them. The dashboard shows only the comment text, without the commenter’s name, headline, photo or member ID. If our reporting tools receive a commenter’s name or member ID, we delete it within 24 hours;
• the Page’s follower count and post statistics, such as impressions, likes, comments, shares and clicks;
• the Page’s followers, only to let the Page mention a follower in a post the client approved. When that post is published we look up the name the client wrote and insert the mention. We do not store lists of followers.

LinkedIn member data is displayed only inside WPrime Connect and our internal tools, and only to the client whose Page it relates to and the WPrime staff assigned to that client. We do not sell, export or transfer it to anyone else, except the service providers listed in Section 6.13 that process it for us; we never send it to AI providers. We do not combine it with other data. We do not use LinkedIn member data for advertising, sales prospecting, recruiting, lead lists or to enrich CRM records, and we do not use it to infer sensitive information about members. WPrime Agency’s own LinkedIn Page (linkedin.com/company/wprime-web-solutions) is covered by Section 7. LinkedIn’s own privacy policy: linkedin.com/legal/privacy-policy.

6.7 Pinterest

Pinterest becomes available in WPrime Connect after Pinterest approves our app. Once it is available, for Pinterest business accounts that clients connect through WPrime Connect, we use the Pinterest API. With the permissions the account owner grants, we may access the account’s profile information, its boards (to let the client choose where a Pin goes), its Pins, analytics for the account and its Pins and, if the client asks us to report on Pinterest ads, campaign analytics for the client’s ad accounts. If the client chose the “Reports and publishing” option, we can create, edit and delete Pins on the client’s existing boards, only after a WPrime team member approves each action after confirming it with the client. WPrime Connect does not create or change boards. WPrime Agency’s own Pinterest account (pinterest.com/wprime_studio) is covered by Section 7.

We do not collect lists of followers or information about individual Pinterest users, do not collect information about other Pinterest accounts through the API or by scraping, do not compare one account’s Pinterest data with another’s or use it for competitor research, do not use Pinterest data to train AI models, and do not send information about Pinterest users to AI providers. Pinterest’s own privacy policy: policy.pinterest.com/privacy-policy.

6.8 Microsoft: Bing, Microsoft Advertising and Clarity

With a client’s authorization, we access Bing Webmaster Tools, Microsoft Advertising and Microsoft Clarity accounts to receive search performance, advertising and website usage data. We use it to analyze, report on and improve the client’s website and campaigns.

6.9 Shopify, eBay, WordPress and other platforms

With a client’s authorization, we connect to e-commerce, website and business platforms such as Shopify, eBay, WordPress and WooCommerce, and to the client’s forms, call tracking and CRM tools. Depending on the service, we receive store, product, inventory, order, sales and lead data, which can include the names, contact details and order or inquiry details of the client’s customers. We use this data only to build, maintain and improve the client’s website or store, route and track leads and orders, and prepare reports for the client.

6.10 How to revoke our access

You can remove our access to your accounts at any time:

• WPrime Connect (any network): press Disconnect next to the account on your WPrime Connect link page or dashboard (Section 6.14).
• TikTok Shop: deauthorize our application in TikTok Shop Seller Center, or ask us to disconnect it.
• Google and YouTube: Google security settings at myaccount.google.com/connections, or remove our users from the account’s user management settings.
• Facebook and Instagram: Meta Business Suite or Business Settings → Integrations → Connected apps (if you connected a business portfolio), or Facebook Settings → Business integrations (if you connected with your personal Facebook account).
• Threads: Threads Settings → Account → Website permissions.
• LinkedIn: Me → Settings & Privacy → Data privacy → Other applications → Permitted services, or remove our admins from the Page. Our access to a Page also ends when the person who connected it is no longer its Super admin.
• TikTok: Settings and privacy → Security → Manage app permissions → Remove access.
• Pinterest: Settings, where the apps that have access to your account are listed.
• Other platforms: remove our users, staff accounts, API keys or installed apps in the platform’s settings.

You can also email privacy@wprime.studio and we will disconnect our access for you. Removing access stops new data collection. For accounts connected through WPrime Connect, Section 6.14 explains what happens to the data we already hold and how to have it deleted. For other accounts, to have data we already hold deleted, send us a request (Section 14).

