Privacy Policy

By The Workshaped Lab · Effective October 17, 2026 · Last updated October 17, 2026

Updated October 17, 2026: we now use X's advertising pixel to measure our ads on X. It doesn't load in the EU, EEA, UK or Switzerland, with Global Privacy Control, or after you opt out. Your opt-out choices

This policy explains what personal information Summit Holdings Alliance LLC (doing business as Workshaped) ("Workshaped", "we", "us") collects through workshaped.ai, why, who else handles it, how long we keep it, and the choices you have. We have tried to describe only what the site actually does.

The short version

• We collect what you type into our forms, plus what we need to deliver what you buy.
• We use X's (formerly Twitter's) advertising pixel to measure whether our ads on X lead to visits, sign-ups and purchases. It sets X cookies in your browser and lets X collect information about your visit. We don't load it for visitors in the EU, EEA, UK or Switzerland, or if your browser sends Global Privacy Control, and you can turn it off with the "Do Not Sell or Share My Personal Information" link at the bottom of every page.
• Our host, Cloudflare, also gives us cookieless page-view and page-speed statistics (Cloudflare Web Analytics). We have no other analytics or advertising tags.
• We don't sell your personal information for money. Under California law, letting X's pixel collect information on our pages counts as "sharing" for advertising, and other US states may treat it as "targeted advertising" or a "sale". You can opt out (section 5).
• Stripe handles payments. We never see your full card details.
• You use Blueprints in your own AI assistant account (or, for the optional developer kit, on your own systems). We never receive the business or personal data you paste into them. Your AI provider's own terms and privacy policy apply to what you paste in, so check its data and training settings first (most Blueprint pages show where to find them).

1. What we collect

Forms on the site

Each stored entry also carries a review status (for example "unreviewed"). Results you report in a submission are marked "self-reported, unverified" unless we verify them.

Purchases

When you buy, you pay on a Stripe-hosted checkout page. We never receive or store full card numbers. Stripe collects:

• your name and email address;
• your billing address or location, when Stripe needs it for the payment method or to calculate tax;
• your payment method details (kept by Stripe); and
• the details of the order.

Stripe creates a customer record for each buyer. After payment, Stripe tells us the order happened, and we store an order record so we can give you access: your email address, your Stripe customer ID, the checkout session reference, the product, the amount and currency, the time paid, and the time your Blueprint was first opened through an access link (a single date and time, recorded once and never updated; no IP address or device details), which we use to confirm delivery and to handle refund requests and payment disputes. We can also see the details Stripe holds about the order (including your name and billing address, if collected) in our Stripe account. Stripe emails you a receipt and invoice.

Security and anti-spam data

• Rate limiting. When you submit a form, we turn your IP address into a one-way hash and use it to count submissions over a rolling hour. That counter is deleted automatically after the hour. We do not store your raw IP address with your submission.
• Cloudflare Turnstile. Our forms use Turnstile, a Cloudflare service that checks you're a person without a puzzle in most cases. It runs in your browser, and when you submit, we send the Turnstile result and your IP address to Cloudflare to confirm it. Cloudflare's privacy terms for Turnstile apply.

Site statistics

• Cloudflare Web Analytics. Our pages load a small script from our host, Cloudflare, that counts page views and measures how fast pages load. It doesn't set cookies or use other browser storage, and Cloudflare says it doesn't fingerprint visitors or collect their personal data. It reports the page address without any query string, the site that referred you, your country (worked out from your connection), your browser, operating system and device type, and page-load timings. We see only totals in our Cloudflare dashboard, not individual visitors.

