Skip to content
Wakio
Get started
Legal

Privacy Policy

Two kinds of data pass through Wakio, and they are not the same thing. This policy keeps them apart.

Last updated 2026-08-06

1. The two kinds of data

Wakio is operated by WorkersLab LLC, trading as Wakio, of 30 N Gould St STE N, Sheridan, WY 82801. The company's own site is workerslab.com.

Two different things pass through the product, and most policies for products like this blur them:

  • Data about you, our customer. You gave it to us, we decide what to do with it within this policy, and you can ask us about it.
  • Data about your recipients. You decide what happens to it. We process it on your instruction and never for our own purposes. We do not market to your recipients, we do not sell their addresses, and we do not use them to build anything.

If one of your recipients contacts us about their data, we will point them to you, because you are the one who holds the relationship and the permission record. We will tell you it happened.

2. Data about you

We hold what an account needs:

  • your name and email address
  • a hash of your password, never the password
  • your account name and the plan you are on
  • a customer reference from our payment processor
  • the domains you have added and the DNS records we generated for them
  • ordinary server logs, which include IP addresses

We use it to run your account, take payment, send you service mail such as password resets and allowance warnings, and answer you when you write to us.

3. Data about your recipients

On your instruction we hold:

  • the email addresses you send to, and any contact fields you choose to store
  • unsubscribe records: that it happened, when, and from what address
  • complaint records: that it happened and when
  • the personalisation values you send with each message, used only to fill in that message
  • delivery events for each message, with a timestamp and a reason
  • your suppression list, which is the record of who must not be emailed again

Your suppression list is scoped to your account and is never pooled. A bounce for another customer does not quietly block that address for you, and yours does not affect them.

We do not track opens or clicks. There is no invisible image in your mail that reports when it was opened, and no rewritten links, because that feature is not built. If it is ever added it will be off by default and this policy will say so before it ships.

4. Cookies and this website

This site sets two cookies, and both exist for security rather than for tracking. One protects the forms on this site against forgery and is set on every page you visit, including this one, whether or not you have signed in. The other keeps you signed in, and is set only once you do. Neither is used to track you and neither is shared with anyone. There is no banner because both are strictly necessary and there is nothing here that needs your consent.

There is no analytics, no advertising pixel and no third-party script on any page. Our fonts are served from our own domain rather than from a font provider, which we did specifically so that no third party learns the address of everyone who reads our pricing page.

5. How it is protected

  • Traffic to the site and the API is encrypted in transit.
  • Passwords are stored as hashes.
  • API keys are stored only as a SHA-256 digest. We show a key once, when you create it, and we cannot show it again because we do not have it. A copy of our database cannot be replayed against the API.
  • We never see your card. Payment and billing changes happen on our payment processor's own hosted pages. This application renders no card form and stores no card details.
  • Every query for your data is scoped to your account.

6. Who else sees it

We use a small number of companies to run Wakio, and they are listed with what each one does on our sub-processors page. We will update that page before adding another.

Beyond them: we do not sell data, we do not share it for advertising, and we do not give it to anyone else unless the law requires it or you ask us to. If a legal demand arrives for your data we will tell you, unless we are forbidden from doing so.

7. How long we keep it

We keep your data for as long as you have an account, and your recipients' data for as long as you tell us to.

We are not going to state a fixed retention period here, because we do not yet enforce one. There is no automated purge running against delivery events or contact records today. Publishing "90 days" or "two years" would be a sentence on a page rather than something happening in the product, and you would have no way to tell the difference. When a retention schedule exists, this section will describe it and the date above will change.

8. Deletion, and what we keep

We keep no copy of the message itself. The subject and body are rendered at the moment we send, handed to the mail system, and never written to our database. Only a one-way checksum survives, and a checksum cannot be turned back into a message.

What we do keep is the record of what happened, and that record is deliberately append-only. A contact's consent history and a delivery's events are both treated as evidence: neither can be edited once written, and our database refuses to destroy a contact or a delivery while that evidence is attached to it.

That restriction is narrower than it sounds, and the honest version is the useful one. It attaches to the evidence, not to the contact as a whole. Sending to somebody does not create consent history, so a contact who has never unsubscribed and never had a complaint reported against them can be removed on request however much mail you have sent to that address. The messages themselves are a separate record and do not go with the contact. They stay, with their events, because they are what happened.

Two records carry a reason worth stating on their own:

  • Suppression records. This is the list of people who unsubscribed or complained. Nothing in our database stops us clearing it, so this one is a decision rather than a restriction, and the decision is no. Deleting it does not protect them, it re-enables mail to them. It is the one record that exists purely in the recipient's interest.
  • Consent records. Today these are records of somebody leaving: that they used an unsubscribe link, or that a mailbox provider passed on a complaint for them. They are the proof that the request was made and that we acted on it, which is the record you would want if it were ever questioned. We do not yet store the wording somebody was shown when they joined a list, and this section will say so when we do.

If you want something removed, write to us and we will tell you plainly what can go, what stays and why.

9. Making a request

Write to [email protected] for a copy of what we hold about you, to correct it, or to ask what of it can be deleted. We will answer a request under this policy within thirty days and we will tell you if something takes longer.

That window is for requests about personal data and nothing else. Our Terms of Service makes no commitment at all about how quickly ordinary support mail is answered, and the two are not the same undertaking even though they arrive at the same address.

If your request concerns one of your recipients rather than you, tell us and we will help you answer them. The decision is yours, because the relationship is.

10. Children

Wakio is a product for businesses. It is not directed at children and we do not knowingly hold data about anyone under 13. If you believe we do, write to us and we will remove it.

11. Changes

We may update this policy. The date at the top says when it last changed, and if a change materially affects you we will email you before it takes effect.

12. Contact

WorkersLab LLC
30 N Gould St STE N
Sheridan, WY 82801
United States

[email protected] for anything in this policy, including data requests. Our Terms of Service covers the rest of the agreement.