Skip to content

Privacy Policy

Effective date: November 1, 2026

Workel, Inc. [To confirm: exact legal name of the company] ("Workel", "we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit workel.com or use our workspace and project management platform, including our web, desktop and phone apps and related services (collectively, the "Service"). For the personal data described here, Workel is the controller. For the content a workspace stores in the Service, the workspace's organization decides what goes in, and we process it on its behalf.

1. Information We Collect

1.1 Account Data

When you create an account, we collect your name, email address, profile photo (if provided), and authentication credentials. If you sign in with Google, Apple or GitHub, we receive your basic profile information (name, email address and an account ID) as authorized by you.

1.2 Usage Data

We automatically collect information about how you interact with the Service, including pages visited, features used, actions taken, timestamps, and frequency of use. This data helps us improve the Service and provide relevant features. When you sign up, we record which workel.com page and button you came from, the referring site and any campaign tags in the link.

1.3 Device and Technical Information

We collect device type, operating system, browser type and version, IP address, time zone, and general location data derived from your IP address. If you turn on notifications in our phone app, we store a push token for your device. When the apps hit an error, they send us an error report with the app version, the page and your account ID. This information is used for security monitoring and service optimization.

1.4 Content Data

We store the content you create within the Service, including projects, tasks, files, messages, pages, comments, calls you join, and any other materials you upload or generate. This content is stored to provide the Service to you and your workspace.

1.5 Support Messages

When you write to us through the help button on workel.com or in the app, we keep your name, email address, your messages, any screenshots or files you attach, and the page you wrote from. A report sent from the app can also include technical context, such as recent error messages and the requests that failed. When you use "Ask a question" on workel.com, we send your question to our AI provider to write the answer, and use your IP address to limit how many questions one visitor can ask.

2. How We Use Your Information

We use the information we collect for the following purposes:

  • To provide, maintain, and improve the Service
  • To authenticate your identity and manage your account
  • To process transactions and manage your subscription
  • To send you service-related notifications, updates, and administrative messages
  • To respond to your inquiries and provide customer support
  • To monitor and analyze usage trends to improve user experience
  • To measure our advertising, where you have allowed it
  • To detect, prevent, and address technical issues, fraud, and security threats
  • To comply with legal obligations and enforce our terms

3. Who Handles Your Data

We do not sell your personal information. We use the companies below to run the Service. Each one gets only the data it needs for the job described, and processes it on our instructions. Where a region is given, it is where the provider holds the data for us. Unless it says otherwise, the provider is in the United States.

3.1 Running the Service

  • Microsoft Azure: Hosts our servers, database, file storage, email queue and logs, which means all account and workspace data. Region: Central US [To confirm: that the production resources are in Central US]. The desktop app also downloads its updates from Azure storage, which sees your IP address, app version and operating system.
  • Cloudflare: Serves workel.com, app.workel.com and our AI connector (mcp.workel.com), so it handles every request: your IP address, browser details and the pages you open. It runs on Cloudflare's global network, close to where you are.
  • Vercel: Redirects www.workel.com to workel.com, and so sees the IP address and browser details of visitors who use that address.
  • Pusher: Delivers live updates (new messages, task changes, call invites) to your open apps. It sees your IP address and the content of each update. Region: US East (Ohio).
  • LiveKit: Carries voice and video calls and screen sharing: your audio, video, name and IP address while you are in a call. Calls are not recorded. [To confirm: LiveKit Cloud region, and that calls are never recorded]
  • Brevo and Microsoft Azure Communication Services: Send our emails (account emails, notifications, digests and support replies), so they receive your name, email address and the email's contents, and tell us whether an email was delivered and opened. [To confirm: which of the two is live, and Brevo's region (Brevo is based in France)]
  • Stripe: Processes payments for paid plans: your name, email address, billing details and card details, which go straight to Stripe and never touch our servers. Stripe also collects device and IP information to prevent fraud.
  • Sentry: Receives crash and error reports from our phone app and servers, with your account ID, device and app version, and error details from which we remove email addresses and other personal details. Region: United States. [To confirm: the region of the servers' Sentry project]
  • Expo, Apple and Google: Deliver phone notifications. Expo passes each notification to Apple (iPhone) or Google Firebase Cloud Messaging (Android). They receive your device's push token and the notification's title and text, which can include a short preview of a message or a caller's name.
  • Google, Apple and GitHub sign-in: If you choose to sign in with one of them, that company confirms who you are and shares your name and email address with us. On our sign-in pages, Google's sign-in script loads and can see your IP address and Google cookies.
  • Google Fonts: Serves the fonts in the web app, and so sees your IP address and browser details.
  • OpenStreetMap and MET Norway: When you add a place to an event, we look up the address with OpenStreetMap's Nominatim service and show its map tiles. The calendar's weather comes from MET Norway, which receives only an approximate location (rounded to about 1 km), never your identity.
  • Slack: Our team gets internal alerts about failed payments and errors in Slack, and these can include an account ID or email address. [To confirm: that alerts still go to Slack in production]

3.2 The AI Assistant

When you use the assistant, voice notes, document and task extraction, or "Ask a question" on workel.com, we send what the feature needs to an AI provider: your request, and the workspace content it works on (such as tasks, pages, documents, images, audio and recent messages in the conversation).

