Privacy Policy

1. Introduction and Who We Are

Wiggle BOS ("Wiggle") is a business operating system for start-ups and small to medium businesses, built and run by Floof Digital LLC ("Floof Digital," "we," "us," or "our"), based in Indiana, United States.

This Privacy Policy explains what information Wiggle collects when you use the app at app.wigglebos.com, the product pages at wigglebos.com, the public demo at demo.wigglebos.com, and the proposal pages, booking pages, forms and websites that Wiggle hosts for its customers. It covers how we use that information, who we share it with, and the choices you have. The Floof Digital Privacy Policy covers the rest of floofdigital.com and our consulting services.

Your use of Wiggle is also governed by our Terms of Service.

2. Your Business Data Belongs to You

Wiggle is built on one promise: your business, your data, always. Everything your team enters or connects, and every insight Wiggle produces from it, belongs to your business. You can export all of it at any time, in open and documented formats, and take it to any other platform (see section 11).

That shapes two different roles we play:

• Your account. For the people who sign in to Wiggle and the business that pays for it, Floof Digital decides how that information is used. This policy tells you how.
• Your workspace content. For the information your business puts into Wiggle about its own customers, leads and contacts, your business decides how it is used and Floof Digital processes it only to run Wiggle for you. If you are one of a Wiggle customer's contacts, the business you deal with is responsible for your information, and requests about it are best sent to them first. We will help them respond.

3. Information We Collect

Account Information

When you are invited to or sign up for Wiggle, we collect your name, email address, business name, the role you hold in the workspace, and optionally your job title, phone number and a profile photo. When you sign up we also record that you accepted our Terms of Service and this policy (the version and the time), and a coded, one way form of your IP address to prevent abuse. Photos you upload have their hidden location and camera details removed before they are stored.

If you sign in with Google, Microsoft, Facebook or LinkedIn, we receive your name, your email address, whether that address is verified, and which service you used. We use these only to sign you in and to show your name in the workspace. We never receive your password for those services. Our sign-in provider may also receive a link to your profile picture from them; Wiggle does not use it.

Workspace Content

Wiggle stores what your team puts into it, which can include:

• Customers, leads, contacts and accounts, with their names, email addresses, phone numbers, job titles, company details and notes
• Deals, projects, tasks, meetings and the activity timeline
• Emails sent to and from your workspace inbox, including their contents and attachment names
• Email you forward or BCC to your workspace address: the message, its sender, recipients and attachments' names, filed against the matching contact, or held in your Inbox for review.
• Proposals, agreements, signed documents, uploaded files, images and the websites you build
• Your business profile, voice guide, scorecard, goals and business checkup answers
• Your conversations with Romey, the Wiggle AI assistant
• Images and videos your team uploads, with a record that the uploader confirmed they own them or have permission to use them, and that hidden location and camera details were removed
• Contacts your team imports from a file, a Google Sheet, LinkedIn, Monday.com, Asana or another CRM. For 30 days after an import, Wiggle keeps a record of what it created or changed, including the values before the change, so the whole import can be undone
• A photo of a business card you scan with the phone app, which Wiggle reads with its AI provider to fill in a draft contact
• Files your team attaches from Dropbox, OneDrive or Box: either a link to the file, or, if you choose to save a copy, the file itself
• Email campaigns your team sends: the recipients, each email's delivery status, and unsubscribe, bounce and complaint records, so Wiggle never emails someone who opted out. Wiggle does not track opens or clicks in campaign emails
• Fields and record types your team creates for itself, and whatever it stores in them
• Feedback you send from inside Wiggle, including the page you were on and, only if you choose to add one, a screenshot. Feedback is emailed to our support mailbox

Your LinkedIn Export

If you upload the data export LinkedIn gives you, Wiggle reads only the files it needs: your connections (to import as contacts) and, if you ask Wiggle to learn your writing voice, your profile headline and summary, recommendations you wrote and, only if you tick the box and confirm which profile is yours, the messages you sent. Wiggle never reads other people's messages, ignores every other file in the export, and discards the file once it has been read.

