FreeWIS Privacy Notice

Versioned legal text. Adoption and PDF rendition status are recorded separately.

Exact Markdown · Text copy

# FreeWIS Privacy Notice

**Effective for FreeWIS native v1 in the United States · Adopted September 16, 2026.**

## Who we are and what this notice covers

**Hudson Consulting and Training, LLC** ("HCT," "we," "us," or "our"), a Colorado limited liability company, operates FreeWIS. This notice covers https://freewis.com and its public pages, GET inquiries at https://freewis.com/get, PLAY at https://play.freewis.com, standalone CHAT at https://chat.freewis.com, any HCT-provided mobile or desktop client used to access hosted PLAY or CHAT (an "HCT Client"), and FreeWIS support correspondence. Separate signed agreements govern any agency production environment or HCT services involving agency data.

The selected initial HCT Client release is a free United States download for **PLAY only**, including PLAY's AI assistant. Standalone CHAT remains browser-only and no paid CHAT or purchase is included in native v1. This notice's coverage of browser CHAT and possible later client or purchase processing does not make those features part of the first native release.

Contact **freewis.support@hudsonct.com** for privacy questions or requests. You do not need an active FreeWIS account to contact us.

## The essential distinction

HCT supplies fictional, synthetic case data for PLAY. **Account identities, sign-in information, IP addresses, acceptance evidence and security records are real.** The rule against real case input does not guarantee that another user will follow it.

PLAY and CHAT are for people **18 or older**. The AI assistant is artificial intelligence, not a human or professional adviser. AI chatbots may not be suitable for minors. Neither service is for storing or working real cases. **Do not enter real-case information or personal information about a real person in PLAY or CHAT content.** Approved sign-in and requested account-administration information are permitted; this does not authorize real-data attachments or prompts.

HCT does not enable a web-search tool for the AI assistant. Standalone CHAT retrieves HCT-curated knowledge-base materials. Within PLAY, the assistant may also use the offered synthetic demonstration records and tools. Those sources do not make either service an open-web search or assure that an answer reflects later law, policy, guidance or events.

We do not sell personal information or use it for third-party advertising. FreeWIS uses essential session technologies and no advertising cookies or cross-site advertising trackers.

## Information and purposes

| Information | What we receive or keep | Why we use it |
| --- | --- | --- |
| Public-site and HCT Client connections | IP address, request time/page or function, request and connection metadata, browser/device/operating-system and app-version information where supplied, and relevant rate-limit, bot, firewall or abuse signals | Deliver pages and client functions, diagnose failures, limit abuse, enforce restrictions and secure the service |
| Sign-in and account | Provider identifier; name and email from supported Apple, Google or Microsoft sign-in, including an Apple private-relay email address where selected; profile photo where a supported flow supplies one; authorization codes and identity tokens used to complete sign-in; account and session state | Authenticate, distinguish accounts, provide supported identity/avatar features and administer access; HCT does not receive your provider password |
| Age eligibility and platform safeguards | Adult affirmation; where supplied and needed, age-range bounds or over/under-18 result, declaration/verification source, supervision or applicable approval/revocation status, sharing/availability/error state, and the minimum app/account or installation reference, check time and decision/rule version | Apply the 18-year minimum, deny known minors, obtain required usable verification, recheck changed signals and review an age-access decision; no advertising, marketing, profiling, analytics or AI-response use |
| PLAY admission | Admission status and timing, demonstration context, access period, service-provisioning outcome | Establish and retire the evaluation period and decide a later admission request |
| Acceptance and acknowledgement | Signing identity/provider, affirmation, timestamp, surface, accepted Agreement/Terms versions and hashes, acknowledged Privacy version and hash, and associated evidence events | Record the exact documents and action, enforce access rules and reproduce the accepted bundle |
| PLAY and CHAT content | Prompts, relevant conversation context, AI responses, messages, synthetic edits, notes, documents, reports and related service metadata | Supply the requested conversation and demonstration features through the configured knowledge and synthetic-demo tools, support them and address misuse or incidents |
| Security and service records | Relevant access/activity events, errors, authentication/session state, request patterns, abuse indicators, control decisions, restrictions and response records | Operate rate limits and other safeguards, investigate and respond to incidents, enforce restrictions, maintain service integrity and comply with law |
| Content, user and AI reports; blocking/moderation | Reported item/user/AI-response identifiers, reporter identity where applicable, selected reason, explanation, minimum review context, block state, review action and outcome | Receive and assess reports, apply a participant's block, moderate Community Content and AI output, enforce rules, prevent repeat abuse and document necessary action |
| GET and support | Requested professional contact details, agency/entity type, role/authority, intended use, known vendor relationships and status, implementation path, optional infrastructure/timeframe and correspondence | Review eligibility, resolve unknown facts, respond, discuss a possible license or service and retain the necessary business record |
| Copy-delivery records | Intended recipient, exact version/copy identity and mail submission result; delivery or failure information when available | Attempt agreement-copy delivery and accurately distinguish submission from receipt |

