Privacy Policy

1. Who we are

Worcia is a US business operated by its founder, Hashim. It is not yet a registered company; it intends to register in Wyoming, and until then Hashim runs it as an individual. In this policy, "Worcia", "we", "us" and "our" mean Hashim trading as Worcia, and the company once it is formed.

For the personal data described in this policy, Worcia is the controller: we decide why and how it is used.

• Email: hello@worcia.com (opens in a new tab)
• Phone: +1 415 605 2585

We do not have a postal address yet, so please contact us by email. We will add an address to this page when we have one.

Our team works from Pakistan and serves clients worldwide, remotely. The servers that hold your data are in the European Union (France).

2. What this policy covers

This policy covers personal data we collect when you:

• visit worcia.com or use the Lab, our interactive tools and demos;
• send a form, book a call, request a report or subscribe to The Worcia Brief, our newsletter;
• email or call us;
• use Worcia Console, our client portal;
• pay one of our invoices.

It does not cover personal data we process for our clients when we build or run systems for them, such as their customers' calls, messages and CRM records. For that data the client is the controller and we act as its processor under our Data Processing Addendum. If you are a customer of one of our clients, their privacy policy applies, and you should contact them first.

3. What we collect and why

3.1 Inquiry, contact and booking forms

When you send an inquiry or request a Growth Call, we collect:

• your name, work email, phone number (optional), company and website;
• the services you are interested in, your monthly inquiry volume range, timeline and budget range, your message, your preferred call times and your timezone;
• the industry you chose on our site, if you chose one;
• where your visit started: the first page you landed on, the website that referred you, and any campaign tags in the link you followed (such as UTM parameters or an ad click identifier);
• the page you sent the form from;
• whether you agreed to marketing email, with the exact wording you saw and the time you agreed;
• a hashed version of your IP address (a one-way code that cannot be turned back into the address), used only for rate limits and abuse prevention.

We store this in Worcia HQ, our internal CRM. We use it to reply to you, prepare for and hold the call, follow up on the times you asked for, and keep a record of our conversation. We also record when we first replied, so we can measure our own response time.

3.2 Booking a call

When our booking page is configured, you book through Zoho Bookings or Zoho Calendar. Zoho receives the details you enter on its scheduler (usually your name, email address and chosen time), schedules the meeting and passes the details to us.

Until then, the booking page uses our own form: you give us three preferred times, and we confirm one by email. Either way, we send you a confirmation and reminders about the call.

3.3 Project Planner

The Project Planner in the Lab runs in your browser. Your answers live in the page address (so you can save or share the plan), in your browser tab's session storage, and in any PDF you print. We do not receive them unless you book a call with the plan attached. If you do, we store the plan with your inquiry.

3.4 Calculators

The calculators run in your browser and send us nothing while you use them. A result's shareable link contains the numbers you entered, so anyone you share it with can see them.

If you ask us to email you a report, we collect your name, email address, your inputs and the result. We create a record in Worcia HQ and email you the report. Someone from Worcia may reply to follow up. Tell us to stop at any time.

3.5 The Worcia Brief (newsletter)

When you subscribe, we collect your email address, the page you subscribed from, and the consent wording and time. We first send a confirmation email. You are subscribed only after you click the link in it (double opt-in). Every newsletter has an unsubscribe link. When you unsubscribe, we keep your email address on a suppression list so that we never email you again by mistake.

3.6 Emails we send

• Automatic replies and confirmations when you send a form, book a call, request a report or confirm a subscription.
• Notifications to Worcia containing the details of your inquiry, so a person can reply to you.
• Reminders about calls you have booked or requested.
• Marketing email, meaning the newsletter and short follow-up sequences after you use a Lab tool or download a resource from us, only if you have agreed to receive it. Every marketing email has an unsubscribe link. US law requires commercial email to include a postal address, so we send none until our postal address is in place.

Our mailbox, hello@worcia.com (opens in a new tab), and the email we send are hosted by Zoho Mail in Zoho's US data center. Zoho is listed on the Subprocessors page.

3.7 Talk to our AI (demo conversations)

Today, the Lab's Concierge demo is a scripted example: a labeled transcript and, where offered, the same script read aloud by your own browser's built-in speech engine. It is not a live conversation. It does not use your microphone, and it collects nothing. Some browsers use their maker's online voices to read text aloud; if yours does, your browser sends our script text, not anything about you, to its maker.

When the live voice and chat demo is enabled:

• before the conversation starts, a notice tells you that you are talking to an AI system and that the conversation is recorded and transcribed;
• we keep the transcript, and the audio for voice conversations, for 30 days, then delete them;
• we record a hashed IP address, the length of the session and its cost, to apply rate limits and a daily spending cap;
• the voice platform and language-model provider that process the conversation are named on the Subprocessors page before they process any data.

