This Privacy Policy explains how Workify ("Workify," "we," "us," or "our") collects, uses, discloses, and protects personal information in connection with www.joinworkify.com, the Workify web application, trial or demonstration access, and related services (collectively, the "Service").
Workify provides an AI-powered service assistant designed primarily for machinery dealers, service organizations, and technicians. The Service can use manuals, parts catalogs, technical documentation, and information supplied by customers to generate diagnostic, maintenance, and repair-related responses.
This Privacy Policy is intended to describe our actual data practices. Where applicable law gives you rights that differ from or exceed this Policy, applicable law controls.
1. Scope and Our Role
This Privacy Policy applies when you:
- visit joinworkify.com;
- create or use a Workify account;
- use the Workify AI Service Assistant;
- access a trial, demonstration, invitation, or QR-code access link;
- are invited to Workify by an organization;
- contact us for support, sales, or other communications.
Customer Organizations
If you use Workify through your employer, dealer, service company, or another organization (a "Customer Organization"), that organization may control your Workify membership and certain information associated with its workspace.
Customer Organization administrators may, depending on their permissions:
- invite or remove users;
- view or manage organization content;
- manage subscriptions and access;
- access organization chat history or other workspace information where the Service permits it;
- request deletion or export of organization data.
Where Workify processes personal information contained in Customer Content solely on behalf of a Customer Organization, the Customer Organization may act as the relevant controller or "business," and Workify may act as its processor or service provider, as those terms are defined by applicable privacy law. For personal information Workify uses for its own account administration, billing, website operation, security, support, and legal obligations, Workify may act as the controller or business.
If your request concerns information controlled by your Customer Organization, we may direct you to that organization or assist the organization in responding as required by applicable law.
2. Information We Collect
2.1 Account Information
When you create or use an account, we may collect:
- your name;
- email address;
- phone number, if provided or used for authentication;
- authentication credentials or authentication identifiers;
- organization or company affiliation;
- account role and permissions;
- account preferences.
Passwords or authentication credentials may be processed through our authentication provider. We do not intentionally store your password in readable plaintext form.
2.2 Organization Information
We may collect:
- Customer Organization name;
- subscription or plan information;
- administrator information;
- invited team members;
- roles and permissions;
- organization settings;
- usage-limit information.
2.3 Billing and Transaction Information
Payments are processed by third-party payment providers such as Stripe. Our payment processor may collect payment-card or financial information directly. Workify generally receives limited billing information such as:
- billing name and contact information;
- subscription status;
- transaction identifiers;
- invoice information;
- payment status;
- partial payment-method information where provided by the processor.
Workify does not intentionally receive or store your complete payment-card number.
2.4 Customer Content
"Customer Content" includes information submitted to or processed through the Service by you or your Customer Organization, including:
- service manuals;
- parts catalogs;
- technical documentation;
- equipment documentation;
- uploaded files;
- questions and prompts;
- chat messages;
- information supplied to obtain diagnostic or repair guidance.
Customer Content may contain information belonging to the Customer Organization or third parties.
2.5 AI Conversation and Output Data
We may retain:
- prompts or questions submitted to the AI Service Assistant;
- relevant portions of documents retrieved in connection with a question;
- AI-generated responses;
- citations or references generated by the Service;
- conversation history;
- feedback on AI answers;
- technical information used to evaluate retrieval or response quality.
This information allows users to revisit conversations and allows us to maintain, troubleshoot, evaluate, and improve the Service.
2.6 Trial and Invite-Link Information
If you use the Service through a demo, emailed invitation, access token, or QR code, we may collect:
- the email address you provide;
- the applicable invitation or access identifier;
- session information;
- usage associated with the trial.
Trial access may not require creation of a full account.
2.7 Support, Sales, and Communications
If you contact us, we may collect the information contained in your communication, including your contact details, support request, feedback, attachments, and correspondence with us.
2.8 Usage, Device, and Log Information
We may automatically collect technical information such as:
- IP address;
- browser type;
- operating system;
- device type;
- timestamps;
- pages or features accessed;
- session and request information;
- error and diagnostic logs;
- approximate geographic information derived from IP address;
- security and authentication events.
