Privacy Policy

This policy covers Workloop's website, web app, desktop and mobile apps, and API. It applies to people with a Workloop account, guests who join a meeting or receive an invite, and visitors to our website.

For content inside a workspace, the workspace owner decides who can see it. We process that content on the workspace's behalf, to provide the service.

Account information

• Your name, email address, and profile picture if you add one.
• Your password, stored only as a one-way hash. We never see it in plain text.
• Two-factor authentication settings and backup codes, if you turn them on.
• Which version of these policies you accepted, and when.

Content you create

• Tasks, projects, comments, documents, diagrams, files, chat and direct messages, and calendar events.
• Names and email addresses of people you invite to a workspace or a meeting.

Video calls

• Audio, video and screen shares are sent in real time through our video servers. We do not record calls.
• We store details about each call: the room, who started it, start and end times, and names given by people asking to join.

Usage and security data

• IP address, browser or device type, and login times.
• An activity log of important actions, such as creating or deleting items, downloading files and changing members. Workspace admins can see the log for their workspace.

Device data

• A push notification token, if you allow notifications. It lets us deliver alerts to your device.

Billing data

• Your plan and subscription status. Payments are handled by Lemon Squeezy. We never receive your full card number.

Data from integrations you connect

• If you connect services such as Google Calendar, Outlook, Slack, GitHub or Calendly, we receive the data needed to sync with them. For example: calendar events and attendee emails, messages in channels you bridge, or issues and pull requests.

• To run Workloop: store and sync your content, deliver messages and calls, and send notifications.
• To send service emails: account verification, password resets, workspace invitations and meeting invites.
• To keep accounts and workspaces secure, prevent abuse and investigate problems.
• To process payments and manage your plan.
• To meet legal obligations.

We do not sell your data, do not use it for advertising, and do not use your content to train AI models.

• Contract: to provide the service you signed up for.
• Legitimate interests: to keep Workloop secure and improve its reliability.
• Consent: for push notifications and connected integrations. You can withdraw consent at any time.
• Legal obligation: for example, tax records for payments.

Your workspace:other members can see content according to the workspace's settings. Owners and admins can manage members and see the activity log.

Service providers process data for us only to run Workloop:

• Hosting and database providers. Our servers store your account and workspace data.
• Amazon Web Services (S3), for file storage.
• Pusher, or our own real-time servers, for live updates and chat delivery.
• Google Firebase Cloud Messaging, for push notifications.
• Resend or useSend, for sending emails.
• Lemon Squeezy, for payments, as merchant of record.
• Composio, for connecting the third-party integrations you choose.

We may also share data if the law requires it, to protect people's safety or our rights, or as part of a merger or acquisition. If that happens, this policy will continue to apply.

Essential cookies keep you signed in and protect your account. They are always on, because Workloop cannot work without them. Your browser or app also saves a few preferences on your device: your theme, your push notification token, which banners you have dismissed, and your cookie choice.

Optional analytics cookies are used only if you allow them. We do not use advertising cookies.

On your first visit to our website, we ask for your choice. You can change it at any time using "Cookie settings" at the bottom of any page. We keep your choice for 12 months, then ask again. The desktop and mobile apps use only essential storage.

• We keep account and workspace data while your account or workspace is active.
• When you delete content or your account, we remove it from our active systems. Backup copies are cleared on a rolling basis.
• We keep security logs and billing records for as long as needed for security, accounting and legal purposes.

Depending on where you live, you may have the right to:

• access the personal data we hold about you, and get a copy of it;
• correct inaccurate data;
• delete your account and data;
• object to or restrict certain processing;
• withdraw consent you have given.

To use these rights, email [email protected]. We will reply within 30 days. You can also complain to your local data protection authority.

We protect your data with encrypted connections (HTTPS/TLS), hashed passwords, optional two-factor authentication, access controls and audit logging. No system is perfectly secure. If a breach affects your personal data, we will notify you as the law requires.

Our providers may process data in countries other than yours. When data leaves the EEA or UK, we rely on safeguards such as Standard Contractual Clauses.

Workloop is not for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

If we make significant changes, we will update the date at the top and notify you by email or in the app before they take effect.

Questions or requests about your privacy? Email us at [email protected].