Wrangl Privacy Policy

Effective: September 2026
Last updated: September 2026

The short version

Wrangl keeps track of your hours, projects and invoices. To do that, it holds your business records. We don't sell them, we don't show you ads, and we don't use tracking scripts on the site. Card details go to Stripe and never reach us.

Who we are

Wrangl is run by App-O-Matic Labs, LLC, Huntersville, NC. "We" and "us" on this page means that company. When you create an account, this policy covers how we handle what you put in.

Who's responsible for what

There are two kinds of information in Wrangl:

• Your account details: the name, email and billing relationship of the people who sign in. We're responsible for these.
• Your business records: clients, projects, hours, rates, invoices, tasks and messages. You own these and decide what goes in. We store and process them only to run Wrangl for you.

Information you provide about other people

You may add information to Wrangl about other people, such as clients, client contacts, employees, contractors, or subcontractors, including people who do not have a Wrangl account.

When you provide personal information about another person, you represent and warrant that you have the right and lawful basis to provide that information to Wrangl and to authorize Wrangl to process it in connection with the Services. You are responsible for providing any notices and obtaining any permissions or consents required by applicable law.

For personal information contained in Customer Data that Wrangl processes solely on your behalf, you determine the purposes for which the information is provided and Wrangl processes that information on your instructions to provide, maintain, secure, and support the Services. Where applicable privacy law uses the terms "controller" and "processor," you are the controller and Wrangl is the processor. Where applicable law uses the terms "business" and "service provider," you are the business and Wrangl is the service provider.

Wrangl will not sell or share Customer Data or use Customer Data for purposes unrelated to providing, maintaining, securing, or improving the Services, except as permitted by applicable law and our Data Processing Addendum.

What we collect

When you sign up and sign in

• Your name and email address.
• Your password. Our authentication provider stores it scrambled, so we can't read it.
• The plan you chose.
• A sign-in cookie that keeps you signed in. It's needed for the app to work.

What you put into Wrangl

• Clients and resources, including any contact details you enter, such as phone numbers.
• Projects, codes, budgets, billing rates and costs.
• Hours: the time you punch in and out, and the comments you add.
• Invoices and invoice lines.
• Tasks, dependencies, messages, reactions, and the files you attach to them.

When you pay

• Stripe collects your card details on its own checkout page. We never see or store your card number.
• Stripe tells us your customer and subscription reference, your plan, and whether payments went through. We keep those so we know which plan you're on.

From your device

• Notifications: if you turn them on, your browser gives us an address for sending them to that device. Notifications are encrypted, so the browser's push service can't read what's in them. Turn them off and they stop.
• Preferences on your device: your browser remembers your light or dark theme and the last conversation you opened. These stay on your device and aren't sent to us.
• Bot protection: the sign-up, sign-in and password-reset forms use Cloudflare Turnstile to check that a person is filling them in. Cloudflare looks at signals from your browser to do this.
• Server logs: our hosting providers keep standard request logs, such as IP address, browser type and time of request, to run and secure the service.

What we don't do

• We don't sell your information or share it for advertising.
• We don't run ad-tracking scripts on the website or in the app.
• We don't read your records unless you ask us to help with something, or the law requires it.

AI features

We're building AI features, such as an assistant that can enter hours or answer questions about how Wrangl works.

When you use one, your request and the records needed to answer it, such as the project, code and resource names in your account, go to an AI provider we hire under contract. They may only use that information to answer your request, and not to train their models.

We don't use your records to train our own models. If that ever changes, we'll tell you first and give you a choice.

How we use it

• To run Wrangl: storing your records, sending sign-in emails, sending the notifications you turned on, and producing your invoices.
• To bill you for your plan.
• To keep the service secure and stop abuse.
• To contact you about your account, such as billing problems or important changes, to periodically send marketing email, including how to opt out.
• To meet legal obligations.

Who we share it with

We only share information with the providers that make Wrangl run, and only what each one needs:

Beyond these, we share information only if the law requires it, to protect people's safety, or as part of a sale or merger of the business, in which case this policy continues to apply.

Where your data lives

Your records are stored with Supabase in the United States.

International data transfers

Wrangl is based in the United States, and personal information we process may be transferred to, stored in, or processed in the United States and other countries where we or our service providers operate.

Where applicable law requires safeguards for an international transfer of personal information, we use legally recognized transfer mechanisms. For transfers subject to the European Economic Area's General Data Protection Regulation, these may include the European Commission's Standard Contractual Clauses.