Advertising measurement (X pixel)

• What it is. Our pages load a script from X Corp. ("X", formerly Twitter; it loads from static.ads-twitter.com) so we can measure our ads on X. We don't load it for visitors whose connection our host places in the EU, EEA, UK or Switzerland, if your browser sends Global Privacy Control, or after you use our opt-out link.
• What X receives when it loads. The address of the page you're on and the page you came from, your IP address, browser and device details, and the identifiers stored in X's cookies. X may link this to your X account if you use X in the same browser, and may use it to measure ads and to build audiences for showing ads, including our ads on X.
• Cookies. X's script sets cookies on workshaped.ai: _twclid (holds an X ad-click reference if you arrived from an X ad), _twpid (a random browser identifier) and _twsid (a visit identifier). The script sets these to last about 13 months. X's own domains may also set or read cookies under X's cookie policy. You can delete them in your browser at any time.
• Events we send. After a completed purchase, we tell X the price and currency, with a random reference used only so X doesn't count the same purchase twice. If we turn on sign-up measurement, we tell X only that a newsletter or work-with-us sign-up happened. We never send X your email address, name, phone number, order number or anything you type into a form, and we've turned off X's feature that reads form fields to match visitors.
• Private links. Pages that open your purchased Blueprint don't load the pixel, and we remove your checkout reference from the page address before the purchase event goes to X.
• X's role. X isn't our service provider for this. It decides how it uses this data under its own terms and privacy policy (https://x.com/en/privacy).

Hosting

• Hosting logs. Our site is served by Cloudflare. Like any web host, Cloudflare processes your IP address, browser details and the pages you request to deliver and protect the site, and your browser may send Cloudflare network error reports if a page fails to load.

What we don't collect

• No session recording, no analytics other than the cookieless Cloudflare Web Analytics, and no advertising tags other than X's pixel, both described above.
• No cookies of our own. The only cookies on our pages are X's cookies described above, and they aren't set if the pixel doesn't load for you. (Stripe's checkout pages, which are on Stripe's domain, use their own cookies for payment and fraud prevention. Cloudflare Turnstile may use browser storage needed to run its check.)
• No data from inside your Blueprints. When you use a Blueprint, the emails, files, bank exports, medical bills and other information you paste or upload go from you to the AI assistant you chose (or, with a developer kit, between your own systems and your own AI provider). They do not pass through us, and we can't see your chats. Your AI provider is not our service provider: it handles that information under its own terms, privacy policy and settings, which you choose and agree to. Before you paste someone else's personal, health or financial information, make sure you have the right to share it, and remove details the task doesn't need (such as member IDs, account numbers or dates of birth).

2. Why we use it

We don't use your information to make automated decisions that have legal or similarly significant effects on you, and we don't build advertising profiles ourselves. X may use what its pixel collects for its own advertising purposes, as described in section 1.

Emails we send. If you buy, we may email you about your purchase and about updates to it. We'll only send the newsletter if you signed up and ticked the consent box.

The newsletter today. The weekly email (one tested AI use case a week) is being prepared. Until the first one goes out, signups are stored only and we don't use an email service for it, so nobody outside Workshaped and our host, Cloudflare, handles your signup. We don't record your IP address with your signup. Before we send the first newsletter, we'll update this policy to name the email service we use and what we share with it. Until then, to unsubscribe, email hello@workshaped.ai from the address you signed up with and we'll delete your signup. Once we start sending, every newsletter will also have an unsubscribe link, and unsubscribing will stop further newsletters right away.

3. Who else handles your information

We use a small number of service providers. They handle data for us under their own terms and data processing agreements:

We don't use an email service for the newsletter yet (see "The newsletter today" above). We'll add it to this table before the first newsletter is sent.

Third party that receives data for advertising. This one isn't our service provider; it uses the data under its own terms:

We may also disclose information if the law requires it, to protect our rights or someone's safety, or as part of a sale or reorganization of our business (in which case this policy, or one at least as protective, will continue to apply).

We don't sell your personal information for money. We do let X's pixel collect information on our pages for advertising. California law calls this "sharing" for cross-context behavioral advertising, and other states may call it "targeted advertising" or a "sale". The categories involved are identifiers (IP address, cookie and device identifiers), internet activity (pages viewed on our site and the page you came from) and commercial information (the purchase price and currency, which we don't link to your name or email when we send it). We don't sell or share sensitive personal information, and we don't knowingly sell or share the personal information of anyone under 16. You can opt out at any time (section 5, "Your opt-out choices").

4. How long we keep it

"Activity" means things like replying to us, submitting a form again, or buying something.