GET permits initial inquiries based on the requester's knowledge, including facts marked unknown. An authorized official must verify the required facts before qualification or execution. Prior relationships and current disqualifying involvement are distinct. HCT and ordinary infrastructure within the disclosed exception are not disqualifying merely because they are paid.

GET requests go to **freewis.support@hudsonct.com** through Microsoft 365 using Microsoft Graph. The request and correspondence may be stored in the support mailbox and Sent Items. Provide only the professional and administrative information requested. Do not submit secrets, credentials, real-case data or unnecessary restricted procurement material. If more sensitive administrative information is needed, contact support for an appropriate follow-up method before sending it.

FreeWIS uses essential cookies and similar session storage to sign users in, maintain access and protect the service. Session expiry and PLAY account retirement are separate: ending a browser session does not delete an account or content.

For native Sign in with Apple, FreeWIS processes Apple identity tokens, a one-time authorization code and a server-generated sign-in transaction and nonce to verify and complete the login. FreeWIS records Apple's stable provider identifier and the name or email supplied for that account; an email may be an Apple private-relay address, and Apple does not supply a profile photo. A returning account may use identity information previously retained for that same Apple identifier. FreeWIS separately stores the Apple refresh credential in encrypted form so it can revoke the app's Apple authorization during verified account deletion or PLAY-period retirement. That encrypted credential is separate from the account/admission row and audit events and is deleted after Apple confirms revocation. Protected backups remain subject to the backup and recovery rules below.

For hosted PLAY and CHAT, HCT may use rate limiting, web application firewalls, bot prevention, authentication/access controls, safety or content controls, logging and related security measures. Those measures may evaluate the connection, request, session/account and abuse information described above and may block or delay requests, restrict functions or help enforce a suspension. HCT uses that information for the protective and enforcement purposes described here. These measures reduce risk but do not promise perfect security or uninterrupted service.

An HCT Client uses the same hosted-service information described in this notice. Apple, Google, Microsoft or another distribution platform may separately process app downloads, updates and device/store-account information under its own terms. The initial native app has no purchase flow or paid CHAT. It does not collect or send purchase receipts or payment details to HCT. HCT does not receive a platform password or payment-card number merely because a person downloads an app. Before HCT offers a later paid client feature, the then-current notice and purchase flow must identify any receipt, transaction or entitlement information HCT receives and how it is used and retained.

## Age safeguards and limited platform signals

FreeWIS combines applicable available platform safeguards with its own neutral
adult affirmation and backend access checks. For a Google Play client, this
means the 18-and-over-only audience and Restrict minor access setting, plus
Play Age Signals where available. For an Apple client, it means the rating or
override consistent with the 18-year minimum and Declared Age Range where
available or required. The platform controls do not establish that every user
has been independently verified.

An age response may be verified, self- or guardian-declared, supervised,
unknown, not shared, unavailable or unsuccessful. These states describe the
actual source and availability, not interchangeable proof of adulthood. We do
not infer an exact birthdate from a range or ask for an exact date of birth by
default. If an additional lawful verification method is needed, its data and
purpose must be disclosed before collection through an appropriate secure
method; do not email passwords or identity documents.

On a native age screen, FreeWIS automatically requests the applicable Apple or
Google result once. An unavailable, declined or not-shared response, an
ordinary error, or an ambiguous range does not itself establish adulthood.
When there is no known-minor result, no positive retained mandatory platform
requirement and no unresolved unclassified prior verification hold, a person
may explicitly select **“I am 18 or older.”** FreeWIS records the assurance as
`self-declared-native-fallback`—a self-declared native fallback, not Apple- or
Google-verified adulthood. A shared adult range also still requires that
explicit adult declaration. On Android, an unresolved prior verification hold
remains closed on a generic error until a current result resolves it; a current
not-shared response can permit fallback only when it reports and preserves no
positive requirement.