  • OpenAI: Runs our default models for the assistant, transcription, image creation and content checks.
  • OpenRouter: Routes a request to the model you pick in the assistant, from Anthropic, Google, xAI, DeepSeek or Moonshot AI. Each of them receives the same content for that request. [To confirm: whether the DeepSeek and Moonshot AI models run on servers in China, and if so how we tell users before they pick them]

These providers do not train their models on your content, and what they may keep is limited in each request we send, not only in an account setting:

  • OpenAI does not use what we send through its API to train its models. Every request asks OpenAI not to store it. OpenAI may keep a request for up to 30 days to detect abuse, then deletes it. [To confirm: whether our OpenAI organization has zero data retention or modified abuse monitoring; if it does, replace the 30-day sentence]
  • OpenRouter is told, on every request, to send it only to providers that do not store or train on it. If no such provider serves the model you picked, the request fails rather than going to one that does. [To confirm: whether OpenRouter keeps prompts itself under our account's logging setting, and for how long]

A private assistant chat is erased after 60 minutes without activity.

3.3 AI Assistants You Connect

A workspace owner or admin can connect a workspace to an outside AI assistant, such as Claude, through the Workel connector at mcp.workel.com. The connector runs on Cloudflare and stores no workspace content. When the assistant asks for projects, tasks, comments, events, members (including their email addresses) or attachments, we send that content to the assistant's provider, whose own privacy policy then applies to it. A connection can only read and write what the owner or admin approved, and can be ended at any time in Workel under Settings → Developers → Connected apps.

3.4 Apps You Connect

When you connect another service, such as Google Calendar, Google Drive, Trello, Todoist, Notion, Linear, Slack or GitHub, or add a webhook or an embed (YouTube, Figma, Loom and the like), data moves between Workel and that service because you asked it to, and that service's own privacy policy applies to what it receives. When you post a link, our server fetches the page to show a preview, without sending your IP address.

3.5 Everyone Else

  • Workspace Members: Information you share within a workspace is visible to other members of that workspace according to the access controls set by workspace administrators.
  • Advertising and analytics: Section 9 lists every measurement tool on workel.com and in the web app, and which of them wait for your permission.
  • Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of Workel, our users, or the public.
  • Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of the transaction. We will notify you of any such change.

4. Why We're Allowed To Use It

If you are in the European Economic Area, the United Kingdom or Switzerland, the law requires us to name the legal basis for each use of your data:

  • To provide the Service you signed up for: Your account, your workspace content, calls, notifications, emails about your account, payments and the AI features you use. Basis: performing our contract with you.
  • To keep the Service safe and working: Security monitoring, error and crash reports, preventing fraud and abuse, and limiting how often a feature can be used. Basis: our legitimate interest in running a secure, reliable service.
  • To understand and improve the Service: Counting visits without cookies (Umami), usage statistics and recording where a sign-up came from. Basis: our legitimate interest in knowing which parts of Workel are used.
  • To answer you: Support conversations and "Ask a question". Basis: our legitimate interest in helping people who contact us, or our contract with you if you have an account.
  • To measure advertising and record visits on workel.com: The tools in section 9 that wait for "Accept". Basis: your consent, which you can withdraw at any time with "Cookie settings".
  • To meet legal obligations: Keeping billing and tax records, and responding to lawful requests. Basis: legal obligation.

5. Where Your Data Is Stored and International Transfers

We store account and workspace data in the United States, in Microsoft Azure's Central US region, and most of the providers in section 3 are based in the United States. If you use Workel from outside the United States, your data is therefore transferred there.

For transfers from the European Economic Area, the United Kingdom and Switzerland, we rely on [To confirm: the safeguards actually in place: e.g. each provider's certification under the EU-U.S. Data Privacy Framework (and the UK Extension and Swiss-U.S. framework), and/or the Standard Contractual Clauses in our data processing agreements with Microsoft, Stripe, OpenAI, Sentry, Pusher, LiveKit, Brevo and the others in section 3]. You can ask us for a copy of these safeguards at the address in section 12.