6.11 WPrime Connect: accounts our clients connect themselves

WPrime Connect is our application that lets a client connect its own business accounts on Facebook, Instagram, Threads, YouTube and LinkedIn to WPrime Agency, see the status of each connection and disconnect it. TikTok and Pinterest become available after each platform approves our app; until then the link page shows them as “Not available yet”, and the parts of this policy that describe them apply once they are available. WPrime Connect is reached through a personal link that we send to the client (it starts with connect.wprime.studio/c/) and is described at wprime.studio/apps/connect/.

How a connection works. The client’s link lists only the networks the client asked us to work on. The client’s authorized administrator presses a button for a network, signs in on that network’s own page and chooses what to share. The network then returns an access token to WPrime Connect. We never see or ask for the client’s passwords. Where the network gives access to more accounts than the client wants to share, the client chooses the accounts, and we record and work only with the accounts the client chose. A link can be used to connect accounts for 14 days. After that, the link page still shows the status of the accounts connected with it and still lets the client disconnect them, unless WPrime has cancelled the link.

Who should connect. The person who connects an account must be its owner or an administrator authorized by the client to grant this access. For LinkedIn, this must be a Super admin of the client’s LinkedIn Page who works for the client, not a WPrime employee.

What we use the data for. Only to provide the social media services the client has engaged us for under our agreement with the client:

• showing the client’s own posts, comments and performance statistics to the client and to the WPrime staff assigned to the client;
• preparing reports on the client’s own accounts;
• drafting posts and replies for the client, which a person reviews before anything is published;
• carrying out the requests the client makes in its dashboard, after a WPrime team member approves them (see “Dashboard and approvals” below);
• keeping the connection working (checking and refreshing access) and keeping our systems secure.

What we never do with this data. We do not sell it. We do not use it for advertising or ad targeting, or to market to the people it describes. We do not combine one client’s data with another client’s data, compare clients with each other, or use one client’s data to benchmark or research competitors. We do not build or enrich profiles of individual people. We do not use it to train, fine-tune or otherwise develop artificial intelligence or machine learning models. We do not download videos from the networks, and we do not move a client’s content from one network to another unless the client asks us to publish it there.

Dashboard and approvals. The client’s link also opens the client’s dashboard. The dashboard first opens from a link that is still valid for connecting, and it stays available for 90 days from the day the link was created, unless WPrime extends it. It shows the connected accounts with their recent posts, comments and statistics. The dashboard fetches this information from the network when it is needed and keeps it in a temporary cache for no more than 24 hours (one hour for Pinterest). If the client connected an account with the “Reports and publishing” option, the client can also ask us to take these actions:

• Facebook Page: publish a text, link or photo post; edit or delete a Page post; reply to or hide a comment.
• Instagram: publish a single-photo post; reply to or hide a comment.
• Threads: publish a text or photo post; reply to a reply; hide a reply.
• LinkedIn Page: publish, edit or delete a post; reply to a comment.
• YouTube: reply to a comment. WPrime Connect does not upload or edit videos.
• TikTok (when available): reply to or hide a comment. WPrime Connect does not publish videos.
• Pinterest (when available): create, edit or delete a Pin on one of the client’s existing boards.

WPrime Connect does not publish videos on any network. We carry out a client’s request on the network only after a WPrime team member approves it, after confirming it with the client. The only exception is WPrime’s own test accounts in a demonstration organization that we use for the networks’ app reviewers: requests on those accounts are approved automatically.

If a connection stops working. Our team is alerted and will contact the client. The client’s link page shows that the connection needs attention. After the link’s 14-day connection window, the client may need a new link to reconnect.

Cookies. WPrime Connect uses only strictly necessary cookies: a dashboard session cookie (__Host-wprime_cab, HttpOnly, for up to 30 days), short-lived cookies that tie each network sign-in to your browser for security (they expire within about 30 minutes) and a short-lived cookie for the screen where you choose accounts. WPrime Connect does not use analytics or advertising cookies. Cookies on our Website are described in Section 4.

Who can see it. The client’s own people, through their WPrime Connect link, dashboard and reports, and the WPrime staff assigned to that client. Data about members of one client’s audience is shown only to people associated with that client.

Sections 6.3 to 6.7 above describe each network.

6.12 How long we keep data from connected accounts

This section applies to accounts that clients connect through WPrime Connect. WPrime Agency’s own accounts are covered by Section 7.

We keep data received from a connected account only as long as we need it to provide the services to the client, and never longer than the limits below or the network’s own rules allow. Our team applies these limits with an internal retention tool.

