Privacy Policy

Last updated: October 8, 2026

Status: Beta. SilkHat is pre-launch software offered to a limited group of testers. This policy describes how SilkHat handles your information today. Where a protection is still being finished, we say so plainly.

A note about beta — please read this first

SilkHat is built to be a private AI personal assistant. Its design is simple to state:

• Your data lives on your SilkHat instance. Each SilkHat user or organization has its own SilkHat instance — a server that runs SilkHat for you. Your conversations and the data SilkHat copies from accounts you connect are stored on that instance, not in a central WBC Works database. During beta, WBC Works hosts the instances of its founders and of a small group of invited beta testers on servers we operate; each instance is used only by its own user or organization.
• Personal information is masked before content goes to an AI provider. By default, SilkHat masks certain personal details — email addresses, phone numbers, payment-card and government ID numbers, and IP addresses — before content is sent to an external AI model provider, and restores them only in the reply shown to you.
• Stored data is encrypted at rest. By default, the data SilkHat stores on your instance is kept in an encrypted vault, and the sign-in tokens for your connected accounts are kept in an encrypted credential store.

Beta caveat, stated plainly: SilkHat is beta software. Some components may not work exactly as designed, and a protection can fail or be incomplete. Masking catches the categories listed above; other personal details in your content (for example names, or the substance of a message) are sent to the AI provider so it can do what you asked. WBC Works takes all commercially reasonable measures to protect your privacy, but you acknowledge the risks of using beta software. If you are not comfortable with that, please do not connect sensitive accounts.

1. Who we are

SilkHat is operated by WBC Works LLC ("WBC Works," "we," "us," or "our"), a Pennsylvania limited liability company based in the United States (109C Nicholson Rd, Sewickley, PA 15143). SilkHat is our AI personal assistant product; Friday is the in-product assistant you interact with.

For any privacy question, or to exercise the rights described in this policy, contact us at privacy@silkhat.ai.

This policy covers the SilkHat website (silkhat.ai) and the SilkHat application (desktop, mobile and instance), including data accessed through accounts you connect.

2. Information we collect

Information you give us. If you join our early-access list, send us a message, fill out a form, or sign up to test SilkHat, we collect what you provide — for example your name, email address, and your message.

Information SilkHat processes when you use the application. On your SilkHat instance, SilkHat processes:

• The messages you send to Friday and Friday's responses.
• Content SilkHat retrieves from accounts you connect — see Section 6.
• Operational information about how the software is running (error logs, performance data, which features were used). Usage telemetry is off by default on customer installations; when it is on, it contains counts and timings, not message content.

Information collected automatically on the website. When you visit silkhat.ai we collect technical information through server logs and cookies, such as IP address, browser type, device information, and visit time.

3. Cookies and similar technologies

On the SilkHat website we use:

• Essential cookies — required for the site to function.
• Analytics cookies — to understand how the site is used so we can improve it.
• Third-party cookies — limited cookies set by services we work with.

You can manage or disable cookies in your browser; disabling some may affect the site. The SilkHat application does not use advertising cookies.

4. How we use information

We use the information described above to:

• Provide SilkHat and carry out the tasks you ask Friday to perform (including reading, composing and sending email, and reading and managing calendar events, on your instruction).
• Respond to your messages and provide support.
• Keep SilkHat secure and reliable, and fix problems.
• Detect, prevent and investigate fraud, abuse and security incidents.
• Comply with legal obligations and enforce our terms.

We do not use your content to serve advertising, and we do not sell your personal information.

5. How we share information — AI model providers and other recipients

5.1 External AI model providers (the most important disclosure)

Friday is powered by large language models operated by third-party AI providers. To answer your requests and take the actions you ask for, SilkHat sends the relevant content — which may include parts of your conversations and of your connected accounts — to the AI provider, after the masking described above.

• Our primary AI provider is Anthropic. We may also use OpenAI or Google as fallback providers.
• The AI providers we use represent that they do not use data submitted through their APIs to train their models. WBC Works does not control these providers; their handling of data is governed by their own terms. We choose providers with strong data-protection commitments and keep the list in Section 14 current.

5.2 Other recipients

• Connected-account providers (Google, Microsoft). When you ask Friday to act in a connected account (for example, send an email or create a calendar event), SilkHat sends the necessary content to that provider to perform the action.
• Messaging interface (Telegram). If you use SilkHat through Telegram, your messages pass through Telegram and are subject to Telegram's privacy policy.
• Service providers for website hosting, transactional email and website analytics.
• Legal and safety. Where required by law, to comply with legal process, or to protect the rights, safety and security of users, the public or WBC Works.
• Business transfers. If WBC Works is involved in a merger, acquisition, financing or sale of assets, information may be transferred as part of that transaction, with notice to you, subject to this policy.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

6. Connected Accounts — Google & Microsoft User Data

This section governs data SilkHat accesses from accounts you connect, and applies in addition to the rest of this policy. If anything here conflicts with another section, this section controls for connected-account data.