Before You Have a Workspace

Free Business Checkup: the website address you enter, the answers you give, a coded form of your IP address to prevent abuse, and, only if you ask us to email the report, your email address and your agreement to hear from us. We read the public pages of that website the way a search engine does, following its robots.txt. Checkups that do not become a Wiggle workspace are deleted after 90 days.

Services You Connect

Wiggle only reaches into another service when someone in your workspace connects it, and each connection can be removed at any time from Settings, then Connections.

• Google Calendar: your email address and name, and the busy times on your primary calendar so the booking page offers only free slots. Wiggle adds meetings people book to your calendar and invites the attendees. To keep your meetings and deals up to date, Wiggle also reads the events on your primary calendar from yesterday to two weeks ahead: each event's title, time, location, meeting link and attendees' names and email addresses, checked every few minutes and when Google tells Wiggle something changed. Wiggle keeps only meetings with people who are already contacts in your workspace, and may suggest a new contact when a colleague of one of them is on the invite. Other events are not stored.
• Microsoft 365: your profile, your calendar, and your mail. Wiggle reads your calendar the same way as Google Calendar above: busy times for booking, and the title, time, location, meeting link and attendees of events from yesterday to two weeks ahead, keeping only meetings with your contacts. Every few minutes Wiggle checks your Inbox and Sent Items and files only the messages exchanged with customers and contacts already in your workspace onto their records, keeping the sender, recipients, subject and body. Every other message is ignored and is not stored. Mail filing can be switched off for each connection. Wiggle adds booked meetings to your calendar with a Teams link. If you sign in with or connect a Microsoft account, you can review or remove Wiggle's access at any time at account.live.com/consent/Manage (personal accounts) or myapps.microsoft.com (work or school accounts).
• SharePoint: if you attach a file from SharePoint, Wiggle uses your Microsoft connection, with an extra permission you approve the first time, to list the sites, libraries and files you can open, only while you are choosing. It keeps the file you pick, as a link or a copy.
• OneDrive: if you attach a file from OneDrive, Wiggle uses your Microsoft connection to list and search your own files (never files others shared with you) and reads the chosen file's name, size, type and link. It saves either the link or, if you choose, a copy of the file.
• Google Drive: when you attach a file, Wiggle can open only the files you pick in Google's file picker, never the rest of your Drive. It keeps a link to each one, or a copy if you choose. If you choose Open in Google Sheets for a list, Wiggle creates that Sheet in your own Drive, and each export is recorded in your workspace's access log.
• Dropbox: when you attach a file, you pick it in Dropbox's own window, and Wiggle receives the file's name, size and link. It saves either the link or, if you choose, a copy of the file.
• Box: when you attach a file, Wiggle uses your read-only Box connection to list and search your folders so you can pick one, and receives the file's name, size and link. It saves either the link or, if you choose, a copy of the file. Disconnecting Box removes Wiggle's access; files already attached stay until you delete them.
• HubSpot: if you import from HubSpot, Wiggle reads your contacts, companies, deals and their owners, read only, to create them in your workspace. It keeps an undo record for 30 days, like any import.
• Zoho Mail: works like Microsoft 365 mail filing. Every few minutes Wiggle checks your Inbox and Sent folders and files only the messages exchanged with contacts already in your workspace; every other message is ignored and not stored. A filed message's full text is visible only to the mailbox owner; the rest of the team sees a line on the timeline. Wiggle asks for permission to send from Zoho only if you turn sending on.