We request and process only the fields needed for the applicable adult-access
check and any legally or platform-required age action. The information table
above describes those fields; not every platform returns every field. A
platform installation reference is used only if necessary and permitted for
that app's age-related control. We do not repurpose age signals across unrelated
apps or use them to build a general profile. Google Play age-signal information
is limited to permitted age-appropriate uses by the requesting app. Platform
age data is not sent to Anthropic or included in prompts, model context,
advertising, marketing, profiling or analytics.

Authorized personnel and the hosting/database providers acting for HCT may
process the minimum age-decision information only as needed to operate and
review the permitted age safeguard, subject to the platform's use limits. Apple
and Google separately operate their account, age-sharing and checking systems;
FreeWIS does not receive the identity documents or exact birthdate they may use
merely because it receives an age signal.

Browser and Windows paths use a neutral adult affirmation and FreeWIS backend
checks where permitted. Known minors are denied access. A positive retained
platform requirement for age-range sharing, age verification, parental consent
or adult notification keeps access closed until it is satisfied and cannot be
erased by a later unavailable or unsuccessful response. Supervision or parental
approval does not authorize a minor to use these adult services. Contact
support to ask about an age-access decision or correction; information
controlled by a platform may need correction through that platform.

## Visibility and sharing

PLAY is shared. Team collaboration messages and reports or charts generated against shared synthetic records may be visible to other evaluation participants. Account names or avatars displayed with an action may identify a real evaluator. Authorized HCT administrators may access content for operation, support, security and lawful response; the providers below process information for their relevant services.

When one participant's account is deleted, HCT deletes that departing participant's eligible personal data while preserving the remaining participants' eligible Team messages and access under their existing retention rules. This does not extend those messages' retention or create a permanent archive. A remaining message, quote or attachment that contains the departing participant's personal information remains subject to applicable rights review rather than being kept or erased automatically merely because another participant authored or received it.

Standalone CHAT is a separate knowledge-conversation surface. Shared Google or Microsoft identity does not itself make its conversations available to PLAY participants or grant access to PLAY case tools. Any user-initiated sharing feature exposes the content to the recipients or audience shown by that feature. Do not include confidential information in a conversation or shared link.

Shared participant content is subject to the [Community Content Guidelines](https://freewis.com/community-guidelines). In-app content, user and AI-output reports may give authorized HCT reviewers the reported item and minimum context needed to assess it. A participant's block affects only the interactions identified by the implemented control; it does not itself delete prior content or submit a report. HCT may filter, restrict, hide, remove or preserve content and retain necessary moderation evidence for the purposes described here.

Relevant knowledge-base excerpts and, within PLAY, synthetic demonstration-tool results may form part of the response context sent to Anthropic's API. General web search is disabled in both contexts.

HCT may use de-identified or aggregated information that no longer reasonably identifies a person to understand use and improve FreeWIS, subject to applicable law and provider restrictions. HCT does not use identifiable submissions under this notice to train a general-purpose AI model. Product feedback may be used to improve FreeWIS; we do not publicly identify its source without permission. These purposes do not authorize repurposing prohibited real-case content.

We may disclose information when legally required, when reasonably necessary to address fraud, threats, misuse or security incidents, or in a transaction involving the FreeWIS business subject to applicable law and privacy obligations. A transaction does not itself authorize new uses of the information.

## Providers and processing locations

HCT uses the following providers for the described functions:

- **Microsoft Azure:** application hosting, service logs, recovery records and the synthetic demonstration database, with HCT's primary hosted resources in United States regions.
- **MongoDB Atlas:** conversation history and admission/acceptance records, with HCT's primary database storage in a United States region.
- **Microsoft 365 / Microsoft Graph:** transactional email, agreement copies, GET requests and support correspondence, including mailbox and Sent Items copies.
- **Apple, Google and Microsoft:** supported sign-in and associated identity information. Their own account services are subject to their applicable terms and practices.
- **Anthropic's API:** messages and the conversation context needed to generate the AI assistant's responses. See [Anthropic Commercial Terms](https://www.anthropic.com/legal/commercial-terms), [Privacy Policy](https://www.anthropic.com/legal/privacy), and [commercial-data retention information](https://privacy.claude.com/en/articles/7996866-how-long-do-you-store-my-organization-s-data).
- **Apple, Google and Microsoft distribution services, when an HCT Client is offered there:** app distribution, updates, store-account administration, purchase processing and platform reporting. Their store terms and privacy practices govern their independent processing; HCT's current disclosures must identify the information HCT actually receives from them.