6.1 What we access, and why

SilkHat asks for each permission only when you connect that service, and requests the narrowest permissions that support the feature:

SilkHat does not request full-mailbox access (https://mail.google.com/), and does not label, archive or permanently delete your mail. Microsoft accounts (Outlook mail, Microsoft 365 calendar) are used for the same purposes.

We use connected-account data only to provide the user-facing features of SilkHat that you use. We do not sell it, do not use it for advertising, and do not transfer it to others except as described in this policy.

6.2 Where your connected-account data is stored and processed

• On your SilkHat instance. When you connect Gmail, SilkHat copies up to the last 90 days of mail into your instance's encrypted vault and checks for new mail about every 5 minutes, so Friday can search it. Calendar data is read when needed.
• Sign-in tokens for connected accounts are stored on your instance in an encrypted credential store. They are never shown to the AI model and are not written to logs.
• Sign-in relay. When you connect a Google account, a short-lived one-time authorization code passes through a WBC Works relay at silkhat.ai and is deleted automatically within 10 minutes. The relay never receives your email, calendar data or long-lived tokens.
• AI processing. To answer a request, the relevant parts of your connected-account content are sent to our AI provider (Section 5.1) after masking, and to Google or Microsoft as needed to carry out the action itself.

6.3 Human access to connected-account data

In normal use, no WBC Works person reads the content of your mailbox or calendar. Friday processes it automatically to do what you asked. WBC Works personnel may review system logs, performance data and audit records to operate and secure SilkHat; this does not include reading your message bodies or calendar contents.

A WBC Works person will read the content of your connected-account data only when:

• you have given explicit, specific, revocable consent for us to view a specific item (or an identified set of items) to provide support for a feature you use; or
• it is necessary for security purposes, such as investigating abuse or a security incident; or
• it is necessary to comply with applicable law; or
• the data has been aggregated and anonymized and is used for internal operations in accordance with applicable law.

6.4 Disconnection and deletion

You can disconnect a connected account at any time in SilkHat, or remove SilkHat's access from your Google Account at https://myaccount.google.com/permissions. Disconnecting deletes the stored access credential for that account and ends SilkHat's access to it. Content SilkHat has already retrieved is held only as long as needed to complete your requests and to provide SilkHat's ongoing features to you, and is then deleted or de-identified. To request deletion of connected-account content SilkHat has retained, contact privacy@silkhat.ai.

Beta note: SilkHat's automatic retention-and-deletion controls are still being built, so some deletion during beta may be handled manually on request. We will honor disconnection and deletion requests; the mechanism is maturing.

6.5 Google API Services — Limited Use

SilkHat's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, for data obtained through Google API scopes:

• We use Google user data only to provide or improve the user-facing features of SilkHat for which you granted access.
• We do not transfer Google user data to others, except as necessary to provide or improve those features, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with notice to you.
• We do not use Google user data for serving advertisements, including retargeting, personalized or interest-based advertising.
• We do not sell Google user data.
• We do not allow humans to read Google user data, except in the circumstances in Section 6.3.

Microsoft account data is handled on the same basis.

6.6 No AI model training on your data

SilkHat does not use Google user data, or any data from accounts you connect, to develop, improve or train generalized or non-personalized artificial-intelligence or machine-learning models, and does not permit any third party to do so.

7. Your rights and choices

Depending on where you live, you may have rights over your personal information.

• EEA / UK (GDPR / UK GDPR). You may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. Our legal bases include performing the service you request, our legitimate interests in operating and securing SilkHat, and your consent where we ask for it.
• California (CCPA / CPRA). You may have the right to know what personal information we collect and how we use and share it, to request deletion or correction, and to opt out of "sale" or "sharing." We do not sell or share your personal information for cross-context behavioral advertising, and we will not discriminate against you for exercising your rights.

To exercise any of these rights, contact privacy@silkhat.ai. We will verify your request as required by law.

8. Data retention

We keep personal information only as long as necessary for the purposes in this policy or as required by law, then delete or de-identify it. Connected-account retention and deletion are described in Section 6.4. Website and contact information is kept as long as needed to operate the site and respond to you.

9. Security

We protect your information with measures including encrypted storage of data and sign-in tokens on your SilkHat instance, encryption in transit (HTTPS/TLS 1.2+ with HSTS on silkhat.ai), masking of personal details before content reaches AI providers, and multi-factor authentication on WBC Works administrative accounts. No system is perfectly secure, and SilkHat is beta software (see the beta note above).

10. Children's privacy

SilkHat is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided us personal information, contact privacy@silkhat.ai and we will delete it.

11. International visitors

WBC Works operates in the United States. If you use SilkHat from outside the United States, your information may be processed in the United States and other countries whose data-protection laws differ from yours. Our AI and service providers may also process data outside your country. Where required, we rely on appropriate safeguards for international transfers.

12. Links to other sites

SilkHat and the website may link to third-party sites and services we do not control. This policy does not apply to them.

13. Changes to this policy

We may update this policy as SilkHat evolves. When we make material changes we will update the "Last updated" date and, where appropriate, notify users.

14. Subprocessors

15. Contact us

Questions about this policy, or requests to exercise your rights:

WBC Works LLC · 109C Nicholson Rd, Sewickley, PA 15143, United States · privacy@silkhat.ai