• Outlook add-in: when you open an email with the Wiggle add-in, it reads the sender, recipients, subject and date to show the matching contact and deals. It reads the message body only when you click Log this email; the logged email is visible only to you, with a line on the timeline for your team.
• Contacts you import from Google or Microsoft: only when you choose to import them, Wiggle asks for separate permission to read your Google contacts and "other contacts" (people you have emailed), or your Microsoft 365 contacts. It reads names, email addresses, phone numbers, companies and job titles, shows them to you to choose from, and stores only the ones you import. You can remove the permission by disconnecting the service.
• People you email with: if you connected Microsoft 365 mail and ask for suggestions, Wiggle reads the sender and recipient details of the last 180 days of your Inbox and Sent Items (not the message contents) to suggest people you correspond with. It shows them to you to choose from and stores only the contacts you import.
• Google Business Profile: the locations you choose, with their details, posts, reviews, reviewer names and search performance. Wiggle posts updates and review replies only when a person in your workspace approves them. Reviews are shown to you but not stored.
• Facebook Pages and Instagram: your Facebook user ID and name, the Pages you choose, the Instagram account linked to each, and follower and performance figures. Wiggle posts to a Page or Instagram account only when a person in your workspace approves it, or automatically when the workspace owner has turned on auto-sharing of the workspace's own published blog posts. Our Facebook data deletion page explains how to remove this.
• LinkedIn Pages: your LinkedIn member ID (and your name, when LinkedIn shares it), the company Pages you choose, and follower and post figures. Wiggle posts to a LinkedIn Page only when a person in your workspace approves it, or automatically when the workspace owner has turned on auto-sharing of the workspace's own published blog posts.
• QuickBooks, Xero and Zoho Books: Wiggle creates the customer and records the sale or invoice when a customer pays you through Wiggle. If you use Financial health, Wiggle also reads your profit and loss, money owed to you, bank account balances and sales by customer, and keeps a summary in your workspace so you can see them next to your pipeline. Reading never changes anything in your books.
• Stripe, Square and PayPal: if you connect them, Wiggle reads your payments, refunds, customers, subscriptions and, for Stripe, your balance and payouts, and keeps a summary in your workspace next to your other figures. Wiggle only reads; it never moves money or changes anything in those accounts. Only people you allow to see finances can see these figures. Disconnecting Square deletes the summary Wiggle kept from it.
• Online stores (WooCommerce, Square and, when available, Shopify): if you connect a store, Wiggle reads your orders and keeps only a summary for each buyer: their name, email address, number of orders, amount spent, and first and last order dates, linked to the matching contact. It does not keep order lines, addresses or payment details. For Square, the buyer summary is kept only if you choose it. Only people you allow to see finances can see these figures, and disconnecting a store deletes its summary.
• Stripe, when you collect payments: when your clients accept a proposal, they give their payment details directly to Stripe on your Stripe account. Wiggle never sees or stores card or bank numbers; it keeps the billing records (invoices, amounts, dates and status) in your workspace.
• DocuSign: your DocuSign account name and email, to link the account. When you send a document for signature, DocuSign receives the document, your message and each signer's name and email address. Wiggle keeps the envelope's status and signers and, once it is signed, stores DocuSign's signed copy privately in your workspace.
• Canva: each person connects their own Canva account. Wiggle lists your designs so you can pick one, and stores only the designs you import, as images, with a note of where they came from. Canva designs are never sent to an AI feature.