HCT authorizes provider processing for the service, support, security and lawful-response purposes described here, under the applicable account and protective terms. The source license for an open-source component is not a separate authorization to use personal information. Providers may also have their own legally required or contractually permitted safety and security processing.

Anthropic's published standard API period is up to 30 days, with exceptions for particular services, agreed settings, covered-model safety requirements, misuse enforcement and law. Its published policy describes longer retention for some flagged content and feedback. **HCT's actual account, enabled features and applicable terms determine the treatment; this notice makes no zero-retention promise.** Deleting FreeWIS history does not itself prove deletion of provider-held copies. Primary United States storage does not mean every provider, support activity or legally required disclosure occurs only in the United States.

## Google user data

FreeWIS's use and transfer of information received from Google APIs follows the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including Limited Use requirements where applicable to the scopes used. We use the supplied identity fields for sign-in, account identification, acceptance evidence and supported profile features, not advertising or sale. Applicable restrictions continue to govern derived information. If a new use requires notice or consent under Google's policy, we provide it before that use.

## Retention and deletion

The following rules distinguish ordinary content from the limited evidence needed after access ends. A legal hold or documented incident may require restricted retention. It does not authorize continuing ordinary use of the retained content.

| Record class | Retention or retirement rule | Treatment after the ordinary period |
| --- | --- | --- |
| PLAY access and account provisioning | Ordinarily retires approximately **14 days after admission**, unless expressly extended or ended sooner. Following a deletion request, ordinary PLAY content and unnecessary profile/provisioning data are deleted or reset within **7 calendar days after HCT records receipt**. | Connected access is retired; unnecessary profile and provisioning data is deleted or minimized. A later admission uses a new period and current documents. |
| Ordinary PLAY period content, including period chats, uploads, edits and generated artifacts | Deleted or affected synthetic records regenerated as part of retirement on the approximately **14-day clock**; following a deletion request, the departing participant's eligible content/personal data is deleted or reset within **7 calendar days after HCT records receipt**; an extended period follows its revised date; earlier resets may occur | Preserve remaining participants' eligible Team replies and access under their existing retention, without extending that period or creating a permanent archive. Quotes or attachments containing the departing participant's personal information remain subject to rights review. If identity/authority verification or a specific legal constraint prevents safe completion, HCT promptly explains the issue, required action and expected timing without extending any applicable legal deadline. |
| Standalone CHAT conversations and their content | Deleted from ordinary FreeWIS history approximately **14 days after the conversation's last activity** | A separate CHAT clock applies, independent of PLAY retirement. Limited evidence, holds, backups and provider copies follow the rules below. |
| Age signals and eligibility decisions | Process raw platform responses only as long as necessary for the permitted age check; do not retain full raw payloads by default. Keep only a justified minimum eligibility result, source/assurance and app scope, check time, rule version and necessary account linkage while needed to enforce or review age access or meet a specific legal duty. A permitted manual result uses assurance `self-declared-native-fallback`. | Recheck when required or when usable changed information is received; remove superseded raw details and delete or minimize decision evidence when its justified basis ends. An unavailable signal or self-declared native fallback is not verified-adult status. Any permitted incident/hold retention is limited and restricted; no indefinite age profile or fixed new retention period is created. |
| Emailed agreement copy and minimal acceptance/admission evidence | The agreement copy emailed to the user and the minimum receipt needed to prove the presented versions, acceptance and access decision are kept under restricted access while a continuing legal need exists; that need is reviewed at least annually. | Keep only necessary identity, document and event evidence. Annual review is not indefinite retention: delete unnecessary fields, receipts and emailed copies when the basis ends. A permanent public document archive contains legal text, not a public list of accepting users. |
| Routine diagnostic and security logs | **30 days**, unless a specific actual incident, abuse restriction or legal hold requires identified evidence for longer | Delete or minimize at the end of the routine period. Longer retention is restricted to the necessary evidence and ends when its documented basis ends. |
| Completed deletion receipts | **90 days after verified completion** | Keep only the minimum request reference, verified scope, completion date, outcome and necessary contact/identity linkage; then delete unless a specific continuing legal need is documented. |
| Actual abuse restrictions, investigations, reports and legal holds | Only while necessary for the documented restriction, investigation, dispute or legal duty; active restrictions are reviewed at least every **90 days** | Minimize to relevant items, context, events and identifiers; release and delete when the basis ends. A 90-day review does not authorize automatic or indefinite retention. |
| GET and support correspondence | Kept while reviewing/responding and while needed for the resulting business transaction, a relevant claim period or a legal records duty | Remove unnecessary narrative and duplicate copies when no longer needed; keep a minimal eligibility/decision record where justified. An unsuccessful request is not by itself a reason for permanent retention. |
| Suspected real-case or prohibited personal data | Quarantine/restrict promptly after discovery; assess exposure, recipients, applicable reporting, lawful preservation and provider copies | Preserve only necessary evidence securely, stop ordinary onward use, and lawfully delete or return the material when the response/preservation basis allows. No unconditional immediate purge or indefinite ordinary retention. |
| Recovery records needed to reapply deletion or restrictions | Minimum account-period and service-record identifiers, a keyed hash of the sign-in identifier, request references and verification results are kept independently while corresponding backup copies remain restorable, plus the documented recovery-check period. Unfinished cleanup remains under review. | These records contain no message or case content. They are separate from the ordinary 90-day completed-request receipt and are deleted or minimized when their recovery or specifically documented preservation purpose ends. |
| Protected backups and replicas | Follow their secured rotation and recovery cycle, with deletion propagated to active systems | Material pending backup expiry is isolated from ordinary use; any restoration must reapply applicable deletions and restrictions. Legal holds remain limited to the necessary evidence. |
| Provider copies, including Anthropic | Governed by actual provider/account terms and applicable retention or preservation requirements described above | HCT requests or coordinates deletion where available and appropriate. HCT's ordinary 14-day clocks do not promise erasure of every independently retained provider copy by that date. |