We also require service providers that process personal information on our behalf to maintain appropriate protections for that information and, where required, appropriate safeguards for international transfers.

You may contact us at contact@appomaticlabs.com to request additional information about the safeguards applicable to an international transfer of your personal information.

How we keep it safe

• Accounts are kept apart by the database itself. Every table has row-level security, so one account's records can't be read by another, even if there's a bug on a page.
• People only see what their role allows. Members never see billing rates, costs or margins. Admins decide who signs in, and removing someone's access takes effect straight away.
• Files are private. Attachments open through links that expire, not public addresses.
• Traffic is encrypted between your browser and Wrangl.
• Email is verified before an account can sign in.

No system is perfectly secure. If we learn of a breach that affects your information, we'll tell you as the law requires.

How long we keep it

We keep your information while your account exists. If you cancel a paid plan, nothing is deleted: your records stay, and anything beyond the Free plan's limits becomes read-only.

To have your account and records deleted, email us at contact@appomaticlabs.com. There's no self-serve delete button yet, so we handle it by hand. We'll confirm when it's done, within 30 days. We may keep payment records longer where tax or accounting law requires, and deleted data can remain in backups for up to 90 days before it's overwritten.

Your rights

You can ask us to:

• give you a copy of your information,
• correct it,
• delete it,
• stop or limit how we use it.

Email contact@appomaticlabs.com and we'll respond within 30 days. You can correct most of it yourself in Wrangl. There's no self-serve export yet, so copies are sent by hand.

If a Wrangl customer added you, for example as a subcontractor or client contact, contact that business first. They decide what's recorded about you. We'll help them respond.

Depending on where you live and the laws that apply to our processing of your personal information, you may have certain rights regarding your personal information. These rights may be subject to exceptions and limitations under applicable law.

To exercise a privacy right, contact us at contact@appomaticlabs.com. We may need to verify your identity before completing certain requests.

If Wrangl processes your personal information solely on behalf of one of our customers, that customer is generally responsible for responding to your request. In that situation, you should contact the customer that provided your information to Wrangl. We will assist our customer in responding to your request where required by applicable law.

European Economic Area and United Kingdom

If the GDPR or UK GDPR applies to our processing of your personal information, you may have the right to:

• request access to the personal information we hold about you;
• request correction of inaccurate or incomplete personal information;
• request deletion of your personal information;
• request restriction of certain processing;
• receive certain personal information in a portable format and, where applicable, have it transferred to another provider;
• object to certain processing, including processing based on legitimate interests and processing for direct marketing;
• withdraw consent at any time where we rely on consent as the legal basis for processing, without affecting processing that occurred before withdrawal; and
• where applicable, exercise rights relating to certain automated decision-making.

You also have the right to lodge a complaint with a data protection supervisory authority.

If you are located in the European Economic Area, you may generally complain to the supervisory authority in the country where you live or work, or where you believe an infringement occurred.

If you are located in the United Kingdom, you may lodge a complaint with the Information Commissioner's Office (ICO).

We encourage you to contact us first at contact@appomaticlabs.com so that we have an opportunity to address your concerns, but you are not required to do so before contacting a supervisory authority.

California

If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), applies to Wrangl's processing of your personal information, you may have the right to:

• know what personal information we have collected about you, including applicable categories, sources, purposes, and categories of recipients;
• request access to the personal information we have collected about you;
• request deletion of personal information, subject to applicable exceptions;
• request correction of inaccurate personal information;
• opt out of the sale or sharing of personal information, where applicable;
• limit certain uses and disclosures of sensitive personal information, where applicable; and
• exercise your CCPA rights without unlawful discrimination or retaliation.

You may also authorize another person to submit certain requests on your behalf. We may take reasonable steps to verify your identity and the authority of an authorized agent as permitted by law.

Wrangl does not sell or share personal information as those terms are defined by the CCPA.

Wrangl does not use or disclose sensitive personal information for purposes that give rise to a right to limit under the CCPA.

If you believe your rights under the CCPA have been violated, you may submit a complaint to the California Privacy Protection Agency or contact the California Attorney General.

Children

Wrangl is a business tool for people 18 and older. We don't knowingly collect information from children. If you believe a child has signed up, email us and we'll delete the account.

Changes to this policy

If we make a meaningful change, we'll email account admins and note it in Wrangl before it takes effect. The date at the top shows when this policy was last updated.

Contact

App-O-Matic Labs, LLC
Huntersville, NC
contact@appomaticlabs.com