When a connection ends. A connection ends when the client presses Disconnect on its link page or dashboard, when Facebook, Instagram or Threads sends us a deauthorization or deletion request for that account, when the client emails privacy@wprime.studio to disconnect it or to have the data deleted, or when we disconnect the client’s accounts because our agreement with the client has ended. We then stop collecting data from the account, delete the access token within minutes, and delete the stored data within the period in the right-hand column of the table.

When access is removed in a network’s settings. If a client removes our access in its Google, LinkedIn, TikTok or Pinterest settings, or removes a connection made through a Meta business portfolio, the network rejects our token and our access stops. This does not end the connection in our system by itself, because the network does not tell us about it. We check every connection daily. When we find that access was removed, we stop collecting data from that account and contact the client to confirm whether to delete the data we hold. The limits in the middle column keep applying in the meantime.

Dashboard cache. Posts, comments and statistics that the dashboard shows are kept in a temporary cache for no more than 24 hours (one hour for Pinterest), and are also removed when the connection is no longer active.

Dashboard requests. When a client makes a request in the dashboard, we keep a record of it: what was requested, the text, link and image the client provided, the account it was for, and who approved it and when. We keep these records with our client records (Section 12), with these exceptions: images are deleted within 7 days after the request is completed; the excerpt of the comment a request refers to is deleted within 48 hours for LinkedIn, TikTok and Pinterest, and within 30 days after the request is completed for other networks; the LinkedIn Page name in a request is deleted within 8 weeks; and Pinterest requests are handled as described in the table.

Connection records. To keep a connection working, we store the identifiers and names of the connected accounts (for example the Page, channel or profile name) while the connection is active, and delete them within the period for that network after the connection ends.

Reports and backups. Reports we have already delivered to the client belong to the client. We keep our copies under the client records rules in Section 12, except where a network’s rules above require deletion. Our platform database is backed up nightly in encrypted form. Data deleted under this section can remain in those encrypted backups until the backups expire as described in Section 12. We never restore backups to use deleted data.

6.13 AI processing, service providers and storage for connected accounts

AI processing. We use Anthropic’s Claude models, through Anthropic’s commercial API, to help our team draft posts and replies and analyze the performance of a client’s own accounts. Anthropic, PBC acts as our service provider and processes this data in the United States. Under its commercial terms it may not use our data to train its models. For connected accounts, AI providers receive only:

• the client’s own content (its posts, captions, video titles and descriptions) and its brand materials;
• aggregated performance statistics for the client’s own accounts; and
• for Facebook, Instagram, Threads and YouTube only, the text of a comment the client wants to answer, without the commenter’s name, username, photo or ID, so that our team can draft a reply that a person reviews before it is sent.

We never send information about the people who comment on or follow a client’s LinkedIn, TikTok or Pinterest accounts to AI providers, including their comments, names, usernames, photos and IDs. AI output is always reviewed by a person before it is published. We do not use any data from connected accounts to train, fine-tune or otherwise develop AI models.

Service providers. Data from connected accounts is processed on our behalf only by these service providers, which process it only to provide their services to us:

• Hostinger: servers for WPrime Connect and our internal platform, in a data center in Boston, Massachusetts, USA;
• Cloudflare R2: encrypted off-site backups, in North American storage locations;
• Anthropic, PBC: AI processing as described above, in the United States;
• Telegram: the internal tool our team uses to approve client requests and receive alerts. For each request it receives the client’s name, the account name and the content of the request, such as the post or reply text, image and link, and the excerpt of the comment being answered. We do not use it for marketing.

Where data is stored. Data from connected accounts, and our records about those connections, is stored primarily in the United States. Our team members may access it remotely from other countries to provide our services (see Section 10).

Access tokens. Access tokens are kept in an encrypted secrets vault on our own servers and are never shown to staff, sent by email or chat, or written to logs. Our internal alerts about the health of a connection (for example, “a connection needs to be renewed”) name only the client, the network and our internal connection number.