HCT may keep truly de-identified or aggregated information for product analysis where it no longer reasonably identifies a person and applicable restrictions permit that use. Renaming or regenerating a case record alone is not proof of de-identification.

## Requests, including inactive accounts and non-users

You may request access to, correction of or deletion of personal information about you, or ask about an applicable privacy right, by emailing **freewis.support@hudsonct.com**. This channel is available to current or former users, people without an account and authorized representatives. Describe the record or location with the minimum detail needed to find it; do not resend real-case content, passwords or identity documents unless HCT arranges a necessary secure verification method.

We may need proportionate information to locate the record and verify your identity or representative authority. A sign-in account is not proof of authority over another person's information. If a record cannot safely be located or a requested action is restricted by law or another person's rights, we will explain the applicable limitation. We handle applicable rights within the required legal period, provide reasons for a denial and describe an available appeal when law requires it. You may also ask support to reconsider a response. A general business preference does not override a statutory right.

Account retirement, content deletion, official records requests and legal preservation are different processes. HCT may retain the specific evidence required for a lawful exception while restricting access and unnecessary use.

## Unexpected data, security and age concerns

If you find suspected real-case or prohibited personal information, stop accessing or sharing it and report its location to **freewis.support@hudsonct.com**. We assess necessary containment, provider coordination, notice and lawful deletion. We use HTTPS, access controls, supported sign-in and security logging; no service can promise perfect security.

If you believe a minor is using PLAY or CHAT or has submitted personal information, contact support. HCT will assess the information, restrict ineligible access and address the data under applicable requirements. An adult-only rule is not a promise that underage use can never occur.

FreeWIS and support email are not emergency or abuse-reporting channels. For immediate danger contact emergency services; for a child-safety concern contact the appropriate local child-protective or law-enforcement agency. In a United States suicide or mental-health crisis, call or text [**988**](https://988lifeline.org/).

## Changes and acknowledgement

We show the notice version and effective date and retain version-specific copies. Material changes affecting retained information are communicated through an appropriate reachable channel, including account email where available or a prominent public notice. This applies to PLAY, CHAT, GET, support and former users whose information remains covered. We obtain any legally or contractually required consent before a new use; posting a new notice alone is not permission to repurpose previously collected information.

PLAY and CHAT ask you to acknowledge that this notice was provided. That acknowledgement is not a waiver of privacy rights or incorporation of this notice as a separate contract. For PLAY acceptance, HCT attempts the agreement-copy email described in the PLAY Agreement, with a versioned PDF and accessible text; a submission record is not proof of delivery.

## Contact

**Hudson Consulting and Training, LLC** · Mailing address: 7765 Wadsworth Blvd #740433, Arvada, CO 80006 · **freewis.support@hudsonct.com**