• Mailchimp, Klaviyo and Brevo: the name and email address of contacts in your workspace who have agreed to receive marketing from your business, and which list they join. Wiggle adds only those contacts, and, when double opt-in is on, the service asks each one to confirm first.
• Slack, Zapier, Make and other webhooks: when you connect them, Wiggle sends the events you choose (for example a new lead or a won deal), with the deal title, value, the contact's name and email and, for webhooks, phone number, and a link back to Wiggle, to the channel or address you set.
• Zapier, Make and the Wiggle API: when you authorize Zapier or Make, or create an API key, the apps you connect can read and change the records the access you granted covers, such as contacts, deals and tasks, and receive the events you choose. Every change they make is recorded in your workspace, and you can remove their access at any time in Settings.
• Zoom: if you connect Zoom, Wiggle receives the transcript Zoom makes of your recorded meetings, with the meeting topic, time and participants' names and emails. Wiggle writes a summary and suggested next steps, files them against the matching customer, and discards the transcript unless you choose to keep full transcripts. Zoom only provides transcripts on its paid plans with cloud recording turned on. Participants in your meetings should be told that the meeting is recorded and summarized; your business is responsible for that notice.
• Granola: if you connect Granola with your own Granola key, Wiggle receives the summary, title, time and attendee names and email addresses of the meetings Granola sends, and files them on the matching customer or in your Inbox. Wiggle does not receive recordings or transcripts from Granola. Disconnecting removes Wiggle's link at Granola.
• Your website (WordPress, and when available WordPress.com or Wix): if you connect your site, Wiggle keeps, sealed, the password or access key your site issues just for Wiggle. It sends the blog posts you publish in Wiggle, with their cover images, and keeps each post's address on your site. Disconnecting removes Wiggle's access on both sides.
• Calendly: the event types you choose and the name, email and answers of people who book, so each booking becomes a lead or a meeting in your workspace.
• SEO health: Wiggle reads the public pages of your website on the schedule you choose, and Google's PageSpeed Insights measures your homepage's speed. The findings are kept in your workspace.
• Google Search Console and Google Analytics: if you connect them, Wiggle reads your website's search and traffic figures, such as clicks, impressions, the searches and pages people find you through, visits and conversions, and keeps daily totals and top lists in your workspace. Wiggle only reads; it never changes your Google settings.
• Cloudflare: if you paste a read-only Cloudflare access key, Wiggle reads your domains, their DNS records and traffic totals. It never changes your DNS.
• Company logos: to show a company's logo in your lists, your browser loads it from Logo.dev using only the company's own web address (for example harborpine.com), never a person's name or email address. Logo.dev also sees that the request comes from Wiggle, and keeps nothing for us.
• Stock photos and video: when your team searches for images, the search words are sent to Pexels, Pixabay or Unsplash. Images you choose from Pexels and Pixabay are copied to your website's storage. Unsplash images stay on Unsplash's servers, and Unsplash is told when one is chosen, as its rules require. Wiggle records where every stock image came from, who made it and its license, and credits the photographer on your published pages.
• Payroll alerts: if you connect your payroll provider (Gusto directly, or Paycor, Paylocity, ADP, Paychex or QuickBooks Payroll through our service provider Finch), or type in your pay schedule, Wiggle reads and keeps only a summary: your pay schedule, the next pay day and approval deadline, how many people are paid, and the total cost of your last payroll. We do not collect or keep any individual's pay, pay stubs, dates of birth, Social Security numbers, bank details or tax IDs. Only people you allow to see your finances see payroll in Wiggle. Payroll information is not sent to our AI features. When you disconnect, we revoke our access and delete the summary.

