Privacy Policy

We are committed to protecting your privacy and handling personal data responsibly. This policy describes the categories of data we process, why we process them, the legal bases we rely on, and the choices and rights available to you. By using the Service, you acknowledge the practices described in this policy.

We collect the following categories of information:

• Account information— such as your name, email address, phone number, role, and password, provided when you register or are invited to an organization.
• Organization data— information your organization adds to the Service to run its operations, which may include details about team members, customers, schedules, locations, and the services you offer.
• Usage data— information about how you interact with the Service, such as features used, actions taken, and preferences.
• Device and log data— technical information automatically collected when you use the Service, such as IP address, browser or device type, operating system, and timestamps of activity.

We use personal data to:

• Provide, operate, maintain, and secure the Service.
• Authenticate users and protect against fraud and unauthorized access.
• Send transactional communications, such as verification codes, account notices, and service-related messages.
• Respond to support requests and communicate with you about the Service.
• Analyze and improve the Service, including developing new features.
• Comply with legal obligations and enforce our terms.

Where applicable data protection law requires a legal basis for processing, we rely on one or more of the following:

• Contract— processing necessary to provide the Service you or your organization have requested.
• Legitimate interests— processing to secure, maintain, and improve the Service, where those interests are not overridden by your rights.
• Legal obligation— processing necessary to comply with applicable laws.
• Consent— where we ask for your consent for a specific purpose, which you may withdraw at any time.

We do not sell personal data. We may share personal data in the following ways:

• Within your organization— with administrators and team members according to the roles and permissions configured in the Service.
• Service providers— with vendors who process data on our behalf to help us operate the Service (for example, hosting, messaging, and analytics providers), under appropriate confidentiality and security obligations.
• Legal and safety— when required to comply with the law, respond to lawful requests, enforce our terms, or protect the rights, property, or safety of Workbook, our users, or the public.
• Business transfers— in connection with a merger, acquisition, or sale of assets, subject to this policy.

We retain personal data for as long as needed to provide the Service, comply with our legal obligations, resolve disputes, and enforce our agreements. Retention periods vary depending on the type of data and the purpose for which it is processed. When data is no longer required, we take reasonable steps to delete or anonymize it.

We use technical and organizational measures designed to protect personal data, including encryption of data in transit, role-based access controls, and audit logging of sensitive actions. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to address vulnerabilities promptly.

Depending on your location, you may have rights regarding your personal data. The Service is designed to support these rights, including data export and deletion capabilities for administrators.

• Access— request a copy of the personal data we hold about you.
• Correct— ask us to correct inaccurate or incomplete data; many fields can be edited directly within the Service.
• Delete— request deletion of your personal data, subject to legal retention requirements. The Service supports account and data deletion through administrator controls.
• Export— obtain a portable copy of your data; the Service supports data export for organization administrators.
• Restrict or object— ask us to restrict or object to certain processing, subject to applicable law.

To exercise these rights, contact your organization's administrator or reach us using the details in the Contact section below. We may need to verify your identity before acting on a request.

Workbook operates globally, and your personal data may be processed and stored in countries other than the one in which you are located. Where we transfer personal data across borders, we take steps to ensure an appropriate level of protection consistent with applicable law, such as using recognized transfer mechanisms and contractual safeguards.

We use cookies and similar technologies (such as local storage) to keep you signed in, remember your preferences, and understand how the Service is used. You can control cookies through your browser settings, though disabling certain cookies may affect the functionality of the Service.

The Service is intended for use by businesses and is not directed to children. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can take appropriate action.

We may update this Privacy Policy from time to time. When we make material changes, we will provide reasonable notice, for example by posting the updated policy with a new "Last updated" date or by notifying you through the Service. We encourage you to review this policy periodically.

If you have questions about this Privacy Policy or our data practices, or to exercise your rights, contact us at [email protected].