Please do not share sensitive information in a demo. If you give your contact details and ask to book a call, we treat them as an inquiry under section 3.1.

The same applies to our phone line, +1 415 605 2585, once a Worcia voice agent answers it. You will hear an AI disclosure and a recording notice at the start of the call, recordings and transcripts are kept for 30 days, and you can ask for a person at any time. More detail is in AI Use & Disclosure.

3.8 Ask Worcia and the Automation Sketch

Ask Worcia, our site assistant, answers questions about Worcia. Today it runs on our own server: it matches your question to our own published content and replies with automated answers. No AI provider or other third party receives your questions. Your questions are sent to our server to find an answer. We do not store them, and Ask Worcia does not ask for your name or contact details. We use a hashed IP address to apply rate limits. Please do not type sensitive information into it.

The Automation Sketch in the Lab turns a task you describe into a first outline. To use it, you give your name and email address, the task, the tools you use and how often the task happens. We create a record in Worcia HQ with these details and the outline, and email the outline to you. Someone from Worcia may reply to follow up. Tell us to stop at any time. Today the outline is filled in automatically on our own server, with no AI provider.

If we switch either tool to an AI model, we name the provider on the Subprocessors page before it processes any data, and update this section.

3.9 Analytics

We use Umami, an analytics tool we host ourselves, on our own server. It records the pages viewed, the referring website, general technical details (browser, operating system, device type and country) and a short list of events, such as clicking a call to action, starting or sending a form, finishing a calculator, opening search or choosing an industry.

Umami sets no cookies, does not store your IP address, and does not build a profile of you or follow you to other websites. No third party receives this data.

3.10 Security, logs and abuse prevention

• Web server logs. Our web server records each request: IP address, time, page requested, referring page and browser. We keep these logs for up to 14 days, to keep the site running and to investigate abuse.
• Rate limits. Forms and the Lab use a hashed IP address, and the email address you enter, to limit repeated submissions.
• Error reports. When a page fails, we record the error, the page and the browser type, but not who you are.
• Cloudflare Turnstile. When enabled, Turnstile checks that a form is being sent by a person rather than an automated script. Cloudflare processes information about your browser and device to do this and may set strictly necessary security cookies. See the Cookie Policy.

3.11 Worcia Console

Worcia Console is our client portal. We create accounts for clients and the people they nominate. There is no public sign-up. We collect:

• your name, email address and the client organization you belong to;
• your password, stored only as an Argon2id hash, never in readable form;
• session records (IP address and browser) while you are signed in;
• what you and we put in the portal: files, messages, approvals, change requests, support requests, milestones and invoices;
• an audit log of sign-ins, file access and changes, including the IP address for sign-in events.

Files uploaded to Console are encrypted with AES-256-GCM before they are written to disk and are served only through signed, access-checked links. We use this data to deliver the engagement, keep the portal secure and keep a record of what was agreed and delivered.

3.12 When you email, call or message us

We receive what you send: usually your name, contact details and what you need. Our main line, +1 415 605 2585, is also our WhatsApp number. Calls and messages to it go through WhatsApp, operated by Meta, which handles them under its own terms and privacy policy; we see your number, your messages and the call history on our phone. If we go on to work together, the correspondence becomes part of the project record.

3.13 Payments

We never store payment card data on our servers. Invoices are paid by bank transfer or, if we use a payment processor, through a hosted payment page linked from the invoice. The processor collects your payment details directly, under its own terms. We receive confirmation of payment and the details shown on the transfer or receipt (such as the payer's name, amount and date), and we keep invoices and payment records for as long as tax and accounting law requires.

3.14 Where the data comes from

We collect personal data from you directly, from your browser as described above, and from the providers that work for us (for example, Zoho tells us about a booking).

4. Why we use it: lawful bases

If you are in the European Economic Area (EEA) or the United Kingdom, the GDPR and UK GDPR require a lawful basis for each use of your personal data. Ours are:

Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (section 8).

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We may sort inquiries by simple factors, such as timeline or project size, to decide which to answer first. A person reads every inquiry.

5. Who we share it with

• Subprocessors. Providers that host our systems or deliver a service for us, listed on the Subprocessors page. Each may use the data only to provide that service to us.
• Professional advisers. Accountants and lawyers, where needed, under a duty of confidentiality.
• Authorities. Where the law requires it, or where disclosure is needed to protect the rights, property or safety of you, us or others.
• A successor. If Worcia becomes a company, or its business is transferred, your data moves with the business and this policy continues to apply. We will tell you if that happens.

We do not sell personal data, rent it, or share it for anyone else's marketing.

6. Where your data is stored, and international transfers

Your data is stored on a virtual private server from Contabo GmbH, in a data center in the European Union (France).