AI Assistants You Connect (Claude and ChatGPT)

You can choose to connect Wiggle to an AI assistant you use, such as Claude (made by Anthropic) or ChatGPT (made by OpenAI). Before the connection is made, you confirm that you understand the assistant will be able to read the Wiggle data you ask it about, and that once it has read that data, it is handled under the assistant company's own terms and privacy policy, not ours. We record that confirmation, with its wording, the time and the assistant you chose.

• The connection is read-only. The assistant can read your business profile, contacts, companies, deals, pipeline, activity (email subjects, never email contents) and scorecard, limited to what your own role in the workspace can see. Money figures are shared only if you have finance access.
• Every read is recorded in your workspace's access log.
• Wiggle stores only a coded form of the connection's access keys. You can disconnect an assistant at any time in Settings, which ends its access immediately. Disconnecting does not delete what the assistant already read; that is up to the assistant company and your settings with it.

The access keys these services give Wiggle are stored in our database so the connection keeps working. They are never included in exports, and disconnecting deletes them.

Notifications and Text Alerts

• In-app and email notifications: notifications are kept for 90 days. Summary emails list the titles of your notifications and are sent through Resend.
• Phone app notifications: if you allow notifications in the Wiggle phone app, we store a coded device token so Apple or Google can deliver them. Unless you turn on Show names, a notification shows only a general title. The token is deleted when you sign out or when Apple or Google tell us it is no longer valid.
• Text alerts: if you turn on text alerts, we store your mobile number encrypted, confirm it with a 6 digit code, and keep a record of your consent and of any STOP, HELP or START reply, with the wording you agreed to, for 4 years. Texts are sent through Twilio and never include names, amounts or customer details. Reply STOP at any time to end them. Mobile numbers and text consent collected for Wiggle text alerts are used only to send those alerts. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes, and text consent data is never sold or shared.

The Public Demo and Waitlist

• Starting the demo or joining the waitlist: we ask for your work email, record that you accepted our Terms of Service and this policy (the version and the time), and use a coded form of your IP address to prevent abuse. Your email is added as a lead in Floof Digital's own Wiggle workspace, so we can follow up about Wiggle. If you join the waitlist, we will email you once when the demo opens. We send you other news only if you tick the box to receive it, and you can unsubscribe at any time.
• Inside the demo: everything in the demo is sample data. What you type into it is stored only in that demo workspace, which is deleted when you end the demo, after 2 hours, and every night in any case. The demo does not send email or texts, connect to other services, or take payments. Romey questions in the demo go to our AI provider like any other Romey question. The demo keeps only a coded form of your email, to apply its limits. A record of actions taken in the demo (never what you typed) stays in our access log.
• Analytics in the demo: only if you agree, the demo uses Google Analytics and Microsoft Clarity to understand how it is used. Clarity records how the pages are used, such as clicks and scrolling, with the text you type masked. If you say no, or your browser sends a Global Privacy Control signal, neither loads.

Information About the People Your Business Works With

Some of Wiggle's pages are used by people who do not have a Wiggle account. When they use them, Wiggle collects the following on behalf of the business they are dealing with:

• Proposal pages: when a proposal is opened, the time, the browser and device type, and a coded, one way version of the IP address (not the address itself), so the business can see that it was read. Accepting or declining collects the name, email address and any reason given.
• Agreements and signed documents: the signer's typed name and email address, the exact consent wording they agreed to, the time, the browser and device type, and a coded, one way version of their IP address (not the address itself), kept as the record of the signature. Signed copies are stored privately and can be opened only by the business and by the signer through a link that expires.
• Booking pages and lead forms: the name, email address, phone number, company and message entered, and a coded, one way form of the IP address to prevent abuse.
• Forms: when someone fills in one of your Wiggle forms, the answers, any files they attach, the browser and device type, and a coded form of their IP address to prevent abuse are saved to your workspace.
• Client portal: when a business's client signs in to their portal with an emailed link, Wiggle records the sign-in, the browser and device type, a coded form of the IP address, and which proposals, invoices and documents they opened, so the business can see their activity.
• Websites Wiggle hosts: Wiggle adds no advertising trackers, analytics cookies or session recording to the websites it publishes for its customers. It counts page views without cookies and without storing IP addresses. Pages may load fonts from Google Fonts and, when the business chose them, images from Unsplash; those services see the visitor's IP address when they deliver them. The only cookie is set on a password protected proposal, after the right password is entered, so the visitor does not have to enter it again for 7 days. Some public forms use Cloudflare Turnstile to tell people from bots.
• Review requests (Wiggle Reviews): when a business turns this on or asks by hand, Wiggle emails its customers a request for a review, using the customer's name and email address from the business's contacts. The email links to a page with a button for each review site the business chose and a form for a private message to the business. A message sent there is stored in the business's workspace, and its owners and the teammates they choose are alerted. Wiggle notes approximate page visits and which site buttons are pressed, never whether the email was opened. For each request, the business can download a record of who was asked, when, why, the exact words sent and, for a request made by hand, the sender's confirmation that they ask every customer the same way. The record keeps the customer's first name and a coded, one way version of their email address, not the address itself. Every request has a link to stop review requests from that business, and Wiggle sends none to anyone who has unsubscribed from the business's email.