We use this information to operate, secure, troubleshoot, analyze, and improve the Service.
2.9 Cookies and Similar Technologies
We may use cookies, browser storage, tokens, or similar technologies that are reasonably necessary to:
- authenticate users;
- maintain sessions;
- protect the Service;
- remember preferences;
- enable trial access;
- prevent abuse.
Trial or invitation sessions may use a signed session mechanism that can remain valid for up to approximately 30 days, depending on implementation and configuration.
We currently do not use third-party advertising cookies or cross-site behavioral advertising through the Service. Where configured, privacy-focused analytics services may be used to understand general Service usage.
3. Sensitive and Regulated Information
Workify is designed primarily for technical and business information and does not require users to provide highly sensitive personal information such as Social Security numbers, health information, biometric identifiers, financial-account credentials, or similar regulated information.
Unless Workify has expressly agreed otherwise in writing, you should not upload regulated or highly sensitive personal information that is unnecessary for use of the Service. If such information is included in Customer Content, we may process it as necessary to provide the Service and in accordance with the applicable Customer Organization's instructions and contractual arrangements.
4. How We Use Information
We may use information to:
- provide, operate, maintain, and improve the Service;
- create and authenticate accounts;
- administer Customer Organizations;
- provide trial or demonstration access;
- process subscriptions and payments;
- enforce plan limits and entitlements;
- retrieve relevant information from Customer Content;
- generate AI responses;
- maintain conversation history;
- provide customer support;
- diagnose errors and technical problems;
- monitor reliability and performance;
- prevent fraud, abuse, unauthorized access, and security incidents;
- investigate violations of our Terms of Service;
- communicate about accounts, subscriptions, security, support, and Service changes;
- send non-essential communications where permitted by law;
- comply with tax, accounting, legal, regulatory, and contractual obligations;
- establish, exercise, or defend legal claims;
- develop aggregated or de-identified analytics and performance information.
5. AI Processing and Model Training
To answer a question, Workify may retrieve portions of Customer Content that appear relevant to the question and provide the question and those excerpts to Workify's AI infrastructure or third-party AI model providers. AI processing may therefore involve:
- the user's question;
- selected excerpts from uploaded documentation;
- contextual information necessary to answer the question;
- the generated response.
Workify does not use Customer Content to train generalized AI models for the benefit of unrelated customers unless the applicable Customer Organization expressly authorizes such use. We may use aggregated, statistical, technical, or de-identified information to evaluate and improve the Service, provided we take reasonable measures intended to prevent that information from being associated with an identifiable person or Customer Organization. We may also use Customer Content within the applicable Customer Organization's environment to operate, troubleshoot, support, or improve that Customer Organization's use of the Service.
Must verify before publishing: confirm that every AI model/API provider used in production is contractually and technically configured consistently with the preceding statements regarding model training, retention, and secondary use.
6. Legal Bases for Processing
Where laws such as the GDPR or UK GDPR apply, Workify may process personal information based on one or more of the following grounds:
- Contract: processing necessary to provide the Service or perform a contract with you or your Customer Organization;
- Legitimate interests: operating, securing, supporting, analyzing, and improving the Service, preventing abuse, and protecting our legal rights, where those interests are not overridden by your rights;
- Legal obligation: complying with laws, regulations, court orders, tax requirements, and other legal obligations;
- Consent: where applicable law requires consent for a particular activity.
Where processing is based on consent, you may withdraw that consent as permitted by applicable law. Withdrawal does not affect processing that was lawful before withdrawal.
7. How We Disclose Information
We disclose information only as reasonably necessary for the purposes described in this Policy, including to the following categories of recipients.
Service Providers and Subprocessors
Our infrastructure may include:
- Supabase — Authentication, database services, and file storage. Processes: account information, organization information, Customer Content, conversation information.
- Stripe — Payment and subscription processing. Processes: billing details, payment information, subscription and transaction information.
- Resend — Transactional email delivery. Processes: email address, recipient information, and email content.
- Vercel — Application hosting, delivery, and analytics. Processes: technical, request, and usage information.
- Professional advisers — Legal, accounting, insurance, security, or professional services. Processes: information reasonably necessary for those services.
