Privacy Policy

Version 0.2.0 · Updated 2 October 2026

This policy explains how Workelligence Ltd ("workelligence", "we", "us") uses personal data when we decide why and how it is processed (that is, where we are the controller (or a "business" under US state privacy laws). It covers visitors to workelligence.com, people who contact us, users of the workelligence app, and the contact persons of our customers and prospects.

It is written for the United Kingdom (UK General Data Protection Regulation and Data Protection Act 2018, "UK GDPR") and the United States (see section 10). Where the EU General Data Protection Regulation applies to you, the same rules and rights apply. Customers based in Germany or Austria: see our German-language Datenschutzerklärung.

1. Who is responsible

Workelligence Ltd, 128 City Road, London EC1V 2NX, United Kingdom. Company number 17307391, registered in England and Wales.

• Contact for privacy questions: support@workelligence.com (subject "Privacy"), or our contact form at workelligence.com/contact
• Information Commissioner's Office registration number: ZC263294

We have not appointed a data protection officer because the law does not require one for our processing. Our privacy contact handles all data protection matters.

2. Data in customer workspaces: we are the processor, not the controller

Agencies use workelligence to manage their own contacts, clients, projects, time, emails, documents and invoices. For that workspace content the agency is the controller (in the US: the "business") and we process the data only on its instructions as its processor (in the US: its "service provider"), under our Data Processing Agreement.

If you are, for example, a client, supplier or email correspondent of an agency that uses workelligence, or you submitted a form an agency published with workelligence, the agency's own privacy notice applies. Please contact the agency to exercise your rights. If you contact us instead, we will forward your request to the agency (see Privacy Requests).

This policy covers only the processing listed below, where we decide the purposes ourselves.

3. What we process, why, and on which legal basis

The legal bases below are those of the UK GDPR (and EU GDPR where it applies).

3.1 Visiting our website

Our website does not use cookies, analytics, advertising or tracking tools, and it loads no content from third-party servers (our fonts are hosted by us). The app also uses only self-hosted fonts.

When you open a page, our hosting provider Cloudflare necessarily processes technical connection data: IP address, date and time, the page requested, referrer, browser and operating system. We use this only to deliver the site, keep it secure and defend against attacks.

• Legal basis: our legitimate interest in providing a secure website (Art. 6(1)(f)).

3.2 Contacting us, the contact form, demo requests

When you write to us or use our contact form, we process your name, email address, company, role and what you tell us, to answer you. Support and contact requests are handled in our ticket system Freshdesk.

• Legal basis: steps prior to a contract at your request (Art. 6(1)(b)), or our legitimate interest in answering business enquiries (Art. 6(1)(f)).

3.3 Creating and using a workelligence account

To give you access to the app we process:

• Account data: name, email address, password (stored only as a salted hash), language, time zone, profile preferences, and your membership and role in each workspace.
• Sign-in and security data: session cookies (see Cookies and Similar Technologies), two-factor authentication settings and recovery codes, records of re-authentication before sensitive actions, API keys you create (stored only as a hash). We use IP addresses in memory to limit sign-in attempts; we do not store them in your account.
• Acceptance records: which version of our terms you accepted, and when.
• Service emails: emails needed to run your account) address verification, password reset, invitations, email-change confirmations and security notices. We send them through Brevo.
• AI usage metering: when you use AI features we record which user triggered a request, the feature and the number of tokens used, to apply plan allowances. We do not store your prompts or the AI's answers in these records.

Legal basis: performance of our contract with you (Art. 6(1)(b)) or, where your organisation gave you access, our legitimate interest in providing the service your organisation subscribed to (Art. 6(1)(f)); for security records, our legitimate interest in protecting accounts and the service (Art. 6(1)(f)).

Connecting your mailbox (optional, where available). If you connect a Gmail or Microsoft 365 mailbox, we store the access tokens (encrypted) to sync and send email on your behalf. The emails themselves are workspace content (section 2). Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: we use Gmail data only to provide the features you see in the app, we do not use it for advertising, and we do not use it to train AI models.

3.4 Customers, subscriptions and billing

For agencies that subscribe we process the billing contact's name and email, the company's name, billing address, tax or VAT number, the plan, number of seats, subscription status and payment history.

• Payments are handled by Stripe. You enter card or bank details directly with Stripe; we never see full card numbers. Stripe also calculates applicable taxes (VAT, US sales tax) from your billing address. Stripe processes payment data partly as our processor and partly as an independent controller (for fraud prevention and its legal duties), see stripe.com/privacy.
• Legal basis: performance of the contract (Art. 6(1)(b)); keeping accounting and tax records required by law (Art. 6(1)(c)).

3.5 Support

When you contact support we process your contact details, the content of your message and, where you allow it and it is needed to solve the problem, information from your workspace. Tickets are managed in Freshdesk. We only access workspace content to answer your request or when needed for security or legal reasons.

• Legal basis: Art. 6(1)(b) (contract), otherwise Art. 6(1)(f) (legitimate interest in helping users).

3.6 Service messages, newsletter and marketing emails

We send customers and users information about important changes to the service (for example changes to these documents, new sub-processors, planned maintenance). These messages are part of the service (Art. 6(1)(b)).