6.14 Disconnecting an account and deleting its data

• Disconnect on your link page or dashboard. Open the link we sent you, or your dashboard, and press Disconnect next to an account connected with that link. The account shows “Disconnecting” and the disconnection completes within minutes: we stop collecting data, delete the access token and, where the network lets apps revoke access (Facebook and Instagram connected with a personal account, Meta ad accounts connected with a personal account, YouTube and TikTok), also revoke our access at the network. For Threads, LinkedIn, Pinterest and connections made through a Meta business portfolio, our app may still appear in the network’s settings until you remove it there; our token is deleted in any case. Disconnect on the link page keeps working after the link’s 14-day connection window, but not if WPrime cancelled the link. Data we already hold is deleted as described in Section 6.12.
• Accounts connected with a different link. The link page and dashboard can disconnect only the accounts connected with that link. For any other account, email privacy@wprime.studio and we will disconnect it for you.
• Removing access in the network’s own settings (Section 6.10) stops our access, because the network rejects our token, but it is not the same as Disconnect. To have us delete the data we hold, press Disconnect or email privacy@wprime.studio. The exception is Facebook, Instagram and Threads: removing our app there sends us an automatic deauthorization or deletion request, which we handle like Disconnect and which comes with a confirmation code and a status page. Connections made through a Meta business portfolio cannot be identified from that request; for those, press Disconnect or email us. If we find during our daily check that access was removed at any other network, we stop collecting data and contact you to confirm whether to delete it.
• Deletion requests. To ask us to delete data about you or your accounts, follow Section 14 or our Data Deletion page.

7. Our own social media accounts

We manage WPrime Agency’s own accounts on Facebook, Instagram, Threads, LinkedIn, TikTok, Pinterest and YouTube through their official APIs, using our internal social media tools. The same tools serve the clients who connect their accounts through WPrime Connect (Section 6.11); each client’s data is kept separate and is used only for that client. Sections 6.11 to 6.14 describe client accounts; this section describes WPrime Agency’s own accounts.

• What we receive. If you comment on, reply to, mention or message one of our accounts, we receive the content of your interaction, the time it was made, and the profile information the platform provides about you, such as your name, username, profile picture and the ID the platform assigns. We also receive statistics for our accounts and posts and aggregated audience statistics that do not identify individuals. Where a platform’s API allows it, we review public information about other business accounts, such as their public posts and public metrics, to plan our own content.
• Human approval. A member of our team reviews and approves every post and every reply before it is published. The tool does not publish or reply to anyone on its own. The only exception is WPrime’s own test accounts in the demonstration organization that the networks’ app reviewers use (Section 6.11), where requests are approved automatically.
• How we use it. To publish our content, answer comments and messages, measure how our content performs, run internal analytics, and train our team to manage our accounts, for example by reviewing real comments and our replies. “Training our team” means training people, not AI models.
• AI. We use AI models to draft posts and replies and to summarize and categorize comments (see Section 8). Summaries and labels describe comments and conversations, not the people who wrote them, and we do not combine this data with information about the same person from other sources.
• Retention. We keep this data for as long as we use it for the purposes above and as each platform’s terms allow. The limits in Section 6.12 apply to the accounts our clients connect, not to WPrime Agency’s own accounts. You can ask us to delete data about you at any time (Section 14).

8. Artificial intelligence and automated processing

We use AI tools to work faster and more accurately. For example, we use them to draft and edit content, transcribe and summarize meetings, summarize and categorize comments and messages, analyze performance data, prepare reports and search our internal knowledge.

• Providers. We use AI models from providers such as Anthropic, OpenAI, Google and Perplexity through their business (API) services. Each provider receives only the data a task needs, processes it as our service provider, and under its terms may not use our data to train its models.
• No model training. We do not use personal information, client data or platform data to train or fine-tune AI models.
• Human oversight. AI output is reviewed by our team before it is used in client work or published.
• No significant automated decisions. We do not make decisions that produce legal or similarly significant effects on you, such as hiring decisions, based solely on automated processing.

9. How we share information

We share personal information only in the following cases:

• Service providers that process data on our behalf, under written obligations to protect it and to use it only to provide services to us. These include:
  • hosting, infrastructure, security and backup providers (such as Hostinger and Cloudflare);
  • email and productivity providers (such as Google and Hostinger);
  • project management, communication and meeting tools (such as ClickUp, Zoom and Telegram);
  • payment, banking, invoicing and electronic signature providers (such as Stripe, PayPal, Mercury and Documenso);
  • password and secrets management providers (such as 1Password);
  • AI model providers (see Section 8);
  • website analytics, security and advertising measurement providers (see Section 4), and IP geolocation services.
• Our clients. We share data received from a client’s accounts with that client, and we share reports and deliverables with the people the client designates.
• Platforms. When we publish content, run campaigns or update listings, we send that content to the platform where it appears, and we share data with the platform it came from where needed to provide the service.
• Subcontractors and partners. Contractors who work on a client project under confidentiality obligations, only to the extent needed for that project.
• Legal reasons. When required by law, regulation, court order or other valid legal process, or to protect the rights, safety and security of our clients, users, staff, WPrime Agency or others.
• Business transfers. In connection with a merger, acquisition, financing or sale of assets, in which case the information remains subject to this policy.
• With your consent or at your direction.