Our AI infrastructure may use third-party cloud or model services, including Google Cloud or other providers depending on the applicable deployment. Providers may change as the Service develops. We may add or replace service providers where reasonably necessary. Business customers may contact us for information about the then-current subprocessor configuration applicable to their Service.
Customer Organization Administrators
Where you use Workify through a Customer Organization, information relating to that organization's workspace may be visible to or controlled by authorized administrators.
Legal Requirements and Protection
We may disclose information when we reasonably believe disclosure is necessary to:
- comply with applicable law or legal process;
- respond to valid requests from courts, regulators, or government authorities;
- investigate fraud, security incidents, or unlawful conduct;
- enforce our agreements;
- protect Workify, our customers, users, or others;
- establish, exercise, or defend legal claims.
Where legally permitted, we may challenge requests that we believe are invalid or overly broad.
Business Transactions
Information may be disclosed or transferred in connection with a merger, financing, acquisition, reorganization, bankruptcy, sale of assets, or similar corporate transaction.
At Your Direction
We may disclose information when you or the applicable Customer Organization directs or authorizes us to do so.
California Notice at Collection
For California residents, the following summarizes the categories of personal information Workify may collect, the purposes for which those categories are used, and the categories of sources from which they may be collected.
Categories of personal information: identifiers and contact information; account and authentication information; commercial and subscription information; internet or other electronic network activity information; approximate geolocation derived from IP address; professional or employment-related information that a user or Customer Organization provides; user-generated content and communications; and inferences or technical information generated from use of the Service.
Sources: directly from you; from your Customer Organization or its administrators; automatically from your device, browser, or use of the Service; from payment and authentication providers; and from service providers that help operate the Service.
Business or commercial purposes: providing and securing the Service; account administration; authentication; billing; customer support; maintaining and improving the Service; AI retrieval and generation; preventing fraud and abuse; analytics and diagnostics; communicating about the Service; complying with legal obligations; and establishing, exercising, or defending legal claims.
Categories of recipients: service providers and subprocessors; Customer Organization administrators where applicable; professional advisers; payment, authentication, hosting, storage, email, analytics, and AI infrastructure providers; government authorities or other parties where disclosure is legally required or permitted; and parties involved in a corporate transaction.
Workify does not currently sell personal information or share personal information for cross-context behavioral advertising.
8. Sale, Advertising, and Cross-Context Tracking
Workify does not currently sell personal information. Workify does not currently share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act. We do not use Customer Content to create advertising profiles about individual users.
If these practices materially change, we will update this Privacy Policy and provide opt-out mechanisms or consent choices where required by applicable law. Where applicable law requires recognition of a legally valid browser-based opt-out preference signal, we will process such signals as required by that law.
9. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including providing the Service, complying with law, resolving disputes, and enforcing agreements. Retention periods vary depending on the type of information and applicable Customer Organization configuration. In general:
- account and Customer Organization information may be retained while the applicable account or subscription remains active;
- Customer Content and chat history may be retained until deleted by an authorized user or administrator, the applicable Customer Organization instructs us to delete it, or the applicable account is terminated;
- billing and transaction records may be retained as necessary for accounting, tax, fraud-prevention, and legal obligations;
- security and technical logs may be retained for a reasonable period for security, troubleshooting, and abuse prevention;
- trial and invite information may be retained as reasonably necessary to administer the trial, prevent abuse, and evaluate the trial program.
Deletion from active systems may not immediately remove information from disaster-recovery or backup systems. Backup copies may remain until overwritten through ordinary backup-retention cycles and will not ordinarily be restored except for legitimate recovery purposes.
We may retain information longer where required by law, subject to litigation hold, necessary to investigate misuse, or necessary to establish or defend legal claims. Where permitted by law, we may retain aggregated or de-identified information that no longer reasonably identifies an individual.
10. Data Security
We use reasonable administrative, organizational, and technical measures designed to protect information against unauthorized access, disclosure, alteration, loss, or destruction. Access to information is intended to be limited to personnel and service providers who require access for legitimate operational purposes.
However, no Internet service, transmission method, software system, or storage system can be guaranteed to be completely secure. We therefore cannot guarantee absolute security. If a security incident involving personal information occurs, we will provide notifications where required by applicable law.