Billing Information

Wiggle subscriptions, and payments your customers make through Wiggle, are handled by Stripe. Card details are entered on Stripe's own pages and never reach our servers. We keep the plan, billing status, invoice history and the Stripe customer reference.

Technical and Usage Information

Our hosting provider records technical details of requests to Wiggle, such as the IP address, browser type, time and page requested, to keep the service running and secure. Wiggle records how many AI actions each workspace uses, and their cost, to run the monthly AI allowance, and records errors to fix problems. The Wiggle app contains no advertising pixels, analytics trackers or session recording. The public demo uses analytics only with your consent, as described above.

4. How We Use Your Information

We use information to:

• Run Wiggle and provide the features your workspace uses
• Sign you in and keep your account and workspace secure
• Send the emails you ask Wiggle to send, and service messages about your account, billing and security
• Provide support, fix problems and improve Wiggle
• Bill for subscriptions and apply the limits of your plan
• Detect and prevent fraud, abuse and security incidents
• Comply with legal obligations

We do not sell your information, we do not use your workspace content for advertising, and we do not market to the contacts your business keeps in Wiggle.

5. Romey and AI Features

Romey and Wiggle's other AI features send the information needed for each request to our AI model providers, and return the result to you. Depending on the feature, that can include account, contact and deal details, recent emails, your business profile and voice guide, review text, meeting transcripts you chose to summarize, a scanned business card, the brief you typed, and, when you ask about them, figures from the accounting, payment, Search Console and Analytics services you connected (such as income, money owed, searches and visits). AI image creation sends only the description of the image to FLUX image models run by Cloudflare Workers AI; every image it makes is labeled as AI-generated. AI video creation sends only the description of the video to Google's video model. Promo Videos: when you set up a presenter, the headshot you upload is sent to Black Forest Labs, which draws cartoon poses of that person from it. You must confirm that it is your face or that the person agreed to be in the video, and that the person is 18 or older; Wiggle records who confirmed it and when. Cutting out the face and the car or house photo, and making the video, happen on Wiggle's own servers at Cloudflare. Every promo video says "Made with AI". Photo descriptions: if your workspace uses them, a smaller copy of a photo your team uploaded is sent to our AI provider to suggest a description, what kind of image it is and where its subject sits, so Wiggle can place and crop it well; the AI is told never to identify people, and the copy is not kept. Stock photos and videos, Canva designs and payroll information are never sent to an AI model.

• AI drafts, people decide. Anything AI writes that could reach a customer or a public listing arrives as a draft for a person to approve. The one exception is auto-sharing: if a workspace owner turns it on, Wiggle shares a short recap of the workspace's own published blog posts to its connected Pages without a separate approval each time.
• No training on your data. Our AI model providers process your workspace information only to answer the request. Under our agreements with them, they do not use it to train their models, and we have asked the maker of the FLUX image models to exclude our use from training. AI image creation receives only the description you write, never your workspace records. Promo Videos is the one feature that sends a photo of a person to an AI provider, and only the headshot chosen for a presenter.
• Your conversations are yours. Romey conversations are saved in your workspace so you can pick up where you left off, and they are included in your export. You can remove a conversation from your history with Forget this conversation.

6. Google User Data

Wiggle BOS's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Information from Google is used only to provide the features you connected it for, is not sold, is not used for advertising, is not read by people except with your permission, for security, or to comply with the law, and is not used to develop, improve or train generalized AI or machine learning models.