We do not sell or rent personal information, and we do not give data received from platforms to advertisers or data brokers.

10. Where we store information and international transfers

We are based in the United States. We store and process information primarily on servers located in the United States, and seller and customer data received through the TikTok Shop API is stored and processed in the United States. Some of our service providers may process information in other countries. If you contact us or use our services from outside the United States, your information will be transferred to and processed in the United States. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses or the EU-U.S. Data Privacy Framework used by our providers.

11. How we protect information

We protect personal information with administrative, technical and physical safeguards appropriate to its sensitivity, including:

• encryption in transit (HTTPS/TLS) for our Website, internal systems and connections to platform APIs;
• access limited to staff who need it for their work, with individual accounts, role-based access controls in our databases and single sign-on for our internal tools;
• passwords, API keys and access tokens kept in a password manager or secrets vault and on our servers, never sent by regular email or chat;
• key-based authentication for server administration, firewalls and protection against denial-of-service attacks;
• encrypted off-site backups, with restore tests run regularly;
• monitoring of our websites and systems for availability and security issues, and regular security updates; and
• confidentiality obligations for our staff and contractors.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach affects your personal information, we will notify affected clients, platforms, individuals and authorities as required by law and by our platform agreements.

12. How long we keep information

We keep personal information only as long as we need it for the purposes described in this policy, or as long as the law requires. When we no longer need it, we delete it or de-identify it.

13. Your privacy rights

13.1 Rights available to everyone

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy of it, in a portable format where possible;
• correct inaccurate or incomplete information;
• delete your information (Section 14);
• stop sending you marketing communications; and
• withdraw any consent you have given us, without affecting processing that took place before you withdrew it.

We will not discriminate against you for exercising any of your privacy rights. Some rights have legal exceptions, for example when we must keep information to meet legal obligations. If we cannot fully meet your request, we will explain why.

13.2 California residents

If the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), applies to our processing of your personal information, you have the following additional information and rights.

Personal information we collected in the last 12 months:

Sensitive personal information. We do not intentionally collect sensitive personal information, and we do not use or disclose it to infer characteristics about you.

Sources, purposes and retention. We collect personal information from the sources described in Section 3, for the purposes described in Sections 5 to 8, and keep it as described in Section 12.

Sale and sharing. We do not sell personal information for money. Our Website uses advertising and analytics cookies and pixels from third parties such as Google and OpenAI (Section 4). Under the CCPA, allowing these third parties to collect information about your activity on our Website may be considered a “sale” or “sharing” of personal information for cross-context behavioral advertising. You have the right to opt out. To opt out, choose “Decline” in our cookie banner, block these cookies in your browser, or email privacy@wprime.studio with the subject “Do Not Sell or Share”. We have no actual knowledge of selling or sharing the personal information of consumers under 16.

Your rights. You have the right to know what personal information we collect, use, disclose, sell or share and to access it; to delete it; to correct inaccurate information; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information (we do not use it); and not to be discriminated against for exercising these rights.

Authorized agents. You can use an authorized agent to make a request for you. We may ask the agent for proof that you authorized them and ask you to verify your identity directly with us.

“Shine the Light”. We do not disclose personal information to third parties for their own direct marketing purposes.

13.3 Residents of other U.S. states

Depending on the state you live in (for example Colorado, Connecticut, Oregon, Texas, Utah or Virginia), you may have the right to confirm whether we process your personal information, access it, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, the sale of personal information and certain profiling. To exercise these rights, follow the steps in Section 13.5. If we decline your request, you can appeal by replying to our decision with the word “Appeal” in the subject line. We will respond to your appeal within the time required by your state’s law. If your appeal is denied, you may contact your state’s Attorney General.