6. Data Security

We implement industry-standard security measures to protect your data. All data is encrypted at rest using AES-256 encryption and in transit using TLS 1.3. We maintain strict access controls, conduct regular security audits, and follow secure development practices. Workel is not SOC 2 certified yet.

7. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. When you delete your account, we delete any workspace only you are in, and 30 days later we erase your personal details: your name, email address, sign-in methods, connected apps and settings. What you added to a workspace your teammates still use stays there, shown as "Former member". We keep data longer only where we are required to retain it for legal or regulatory purposes. Workspace data may be retained according to the workspace administrator's retention policies. Some data has its own, shorter limit:

  • Support conversations: We keep your messages for as long as we need them to help you. We delete the technical context attached to a report (error messages and failed requests) after 180 days, and screenshots and files you attached after 365 days. [To confirm: the job that deletes them (support:prune) is not built yet, and a limit for the messages themselves]
  • Error reports and page-view statistics: Deleted after 30 days.
  • Notifications: Deleted 180 days after they are sent.
  • Phone push tokens: Deleted after 30 days without use.
  • Private assistant chats: Erased after 60 minutes without activity.
  • Backups: Database backups are kept for 7 days, so deleted data leaves them within a week.
  • Billing records: Kept for as long as tax and accounting law requires. [To confirm: the period]
  • Your cookie choice: Kept in your browser for one year.

8. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

8.1 GDPR Rights (European Economic Area and United Kingdom)

  • Right to access your personal data
  • Right to rectification of inaccurate data
  • Right to erasure ("right to be forgotten")
  • Right to restrict processing
  • Right to data portability
  • Right to object to processing based on our legitimate interests
  • Right to withdraw consent at any time
  • Right to complain to your local data protection authority

8.2 CCPA Rights (California)

  • Right to know what personal information is collected, used, and shared
  • Right to request deletion of personal information
  • Right to opt out of the sale or sharing of personal information for targeted advertising
  • Right to non-discrimination for exercising your rights

To exercise any of these rights, please contact us at privacy@workel.com. We will respond to your request within 30 days.

9. Cookies and Measurement Tools

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. Cookies that keep you signed in and remember your settings are needed for the Service to work.

9.1 On workel.com

The tools below that set cookies load only after you choose "Accept" in the cookie bar. Until then, none of them is fetched. You can change your choice at any time with "Cookie settings" at the bottom of every page. Declining after you accepted deletes their cookies on workel.com; cookies those companies set on their own sites are yours to clear in your browser. We remember your choice in a cookie called workel_consent for one year.

Only after you accept:

  • Google Analytics and Google Ads (Google): Counting visits and measuring which ads bring people to the site. Cookies: _ga, _ga_<id>, _gid, _gcl_au, plus any the company sets on its own domain.
  • Meta pixel (Meta): Measuring our Facebook and Instagram ads and building ad audiences. Cookies: _fbp, _fbc, plus any the company sets on its own domain.
  • Reddit pixel (Reddit): Measuring our Reddit ads. Cookies: _rdt_uuid, _rdt_em, plus any the company sets on its own domain.
  • Microsoft Clarity (Microsoft): Heatmaps and session replays: recordings of clicks, scrolling and mouse movement on our pages, used to find what confuses visitors. Cookies: _clck, _clsk, _uetsid, _uetvid, plus any the company sets on its own domain.
  • DataFast (DataFast): Counting visits and which channels lead to sign-ups. Cookies: datafast_visitor_id, datafast_session_id, plus any the company sets on its own domain.

For every visitor (no cookies and no visitor ID):

  • Umami (Umami Software): Counting page views, referrers and clicks on sign-up buttons, without cookies or a visitor id.
  • Vercel Web Analytics (Vercel): Counting page views without cookies or a visitor id. It runs only on pages served from Vercel.

9.2 In the Workel apps

The web app (app.workel.com) loads the Meta pixel, which sets the _fbp cookie and tells Meta which pages you open and when you sign up, so we can measure our ads. [To confirm: the web app loads it today without asking first; add a consent step like workel.com's before this policy goes live, then describe it here] The desktop app blocks it. [To confirm: checked from the desktop app's security settings, not yet in the running app] The phone app has no advertising or analytics tools; it sends crash reports to Sentry (section 3.1).

You can also control cookies through your browser settings, though blocking the cookies that keep you signed in will stop the Service from working.

10. Children's Privacy

The Service is not directed to individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that information promptly. If you believe we have collected information from a child, please contact us at privacy@workel.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the effective date. For significant changes, we will provide additional notice, such as an email notification or an in-app banner. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at:

Workel, Inc. [To confirm: legal name]

[To confirm: postal address]

Email: privacy@workel.com

Data protection officer: [To confirm: name, or that none is required]

Representative in the EU and UK: [To confirm: name and address, or that none is required]