7. Cookies and Browser Storage

The Wiggle app keeps your sign-in session, and small preferences such as a collapsed menu or the last workspace you opened, in your browser's own storage. While a Romey chat is open, the browser tab also keeps a copy of it until you close the tab; the saved history is described in section 5. The desktop app keeps an encrypted copy of recent records on your computer so it can open offline; signing out deletes it. These are needed for Wiggle to work and are not used for tracking. The Wiggle app sets no advertising or analytics cookies.

Wiggle loads some code libraries and fonts from public content networks (jsDelivr, cdnjs and Google Fonts), which see your IP address when they deliver them. On the Wiggle product pages at wigglebos.com and in the public demo, Google Analytics and Microsoft Clarity load only after you agree. If you say no, or your browser sends a Global Privacy Control signal, they do not load, and on wigglebos.com you can change your choice at any time from the Cookie settings link at the bottom of each page.

8. How We Share Information

We share information only in these circumstances:

• Service providers: companies that run parts of Wiggle for us, and may use the information only to provide their service:
  • Supabase: database and sign-in
  • Cloudflare: hosting, file storage, security, email routing, PDF creation, reading websites you ask Wiggle to read, bot checks (Turnstile) and AI image creation (Workers AI, running FLUX models made by Black Forest Labs)
  • Resend: delivering the emails Wiggle sends
  • Stripe: subscriptions and payments
  • Our AI model provider: Romey and the AI writing features (section 5)
  • Black Forest Labs: drawing the cartoon poses of a person from the headshot uploaded for Promo Videos (section 5)
  • Pexels, Pixabay and Unsplash: stock image search (section 3)
  • Google PageSpeed Insights: measuring the speed of websites you ask Wiggle to check
  • Google: video creation (section 5) and business look-ups for the reviews hub
  • Twilio: text alerts
  • Apple and Google: phone app notifications
  • Finch: connecting payroll providers other than Gusto
  • Google Analytics and Microsoft Clarity: understanding how wigglebos.com and the demo are used, only with consent
  • Logo.dev: company logos, looked up by web address only
  • Geoapify: address suggestions as you type an address, sent from our servers (not your browser)
  • Better Stack: checking that Wiggle is up (no personal information)
  This list was last updated on October 16, 2026. We will update this list, and email workspace owners, at least 14 days before adding a new provider that handles workspace content. The name of our AI model provider, and our complete list of subprocessors, is given to business customers in our Data Processing Agreement and to anyone who asks at privacy@wigglebos.com.
• Services you connect: when your workspace connects a service in section 3, Wiggle sends it what that connection needs. Your use of those services is governed by their own privacy policies.
• Inside your workspace: workspace content is visible to the people your workspace owner invites, according to their role.
• Floof Digital staff: Wiggle support opens a workspace only when its owner grants access, for the time and areas the owner chooses, and every visit is recorded in a log the owner can read. Staff may act without a grant only where needed to keep Wiggle secure or to comply with the law.
• Legal requirements: when required by law, subpoena or legal process, or to protect the rights, safety or property of our users, the public or Floof Digital.
• Business transfers: in connection with a merger, acquisition or sale of assets, your information may be transferred as part of that transaction, and this policy would continue to protect it.

9. Where Your Data Is Stored

Wiggle's database is hosted in the United States. Files and websites are stored with Cloudflare and delivered through its global network, and our service providers may process information in other countries. When information moves outside your country, we rely on our providers' contractual safeguards, such as the European Commission's Standard Contractual Clauses.