13.4 Visitors from the EEA, the United Kingdom and Switzerland

If the EU or UK General Data Protection Regulation or Swiss data protection law applies to our processing of your personal information, we rely on the following legal bases:

• Contract: to respond to your requests before entering into a contract and to provide services to our clients;
• Legitimate interests: to run and improve our business, Website and services, manage our own social media accounts, keep our systems secure and prevent fraud, where these interests are not overridden by your rights;
• Consent: for non-essential cookies and similar technologies, and for marketing where consent is required. You can withdraw consent at any time;
• Legal obligation: to comply with tax, accounting and other legal requirements.

In addition to the rights in Section 13.1, you have the right to object to processing based on legitimate interests, to restrict processing, and to lodge a complaint with your local data protection authority.

13.5 How to make a request

• Email privacy@wprime.studio with the subject “Privacy Request”, or write to us at the address in Section 19. Tell us what you are asking for and how we can reach you.
• We may need to verify your identity before responding. We do this by matching the information you give us with the information we hold, and we may ask you to confirm control of your email address or social media account. We use the information you give us for verification only for that purpose.
• We acknowledge requests within 5 business days and respond within 30 days, or sooner where the law requires. If we need more time where the law allows it, we will tell you why and how much longer we need.
• If your information reached us through a business that uses our services, we will work with that business to respond to your request.

14. How to ask us to delete your data

Anyone can ask us to delete the personal information we hold about them, including data we received from TikTok, Facebook, Instagram, Threads, LinkedIn, Pinterest, YouTube or any other platform.

If you connected accounts through WPrime Connect, you can also disconnect them yourself on your WPrime Connect link page or dashboard (Section 6.14). For those accounts, where Section 6.12 sets a shorter deletion period (for example 7 days for YouTube and 10 days for LinkedIn), we follow it. Our Data Deletion page explains every way to remove our access and have your data deleted, including requests sent through Facebook.

1. Email privacy@wprime.studio with the subject “Data Deletion Request”. Include your name, the email address or phone number you used with us, and, for social media data, the platform and your username or a link to your profile.
2. We acknowledge your request within 5 business days. If we need to confirm that the data is about you, we will tell you how, for example by asking you to send a short message from the account in question.
3. We delete the data from our active systems within 30 days after we receive your request, or after you confirm your identity if we needed to verify it. Deletion covers every copy in our active systems, including AI-generated summaries and reports that identify you.
4. We email you to confirm what we deleted. If we must keep some information, for example to meet legal obligations, we will tell you what and why.

Copies in backups are not restored or used for any other purpose and are deleted when those backups expire (Section 12). Deleting your comment or message on a platform removes it from that platform but does not delete the copy we may already hold, so please send us a request. Deleting data we hold does not delete data stored by the platform itself; to delete your content on a platform, use that platform’s own tools. If you are a customer of one of our clients, we will forward your request to that client and help them respond.

15. Job applicants

When you apply for a job with us, we use the information you provide (Section 3.1) and any information you make available in links you share, such as your LinkedIn profile or portfolio, to evaluate your application, communicate with you and, if you are hired, prepare your engagement. Only the people involved in hiring can see your application. We do not make hiring decisions based solely on automated processing. Please do not include sensitive information, such as government ID numbers, health information or information about your race, religion or sexual orientation, in your application. We keep applications as described in Section 12.

16. Children’s privacy

Our Website and services are intended for businesses and are not directed to children under 13 (or under 16 where applicable). We do not knowingly collect personal information from children. If you believe a child has given us personal information, for example by commenting on one of our social media accounts, contact us at privacy@wprime.studio and we will delete it.

17. Third-party websites and services

Our Website contains links to other websites and social media platforms, and our services use third-party platforms. These third parties handle personal information under their own privacy policies, and we are not responsible for their practices. We encourage you to read the privacy policies of the platforms you use, including those linked in Section 6.

18. Changes to this policy

We review this Privacy Policy at least once a year and update it when our practices change. We will post the updated version on this page and change the “Last updated” date above. If we make a material change, we will also post a notice on the Website and, where appropriate, notify our clients by email.

19. Contact us

If you have questions or concerns about this Privacy Policy or our privacy practices, contact us:

WPrime Web Solutions LLC, an Illinois limited liability company operating under the brand name WPrime Agency
Mailing address: 222 W Merchandise Mart Plaza, Suite 1212, Chicago, IL 60654, USA
Privacy contact: privacy@wprime.studio
General inquiries: hello@wprime.studio · +1 (708) 887-3040