Privacy

1. Our policy

Welcome to the web site (“Site”) of Wrepit AS (“Company”, “Wrepit”, “we”, “us” and/or “our”), a Norwegian company with registration number 821 430 232.

Wrepit provides a cloud platform for on-demand publishing of written documents, with related hosting, sharing services, analytics tools and add-ins for Microsoft Word and Excel named “Wrepit Highlights”, “Wrepit Excel2Word” and “Drafts by Wrepit” (“Services”).

In order to provide our Site and Services, we collect personal data from our customers (“Customers”). We also may collect and host the personal data of our Customers’ end users (“End Users”) when our Customers use the Services. This Policy outlines the information that Wrepit gathers, how the information is used, and your options to access, correct, or delete such information.

By using our Services, you are consenting to the collection and use of your information in accordance with this Privacy Policy. Please do not access or use our Services if you do not consent to the collection and use of your information as outlined in this Privacy Policy.

1.1 Our promise

You own your data — we help you get the most of it. We want to be transparent when it comes to privacy, and we believe in keeping personal information private and secure. We will never sell, rent, or otherwise share your personal information to anyone except as required to provide our service or as otherwise outlined in this Policy without notifying you and providing an opportunity to consent.

1.2 Data Controller and Data Processor

Wrepit’s Privacy Officer can be contacted at privacy@wrepit.net.

In this Privacy Policy is outlined how Wrepit processes personal data collected from individuals or entities in relation to their use of our Services. Legally, Wrepit is the Data Controller of such personal data, as Wrepit determines the means and/or purposes of the processing.

In addition — when Customers transmit personal data while using the Services, Wrepit processes that data. Legally, Wrepit is the Data Processor of such personal data, and the Customers are the Data Controllers. The processing of personal data on behalf of the Customer is based on a data processing agreement between Wrepit and the Customer.

2. Who does this Policy apply to

Customers: Any person that registers individually or on behalf of an organization or legal entity in order to use Wrepit Services.

Website Visitors: Visitors to our websites, and others that may opt in to receive communications from Wrepit.

End Users: Wrepit may process End User data on behalf of customers on the publishing platform. Subsequently, this Policy also applies to any End User that visits a Customer publication and whose information we process in order to provide Services to our Customers.

Add-in Users: Users of the “Wrepit Highlights”, “Wrepit Excel2Word” and “Drafts by Wrepit” add-ins for Microsoft Word and Excel, available from the Microsoft Store.

Minors: Wrepit does not knowingly collect information from children under the age of 16. If you have reason to believe anyone under the age of 16 has provided personal data to the Services, please contact privacy@wrepit.net.

3. What information do we collect

We collect and receive information from you in the following manner:

• When you fill a registration form or otherwise submit your personal information to us.
• When you interact with our Services.

If you have any questions concerning the legal basis on which we collect and use your personal information, please contact us at privacy@wrepit.net.

Customer Account Information: We work with our preferred identity partner, Auth0 (Okta Inc.), to handle all authentication. When you register for a Wrepit account we request and store your email address, and optionally — according to your preferred sign-up selection — password and other account information provided by your identity provider (IDP). Account Information is required to permit access to your account(s). By providing us your Account Information, you represent that you are the owner of such personal data, or otherwise have the consent to provide it to us.

Customer Payment Information: You are not required to enter any payment information unless and until you decide to continue with a paid subscription for our Services. When signing up for a paid service, you must provide billing information.

Website Visitors: We may ask for and collect personal information from you when you submit opt-in forms on our Websites, on our ads on social media or on Google Ads.

Website Cookies and Tracking: We utilize operational and analytical “cookies” in our services. Our cookies help provide additional functionality to the Services and help us more accurately analyze the Services. Cookies that are required for the website to operate properly are allowed to be set without your permission. All other cookies need to be approved before they can be set in the browser. We have divided our cookies into four different categories, and you can see the full list of active cookies in our cookie banner.

• Strictly necessary cookies. Strictly necessary cookies allow core website functionality such as user login and account management. The website cannot be used properly without strictly necessary cookies.
• Performance cookies. Performance cookies are used to see how visitors use the website, e.g. analytics cookies. Those cookies cannot be used to directly identify a certain visitor.
• Targeting cookies. Targeting cookies are used to identify visitors between different websites, e.g. content partners, banner networks. Those cookies may be used by companies to build a profile of visitor interests or show relevant ads on other websites.
• Functionality cookies. Functionality cookies are used to remember visitor information on the website, e.g. language, timezone, enhanced content.

End Users: Our Customers and their users are responsible for the content they publish using our Services (e.g. media, images, written content, graphics, etc.). We collect End Users’ information when they use our Customers’ publications and APIs.

3.1 European Economic Area (EEA)

Our legal basis for collecting and using personal information for individuals from the EEA depends on the personal information, and why we collect it. Normally, we will collect personal information from you only where: (a) we have your consent to do so, (b) we need your personal information to perform a contract with you, or (c) where the processing is in our legitimate interests. In most cases this means that if you do not provide the requested information, we will not be able to provide the requested Services to you.

