This policy explains what Any.win (operated by GEXC Labs) collects when you use the product. It is written for V1: one workspace, BYO keys, run logs, and optional billing. We do not sell personal information.
1. Who we are
Controller: GEXC Labs, operating any.win. Contact: [email protected].
2. Data we process
- Account. Email, name, and profile image from Google or Microsoft when you choose Continue with Google or Continue with Microsoft. We store that on a User and create a default Workspace. A local development session can be used when the app is not in production.
- Workspace and employees. Names, goals, instructions, skills, schedules, approval policy, outcomes (KPIs, deadline, labor budget, result log), versions, and visibility.
- Memory and knowledge. Entries you write or ingest (PDF text, URL excerpts). You can edit and delete them. Working memory is wiped at the end of a run.
- Runs. Trigger, input, step timeline (model and tool calls), tokens, cost, artifacts, errors, and approval payloads. Secrets are redacted from persisted steps.
- Credentials. BYO model keys and OAuth tokens (Google, Slack, GitHub) are encrypted at rest. A workspace Stripe key used only to pull customer or subscription counts into Outcomes is stored the same way — it is not Any.win billing.
- Billing. Stripe processes cards and invoices. We store plan, period, and usage counts. We do not store full card numbers.
- Notification email. When an employee pauses for approval, we email the workspace owner the employee name, the approval title and summary, and a link. The email does not include the draft itself, keys, or tokens.
- Product analytics. First-party events (employee created, run started, succeeded, forked, outcome logged). No advertising pixels in V1.
- API and webhooks (Builder). Hashed API keys (shown once) and outbound webhook endpoints you configure.
3. Why we use it
To provide the service (run employees, pause for approval, schedule jobs, bill plans), keep the product secure, debug failed runs, and understand whether people create, run, and reuse employees. Legal bases where GDPR applies: contract, legitimate interests (security, product metrics), and consent where you connect a third-party account.
4. Model providers and tools
When a run calls a model or skill, the prompt, retrieved memory excerpts, and tool inputs go to the provider you bound. On Pro and Builder, a run can use our key until that month's included model budget is spent. Those providers have their own privacy terms. We do not put API keys, OAuth tokens, or webhook secrets into model prompts. Web extract, HTTP, and Outcomes URL ingest block private and link-local addresses.
5. Cookies
An essential anywin_session cookie keeps you signed in. A local anywin_dev_user cookie is used only in development. Stripe uses cookies on Checkout and the customer portal. We do not use third-party advertising cookies. Details: Cookie notice.
6. Sharing
We share data with subprocessors that host or authenticate the product, and with providers you choose (models, Gmail, Slack, GitHub, search). We share with authorities when required by law. Public employee pages show only the fields listed in the Terms. Forks do not copy credentials.
7. Retention
We keep workspace data while the account is open. You can delete memory, knowledge, employees (archive), and API keys in the product. After account deletion we remove or anonymize personal data within 30 days, except billing and abuse records we must retain. Encrypted credentials are deleted with the workspace.
8. Your rights
Depending on where you live, you may request access, correction, deletion, export, or restriction, and you may object to certain processing. Email [email protected]. You can also edit memory and knowledge in the app. We will not discriminate for exercising these rights. If you are in the EEA or UK you may complain to a supervisory authority. If you use Any.win as a business, the Data Processing Addendum describes how we process workspace content as a processor.
9. International transfers
Infrastructure is typically in the United States (Vercel or Azure, Stripe, Google, Microsoft). If you use the service from elsewhere, you instruct us to process data in those regions. We use subprocessors’ standard contractual clauses or equivalent where required.
10. Children
The service is for people 18 and older. We do not knowingly collect data from children.
11. Changes
We will update the date on this page when the policy changes. Material changes will be noted in the product or by email when we have an address.