Privacy, explained.

Who we are

Winfield Research is operated by Winfield Research Corporation, a Canadian federal corporation. This policy covers our website, AI workspace, account and billing services, and communications with our support team.

Questions and privacy requests go to our privacy contact at [email protected].

Information we handle

• Account and sign-in information: the email address, profile information, account identifier, and authentication information needed for sign-in, account approval, permissions, and sessions. External sign-in also involves your identity provider. We do not need your identity-provider password.
• Workspace content: prompts, responses, saved conversation history, uploads, extracted document text, notes, knowledge collections, and other material you create or use. Thinking output and tool results may be included in a saved conversation.
• Tool information: search queries, URLs, selected content, execution inputs and results, and files created by code or terminal tools. Which information is involved depends on the tools you enable and the work they perform.
• Account and payment records: approval status, starter-credit eligibility, balances, credit reservations, token usage, ledger entries, payment attempts, transaction identifiers, wallet addresses, and payment confirmation or error information. Blockchain transactions are publicly visible independently of our service.
• Technical and support information: IP addresses, request paths, timestamps, browser or device information, status and error information, service logs, and anything you choose to send to support.

We use browser storage and authentication cookies or tokens to keep you signed in and remember preferences. The marketing website does not include an advertising tracker or session-replay script supplied by us. Infrastructure, sign-in, and payment providers may handle technical information under their own policies.

How we use information

We use information to operate the workspace, generate responses, run enabled tools, save work, approve and administer accounts, meter usage, verify and reconcile payments, maintain reliability, investigate service issues, answer support requests, and meet legal obligations.

We do not claim that every provider offers zero retention. See the data-handling guide for the difference between saved workspace content, operational records, and third-party processing.

Service providers and sharing

Providing the service involves external organizations in these categories: inference hosting, infrastructure and network security, identity and authentication, wallet payment processing, blockchain access, and optional search or connected tools. We send the information needed for the relevant operation. The context sent for inference can include your prompts, conversation history, system instructions, images, document excerpts, and tool results.

Processing can occur outside Canada, including in the United States. Information may be subject to the laws and lawful-access requirements of the countries where it is processed. We do not offer a guaranteed Canadian-only or European-only processing region.

If you publish a shared link, share workspace material, or send content to a connected tool, that action can make information available to other people or organizations. Other participants and link recipients may keep their own copies. Review sharing settings before sharing sensitive information.

Authorized operators may access stored information where needed for administration, support, troubleshooting, security, or legal compliance. We may disclose information when legally required or to address fraud, a service attack, or a threat to rights or safety. A business transfer may also involve records, subject to applicable law and notice where required.

Retention and security

Saved chats, uploads, account records, and tool files can remain on our systems until deleted or removed through an applicable retention or account process. Operational logs and manually retained backups do not currently have a guaranteed automatic deletion schedule. Billing, transaction, and legal records may need to remain after an account closes.

Deleting a chat is not necessarily deletion of every associated upload, tool file, shared copy, log, or backup. Account deletion and broader privacy requests are handled through support. We will explain relevant exceptions and the scope of a deletion request rather than promise immediate erasure from every system. See deletion and retained copies.

We use HTTPS on public service endpoints, sign-in and server-side permissions, and restricted access to infrastructure and credentials. No system can guarantee perfect security. This service does not promise end-to-end encryption, a separately isolated computing environment for each user, or content-free diagnostic logs.

Your choices and requests

You can choose which tools to enable, manage available sharing controls, delete or export chats through the workspace, and contact us to request access, correction, export, account closure, or deletion. Tell us which information or account is involved. We may verify your identity before acting on a request.

Requests are assessed under applicable privacy law. Some information may be retained for payments, accounting, fraud prevention, legal requirements, or dispute resolution. We will explain an applicable exception or limitation. You may withdraw consent where applicable, but some processing is necessary to provide the service and withdrawal may require stopping its use.

The service is intended for adults aged 18 and over, not children. If you believe a child has provided personal information, please contact us. We do not need wallet recovery phrases, private keys, or passwords for support; never send them.

Contact and policy changes

Email [email protected] with the subject "Privacy request" or "Privacy concern". We will review your request and communicate any verification steps, applicable response period, or retention limitation. You may also contact the relevant privacy regulator where applicable.

We may update this policy as the service or legal requirements change. We will identify the effective date and provide additional notice or request consent for material changes where required. An updated policy does not remove rights available under applicable law.