4. How do we use the information we collect

Wrepit only processes personal information in a way that is compatible and relevant for the purpose for which it was collected and authorized. In general, all data we collect may be used to:

• Provide, operate, improve and promote the Services.
• Enable your access to the Services.
• Process, complete and send you transaction information and invoices.
• Provide customer service and support, and send you technical notices, updates, security alerts, and administrative messages.
• Send commercial communications in line with your communication preferences.
• Monitor and analyze activity in connection to the Services.
• Comply with legal obligations.

5. When we share information

We use some third-party providers that help us run our business (“Service Providers”). These Service Providers may only process personal information according to our instructions and in compliance with this Privacy Policy and other applicable measures and regulations of confidentiality and security.

In addition to sharing with Service Providers as described above, we may also share your personal information with others in the following circumstances:

• With our resellers and other sales partners who help us distribute the Services to Customers.
• In the event of a merger, consolidation or other corporate reorganization in which Wrepit participates.

See section 7 for a list of service providers.

6. International Transfers

Wrepit is a Norwegian corporation. All personal data is processed in accordance with the General Data Protection Regulation. We primarily store personal data in the European Economic Area ("EEA").

Where personal data is transferred outside the EEA or the United Kingdom, either directly or via onward transfer, the transfer is made on one of the following bases:

• Adequacy decision (Article 45 GDPR). Where the European Commission has decided that the recipient country or framework provides an adequate level of protection, the transfer is made on the basis of that decision. For transfers to the United States this means the EU–U.S. Data Privacy Framework, and applies only where the recipient holds an active self-certification under the Framework.
• Standard Contractual Clauses (Article 46(2)(c) GDPR). In all other cases the transfer is made on the basis of the Standard Contractual Clauses adopted by the European Commission, incorporated into our data processing agreement with the recipient.

The basis that applies to each provider is stated in the tables in section 7. Wrepit has a data processing agreement in place with each provider that processes personal data on our behalf, either concluded directly or incorporated into the provider's terms of service.

7. Service Providers

Wrepit uses the below Service Providers that may process data in connection with our business operations and the delivery of our Services. Unless otherwise stated, the service residency location and data processing residency location are the same for each provider.

Abbreviations used:

• EEA: European Economic Area

• US: United States of America

• DPF: Transfer to the USA under Article 45 GDPR on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (EU–U.S. Data Privacy Framework). The recipient holds an active self-certification under the Framework. Where the recipient does not rely on, or ceases to rely on, the Framework, the Standard Contractual Clauses referred to under SCC apply instead.
• SCC: Transfer to the USA under Article 46(2)(c) GDPR on the basis of the Standard Contractual Clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, incorporated into our data processing agreement with the recipient.

7.1 Sales, Marketing and Administrative Providers

The following providers are used for sales, marketing and business administration and may process personal data such as contact information, lead data or visitor analytics.

7.2 Product-Related Providers

The following providers are used in the delivery and operation of the Wrepit platform and may process customer data. The table also states the data processing location and GDPR legal basis for any transfers outside the EEA.

7.3 AI Usage Policy

Wrepit uses AI tools (currently Anthropic Claude, OpenAI Codex and Microsoft 365 Copilot) to assist with internal administration, software development, customer support and operational tasks. These tools are used by Wrepit personnel only, on accounts administered by Wrepit under commercial or enterprise terms. Consumer or personal-tier accounts may not be used for Wrepit work.

Confidential customer information is never submitted. Wrepit does not submit confidential customer information to AI providers. This includes unpublished report content, draft financial statements not yet published, and any information constituting inside information under the Market Abuse Regulation. This prohibition is not waivable.

Customer-requested support. Where a customer has expressly asked Wrepit for assistance with its reports, Wrepit personnel may use approved AI tools on that customer's report material, including working files, provided that the material submitted is no longer confidential — that is, it has previously been published by the customer or is otherwise no longer subject to confidentiality.

Safeguards. Wrepit uses only AI providers that contractually commit to not using customer content to train or improve their models.

Records and personnel. Wrepit maintains a record of approved AI tools in this policy. Personnel may not submit customer information to an AI tool Wrepit has not approved.

8. Data Subject Rights

Data subjects have the right to request access to data, rectification of data, and erasure of data. To exercise any of these rights, please contact us at privacy@wrepit.net.

9. Security

Wrepit has implemented appropriate technical and organizational measures to safeguard the personal data which we process against accidental or unlawful destruction or accidental loss, alteration, unauthorized disclosure or access, and other unlawful forms of processing. In case of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customers personal data, Wrepit will inform the Customer of the breach without undue delay, including a summary description of the potential impact and a recommendation on measures to mitigate the possible adverse effects of the breach.

10. Changes to the Privacy Policy

This Privacy Policy will be modified from time to time to reflect changes in applicable laws or regulations, or changes in our practices or procedures.

11. Contact us

For any queries or concerns you have related to the processing of your information, you may contact our Privacy Officer Kenneth Avner at privacy@wrepit.net.