We send our newsletter and product news:

• to people who subscribed (on the basis of your consent (Art. 6(1)(a)). We confirm your subscription by email before sending anything (double opt-in). To prove your consent we store the time of sign-up and confirmation, the IP address at confirmation and the consent text. If you do not confirm, we delete your sign-up after 30 days;
• to existing customers and users, about our own similar products and services, where the law allows this without consent (Art. 6(1)(f); in the UK reg. 22 of the Privacy and Electronic Communications Regulations; in the US the CAN-SPAM Act). We tell you when we collect your email address, and in every email, that you can opt out at any time.

Every marketing email contains an unsubscribe link and our postal address. Unsubscribing does not affect service messages. We send the newsletter through Brevo (Sendinblue SAS, France), which processes the data in the EU as our processor. We do not measure whether you open our emails or click links in them.

3.7 Security, abuse prevention and legal claims

We process the data above as necessary to detect and stop attacks and abuse, to enforce our Terms of Service and Acceptable Use Policy, and to establish, exercise or defend legal claims.

• Legal basis: our legitimate interests (Art. 6(1)(f)); legal obligations (Art. 6(1)(c)).

3.8 Data we did not collect from you

If a colleague invited you to a workspace, we receive your name and email address from them. For contact persons of customers and prospects, we may receive business contact details (name, business email, role, company) from your employer or from public business sources such as company websites or Companies House.

4. Who receives data

We share personal data only as described here.

Service providers (processors / service providers) who act on our instructions under data processing agreements:

The providers who process workspace content for our customers (including our AI provider) are listed in our Sub-processors.

Independent controllers: Google or Microsoft (if you connect a mailbox), Stripe (as described in 3.4).

Others where necessary: professional advisers (lawyers, accountants, auditors) bound by confidentiality; authorities and courts where the law requires it; and a buyer or successor if our business or part of it is sold, subject to this policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising.

5. International transfers

We are based in the United Kingdom; our app is hosted in the EU (Germany). Personal data flows between the UK and the EU freely: the UK recognises the EU as adequate, and the European Commission recognises the UK as adequate.

Where a provider processes data in a country without such recognition) in particular the USA, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, otherwise on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum, together with a transfer risk assessment. For data subject to the EU GDPR we rely on the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Recipients that process data in the USA include Cloudflare, Google, Stripe and (for workspace content) our AI provider OpenAI (see Sub-processors). You can ask us for a copy of the relevant safeguards.

6. Do you have to provide data?

You do not have to give us personal data to visit our website. To create an account or subscribe we need the data marked as required in the forms; without it we cannot provide the service. There is no legal obligation to provide data to us.

7. How long we keep data

8. Your rights (UK and EU)

You have the right to:

• access the personal data we hold about you;
• rectification of inaccurate data;
• erasure and restriction of processing;
• data portability;
• withdraw consent at any time, without affecting processing before the withdrawal;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We make no such decisions.

Right to object. Where we process your data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will then stop unless we have compelling legitimate grounds or need the data for legal claims. You can object to direct marketing at any time, without giving reasons, and we will stop.

To exercise a right, use the process on Privacy Requests. We answer within one month (extendable by two months for complex requests, in which case we tell you why). We may ask you to confirm your identity.

9. Complaints

If you are unhappy with how we handle your data, please tell us first at support@workelligence.com. We will acknowledge your complaint within 30 days, investigate it and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ico.org.uk/make-a-complaint) or, if you are in the EU, to the data protection authority where you live or work.

10. United States residents

This section applies to residents of the United States and supplements the rest of this policy. It reflects the California Online Privacy Protection Act and US state consumer privacy laws to the extent they apply to us.

Categories of personal information we collect (see section 3 for details and sources): identifiers (name, email address, account ID); commercial information (plan, subscription and billing history); professional information (company, role); internet activity limited to technical connection data and security records; and the content of messages you send us. We do not collect sensitive personal information for the purpose of inferring characteristics about you.

Sources: you; your organisation (when it invites you); our service providers; public business sources.

Purposes: providing and securing the service, billing, support, communications and marketing as described in section 3. We do not use or disclose personal information for other purposes.

Disclosures: to the service providers listed in section 4 for business purposes only. We do not sell personal information and do not share it for cross-context behavioural advertising, and have not done so in the past 12 months. We do not knowingly collect personal information of people under 16.

Your rights. Depending on your state of residence, you may have the right to know and access the personal information we hold about you, to correct it, to delete it, to receive a portable copy, and to opt out of sale, sharing, targeted advertising and profiling (which we do not do). We will not discriminate against you for exercising these rights. You or an authorised agent can make a request via Privacy Requests; we will verify your identity by matching the email address on your account and may ask an agent for proof of authorisation. If we decline a request, you may appeal by replying to our decision; we will respond within the time the law requires.

Third-party tracking. We do not allow third parties to collect personally identifiable information about your online activities over time and across different websites when you use our website or app.

Do Not Track and Global Privacy Control. Our website and app do not track you across third-party sites, so there is nothing to opt out of; we treat a Global Privacy Control signal as an opt-out of sale or sharing, although we do neither.

Workspace content: when your organisation uses workelligence, we act as its service provider for workspace content (section 2); please direct requests about that data to your organisation.

11. Security

We protect personal data with technical and organisational measures appropriate to the risk. Our Security & Privacy page describes them.

12. Children

We offer workelligence as a business service. It is not directed at people under 18, and we do not knowingly collect their data.

13. Changes to this policy

We update this policy when our processing changes. The version and dates at the top show when it last changed and when it takes effect. If a change materially affects you, we will tell you by email or in the app before it takes effect.