10. Data Retention

• Active workspaces: your workspace content is kept for as long as your workspace is open, unless you delete it sooner. Records you delete can be restored by your workspace owner or admins for 30 days, then they are removed for good.
• Ended subscriptions: if a subscription ends, the workspace becomes read only and your export stays available for 90 days. We then delete it, emailing its owner at least 30 days before we do. We delete it sooner when you ask us to (see section 11).
• Import undo records: kept for 30 days after an import, then removed.
• Review requests: each request, its page visits and any private message are kept for 24 months, then deleted. A request to stop review emails is kept, as a coded, one way version of the address, for as long as the business uses Wiggle, so it keeps being honored.
• Access log: the record of who viewed or changed what in a workspace (never the contents), including the records Romey and connected apps read on someone's behalf, is kept for 7 years for changes, downloads and exports, and 2 years for views.
• Notifications: 90 days. Text alert consent records: 4 years.
• Demo workspaces: deleted when the demo ends, after 2 hours, and nightly in any case. Demo and waitlist leads are kept in Floof Digital's workspace until you ask us to delete them.
• Connected services: access keys are deleted as soon as you disconnect a service, or when the service tells us you removed Wiggle.
• Exports: export files are deleted once their download link expires, after 7 days.
• Billing and transaction records: kept for 7 years, as required for tax and accounting purposes.
• Technical logs and error reports: kept only as long as needed to run, fix and secure the service.
• Backups: deleted data can remain in our database provider's daily backups for up to 7 days, and in our own encrypted backup copies for up to 14 days, until they are overwritten. Our own copies leave out sign-in details and connection keys.

11. Exporting and Deleting Your Data

Export. The workspace owner can download everything in the workspace at any time from Settings: every record as JSON and CSV files, the files you uploaded, the websites you published, and a plain description of how it all fits together. The export is never locked behind a plan and stays available if your subscription ends. Passwords and access keys are left out.

Delete. To delete your workspace, your account, or a Facebook or other connection, email privacy@wigglebos.com from the address on the account. We will confirm the request, give you the chance to take a final export, delete the data within 30 days, and write back when it is done. Records kept for legal reasons, such as billing records, are kept only for as long as the law requires. You can also remove single records, and disconnect any connected service, yourself at any time.

12. Data Security

We protect your information with encryption in transit (HTTPS everywhere), encryption at rest by our database and storage providers, role based access inside every workspace, a tamper-evident log of who viewed or changed records, encryption of connection keys and mobile numbers, private storage for signed agreements and documents, signed and verified connections for payments and webhooks, and by collecting only what Wiggle needs. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If a breach affects your information, we will notify affected workspace owners within 72 hours of becoming aware of it, and anyone else as the law requires.

13. Your Rights and Choices

Depending on where you live, you may have some or all of these rights over your personal information:

• Access: request a copy of the personal information we hold about you.
• Portability: receive your data in a portable format. For workspace content, the export does this at any time.
• Correction: correct inaccurate information. Most of it you can edit in Wiggle directly.
• Deletion: ask us to delete your personal information.
• Objection and restriction: object to, or ask us to limit, how we use it.
• Opt out: of any marketing email from Floof Digital at any time. Service messages about your account continue while it is open.

California residents have rights under the California Consumer Privacy Act, including the right to know what we collect and the right to opt out of the sale of personal information. We do not sell personal information. Residents of the European Union and the United Kingdom have rights under the GDPR, and can complain to their local data protection authority.

To exercise any of these rights, email privacy@wigglebos.com. We will respond within 30 days. If your information is in a Wiggle customer's workspace, we will pass your request to that business and help them respond.

14. Responsibilities of Workspace Owners

Businesses using Wiggle are responsible for having the right to put their customers' and contacts' information into Wiggle, and for the permission needed before adding anyone to a marketing list through a connected service such as Mailchimp or Klaviyo.

15. Children's Privacy

Wiggle is built for businesses. It is not intended for anyone under 18, and we do not knowingly collect personal information from anyone under 18. If we discover we have, we will delete it promptly.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised policy on this page and update the "Last Updated" date. For material changes, we will also tell workspace owners by email or in Wiggle before the change takes effect.

17. Contact Us

If you have questions about this Privacy Policy or how Wiggle handles your information, contact us at:

Floof Digital LLC
Wiggle BOS
PO Box 7521, Greenwood, Indiana 46142-6425
Email: privacy@wigglebos.com
Web: wigglebos.com