Our team works from Pakistan and accesses the data remotely over encrypted connections. Neither the European Commission nor the UK government has made an adequacy decision for Pakistan, meaning they have not assessed its data protection law as equivalent to their own. We protect the data with the measures in section 10, and the same rules in this policy apply wherever we work from.

Some providers process data outside the EEA or the UK. Today, Zoho Mail holds our email in the United States, and our encrypted backups are stored in Google Drive, which may store them in the United States or other countries. Before a provider processes personal data, we name it and where it processes data on the Subprocessors page. Where a transfer needs a legal safeguard, we use a recognized one, such as an adequacy decision, the EU-US Data Privacy Framework where the provider is certified under it, or the European Commission's standard contractual clauses (with the UK addendum for UK data).

You can ask us for more information about the safeguard for any transfer.

7. How long we keep it

You can ask us to delete your data sooner (section 8).

8. Your rights

8.1 Wherever you live

You can ask us to:

• tell you what personal data we hold about you, and give you a copy;
• correct it;
• delete it;
• stop sending you marketing email (every marketing email also has an unsubscribe link).

We do this for everyone, without asking you to prove that a particular law applies to you. If we must keep something by law, such as an invoice, we will tell you what and for how long.

8.2 If you are in the EEA or the UK

Under the GDPR and UK GDPR, you also have the right to:

• restrict how we use your data while a concern is resolved;
• receive data you gave us in a portable, machine-readable format;
• object to processing based on legitimate interests, and object at any time to direct marketing;
• withdraw consent at any time, without affecting what we did before you withdrew it;
• complain to a data protection authority: in the EEA, the authority where you live or work; in the UK, the Information Commissioner's Office (ICO).

We would appreciate the chance to address your concern first.

8.3 If you live in a US state with a privacy law

Residents of California, Colorado, Connecticut, Virginia and other states with comparable laws may have the right to:

• know what personal information we collect, use and disclose, and get a copy in a portable format;
• correct inaccurate personal information;
• delete personal information;
• opt out of the sale or sharing of personal information, of targeted advertising, and of profiling that produces legal or similarly significant effects;
• limit the use of sensitive personal information;
• not be discriminated against for using these rights;
• appeal our decision on a request.

We do not sell or share personal information, as "sell" and "share" are defined in the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and we have not done so in the past 12 months. We do not use personal information for targeted advertising or for profiling that produces legal or similarly significant effects.

You can still send us an opt-out request, by email or through a browser signal such as Global Privacy Control, and we will treat it as valid. Because we do not sell or share personal information, there is nothing further for us to stop.

Categories of personal information (California). The table below summarizes the past 12 months. The purposes are those in section 4, and how long we keep each category is in section 7.

We use Console sign-in credentials only to sign you in and keep your account secure, so the right to limit sensitive personal information does not change how we use them. We do not knowingly collect other sensitive personal information and do not use any personal information to infer characteristics about you.

8.4 How to make a request

Email hello@worcia.com (opens in a new tab) with "Privacy request" in the subject, or call +1 415 605 2585.

• Verification. To protect your data, we may ask you to confirm the request from the email address we hold, or to give details that match our records. We ask only for what we need to verify you.
• Authorized agents. Someone else can make a request for you if you give them written permission. We may still ask you to confirm your identity with us directly.
• Timing. We reply within 30 days. If a request is complex, we may extend that as the law allows, and we will tell you why within the first 30 days.
• Cost. Requests are free, unless they are clearly unfounded or excessive, in which case we may decline or ask for a reasonable fee, as the law allows.
• Appeals. If we decline a request, you can appeal by replying with "Appeal" in the subject. We answer appeals within 45 days. If you are still not satisfied, you can contact your state Attorney General.

9. Children

Our website and services are for businesses. They are not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us personal information, contact us and we will delete it.

10. How we protect your data

• Everything is served over HTTPS with HSTS. Internal services listen only on the server's loopback interface.
• Files uploaded to Worcia Console are encrypted with AES-256-GCM before they are written to disk, and served only through signed, access-checked links.
• Database and file backups are encrypted with GPG (AES-256) before they leave the server.
• Every Worcia HQ account needs a password and a time-based one-time code (TOTP). Passwords are hashed with Argon2id. Two-factor secrets are stored encrypted.
• The application's database account cannot change the database structure. Repeated failed sign-ins lock an account for 15 minutes. Sign-ins, changes and file access are written to an audit log.
• IP addresses used for rate limits are stored only as hashes.

Not every record is encrypted at rest. Data in our database is protected by access controls, network isolation and encrypted backups rather than disk-level encryption. No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authorities as the law requires. More detail is on our Security page.

11. Changes to this policy

When this policy changes, the effective date at the top changes with it. We will make material changes obvious, and where the law requires it we will tell you directly or ask for your consent.

12. Contact

Questions about this policy, or about data we hold about you: hello@worcia.com (opens in a new tab) or +1 415 605 2585. You can also use our contact page.