5. Your choices and rights

Wherever you live, you can ask us to:

• tell you what we hold about you and give you a copy;
• correct it;
• delete it (we may need to keep order records the law requires);
• take you off the newsletter (unsubscribe). Until the first newsletter goes out, email hello@workshaped.ai to do this; after that, you can also use the link in any newsletter.

Your opt-out choices

You can opt out of X's pixel (the "sharing", "sale" or "targeted advertising" described in section 3) in any of these ways. You don't need an account or to tell us who you are:

• Global Privacy Control. Turn it on in your browser or a browser extension. When your browser sends it, we don't load X's pixel at all, and we treat it as a valid opt-out request under the laws of California, Colorado, Connecticut, Oregon, Texas and other states that recognize it.
• The "Do Not Sell or Share My Personal Information" link at the bottom of every page. It turns X's pixel off in that browser right away.
• Email hello@workshaped.ai. Because we don't know who you are when you browse, we'll reply with how to turn the pixel off in each browser you use.

An opt-out applies to the browser and device you use it on. You can also block third-party cookies, delete X's cookies, or limit ad personalization in your X account's privacy settings. These rights cover opting out of sale, sharing and targeted advertising under California, Colorado, Connecticut, Virginia, Oregon, Texas and other state laws.

Visitors in the EU, EEA, UK and Switzerland. We don't load X's pixel when our host places your connection in these countries, so X's cookies aren't set and X receives nothing about your visit from us. That location comes from your connection and may be wrong, for example if you use a VPN; if so, use the opt-out link or Global Privacy Control, or email us.

If you are in the EU, UK or EEA, you also have the right to object to processing based on legitimate interests, to restrict processing, to data portability, to withdraw consent at any time (without affecting earlier processing; for the newsletter, unsubscribing withdraws your consent), and to complain to your local data protection authority. You can object to Cloudflare Web Analytics by emailing us, or block it in your browser (it loads from static.cloudflareinsights.com); the site works the same without it.

If you are a California resident (or in another US state with a consumer privacy law), you have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing (see "Your opt-out choices" above); to limit use of sensitive personal information (we don't collect it through the site); and not to be treated differently for using these rights. The categories we collect are: identifiers (name, email, IP address, cookie and device identifiers), commercial information (purchases), internet activity (pages viewed on our site and the page you came from), and the content of what you choose to submit. We collect them from you, from Stripe and, for the pixel, through X's script on our pages, for the purposes, with the providers and third parties, and for the periods listed above. We share identifiers, internet activity and commercial information with X as described in section 3. Notice at collection: this policy, linked at the bottom of every page, is our notice at collection, and the "Do Not Sell or Share My Personal Information" link is on every page.

To make a request, email hello@workshaped.ai from the address you used with us. We may need to confirm it's you. We'll respond within the time the law requires (generally 30 days in the EU/UK and 45 days in California). You can use an authorized agent where the law allows.

6. Where your data is processed

We are a Wyoming company based in the United States, and our providers process data in the US and other countries. If you are outside the US, your information will be transferred to the US. Where required, our providers rely on recognized transfer mechanisms such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

7. Security

We keep what we collect small. Form entries are stored in a private store on our host that is not published or shown on the site. Submitted text is cleaned before it is stored. Purchase access uses signed links that expire after 7 days. Payment details stay with Stripe. No method is perfectly secure, but we will tell you and the authorities about a breach that affects you where the law requires.

8. Children and minors

The site is for adults and businesses. You must be at least 18 to buy from us or submit anything, and we don't knowingly collect personal information from anyone under 18. If you think a minor has given us information, contact us and we'll delete it.

9. Links to other sites

Our articles link to other sites, and checkout happens on Stripe. Their privacy practices are their own.

10. Changes

We'll update this page when our practices change and change the "last updated" date. If a change is significant, we'll post a notice on the site or email you if we have your address.

11. Contact

Workshaped is a trade name of Summit Holdings Alliance LLC, a Wyoming limited liability company.

• Email: hello@workshaped.ai
• Mail: Summit Holdings Alliance LLC, 30 N Gould St, Ste N, Sheridan, WY 82801