11. Your Privacy Rights
Depending on where you live and the applicable law, you may have rights to:
- request access to personal information about you;
- obtain a copy of certain information;
- correct inaccurate information;
- request deletion;
- restrict certain processing;
- object to certain processing;
- obtain portable information;
- withdraw consent where processing relies on consent;
- opt out of certain disclosures or processing where applicable;
- lodge a complaint with an applicable data protection or privacy authority;
- exercise your privacy rights without unlawful discrimination.
You may submit a request by emailing joinworkify@gmail.com. We may need to verify your identity or authority before fulfilling a request. If you submit a request relating to information controlled by your employer or another Customer Organization, we may refer the request to that organization or ask you to submit the request through its administrator. Certain requests may be subject to exceptions permitted by law, including requirements to retain information for legal, security, contractual, fraud-prevention, or dispute-resolution purposes.
California Residents
To the extent the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), applies to Workify's processing of your personal information, California residents may have rights that include:
- the right to know or access personal information and information about its collection, use, disclosure, and retention;
- the right to request correction of inaccurate personal information;
- the right to request deletion, subject to legal exceptions;
- the right to opt out of the sale or sharing of personal information;
- the right to limit certain uses or disclosures of sensitive personal information where applicable;
- the right to receive information about the categories of personal information collected, the purposes for collection or use, and categories of recipients;
- the right to non-discrimination for exercising applicable privacy rights;
- the right to opt out of certain uses of personal information where required by applicable California law, including applicable rights concerning automated decisionmaking technology.
Workify does not currently sell personal information or share personal information for cross-context behavioral advertising. Workify does not use Customer Content to create advertising profiles about individual users.
How to Exercise California Privacy Rights
You may submit a California privacy request by emailing joinworkify@gmail.com. You may also use any additional request mechanism Workify makes available through the Service or its website.
Workify may need to verify your identity before completing a request. If you use an authorized agent, Workify may require evidence of the agent's authority as permitted by applicable law.
We generally respond to verifiable requests within the time required by applicable California law. Where permitted, we may extend a response period when reasonably necessary and will provide any notice required by law.
If we deny a request where California law provides an appeal right, you may appeal by replying to the decision notice or contacting joinworkify@gmail.com with the subject line "California Privacy Appeal."
Workify will not discriminate against you for exercising privacy rights provided by applicable law.
12. Automated Decisions About Individuals
The Workify AI Service Assistant is intended to provide technical information concerning equipment and documentation. Workify does not intend to use the Service to make solely automated decisions about individuals that produce legal or similarly significant effects, such as employment, credit, housing, insurance, healthcare, or similar eligibility determinations. Customers are prohibited by our Terms of Service from using Workify for such purposes unless Workify has expressly agreed in writing and all applicable legal requirements have been satisfied.
13. International Data Transfers
Workify and its service providers may process information in the United States and other countries that may have data-protection laws different from those where you live. Where applicable law requires safeguards for international transfers of personal information, Workify will use legally recognized mechanisms appropriate to the applicable transfer. These mechanisms may include adequacy decisions, contractual safeguards, or other mechanisms recognized by applicable law.
Workify may process information in the United States and other countries where Workify or its service providers operate. Workify will use transfer safeguards required by applicable law for jurisdictions that impose such requirements.
14. Children's Privacy
The Service is intended for professional and business use and is not directed to children. You must be at least 18 years old, or the age required to enter a binding business agreement in your jurisdiction, to independently create an account.
We do not knowingly solicit personal information from children through the Service. If you believe a child has provided personal information improperly, contact us at joinworkify@gmail.com so we can investigate and take appropriate action.
15. Third-Party Websites and Services
The Service may contain links to third-party websites, documentation, services, or resources that Workify does not control. This Privacy Policy does not govern the independent privacy practices of third parties. You should review their privacy notices where appropriate.
16. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in the Service, our practices, providers, or applicable law. We will update the "Last Updated" date when we revise this Policy. Where required by law, or where a change materially affects how we use personal information, we will provide additional notice before or when the change becomes effective.
17. Contact Us
For privacy questions or requests, contact:
Workify Inc. Email: joinworkify@gmail.com Website: https://joinworkify.com