1. Who we are
WorkBOS is a multi-tenant business operating system provided by Shahzad & Rainer LLC (“we”, “us”), doing business as WorkBOS. For data your organization puts into its workspace (projects, CRM records, HR records, accounting entries, files), your organization is the controller and Shahzad & Rainer LLC processes it on the organization’s instructions. For account and website data, Shahzad & Rainer LLC is the controller. Contact us through workbos.com/contact for any request under this policy, including data-subject requests.
2. Data we collect
- Account data: name, email, password hash, workspace membership and roles.
- Workspace content: the business records your team creates: tasks, deals, employees, invoices, journal entries, documents, messages.
- Usage data: feature interactions, device/browser type, approximate region, log and diagnostic events.
- Billing data: plan, invoices, and payment status. Card details are processed by Stripe and never stored by us.
- Referral data: if you arrive via a partner link, an attribution code (cookie) for up to 60 days.
- Support data: messages you send us and feedback you submit.
- Sign-in security records: see section 3, which describes exactly what these hold, why we keep them and for how long.
3. Sign-in and sign-up security records
Separately from the two lists above, we keep a short security record of every attempt to create an account, sign in, or reset a password, including attempts that fail or are blocked. It exists to stop one person quietly taking several free or discounted workspaces, and to spot an attack early. Nothing about you is decided automatically from it. No account is refused, limited, scored or treated differently by a machine on the basis of these records: they are shown to our staff, and a person decides.
Each record holds:
- The connection address the request came from, and the coarse network block it belongs to (its first three parts, so one household or office counts as one network).
- The country, region, city, postcode and timezone our hosting provider reports for that address, and the browser identification string the request carried.
- The mailbox in three forms: a normalised form with dots and +labels removed, a one-way fingerprint, and a partly-hidden display form such as ab***@example.com. The full address is not stored in this record.
- Whether the connection matched a public list of VPN networks, hosting and datacenter networks, or Tor exit addresses, and whether the mailbox domain is on a public list of throwaway mailbox providers. We keep our own copy of those public lists, so checking one does not tell anybody else that you signed up.
- What was attempted and how it ended: created, signed in, reset, failed, or blocked for too many tries.
What we do not do with it. We do not build a profile of you, we do not use it for advertising or marketing, we do not sell or share it, and we do not use it to decide anything about you automatically. It is never visible to any customer workspace, including your own; only our own staff can see it.
Legal basis and your right to object. We rely on legitimate interests: preventing fraud and abuse of a service we offer free or at a discount, and keeping accounts secure. GDPR Recital 47 names fraud prevention as such an interest. You may object to this processing at any time under Article 21 by contacting us; because the purpose is security, we will explain what we can and cannot stop doing and why.
How long. Twelve months. After that an automatic daily job removes the exact connection address, the city, the postcode, the coordinates and the browser identification string, and only the country, the region, the timezone and the coarse network block remain. Erasing a workspace erases these records for the people in it at the same time.
4. How we use data
- Provide, operate and secure the Service (including tenant isolation and abuse prevention).
- Process payments, send transactional email (receipts, invitations, alerts).
- Power features you invoke, including AI agents, which process your workspace content to draft proposals you approve.
- Improve the product using aggregated, de-identified usage patterns.
- Meet legal obligations and enforce our Terms.
We do not sell personal data. We do not use your workspace content to train third-party AI models.
5. AI processing
When you use AI features, relevant workspace content is sent to the configured AI provider (our default provider, or your own key if you bring one) solely to generate the requested output. Agent actions are logged with who approved what and when. Cost ceilings and rate limits apply.
6. Subprocessors
- Supabase: database, authentication, storage (hosting of workspace data).
- Vercel: application hosting and delivery.
- Stripe: payment processing and billing.
- Resend: transactional email delivery.
- OpenAI, Anthropic and Groq: AI feature processing. Which one handles a given request is decided by our model router; all three are named on the subprocessor page. If you configure your own model endpoint, that provider processes your requests under your own agreement and is not our subprocessor.
- Cloudmersive: antivirus scanning of uploaded files.
We bind subprocessors to data-protection obligations and review this list as the platform evolves.
7. Cookies
We use strictly-necessary cookies (session, workspace routing), a functional preference store, and an optional partner-attribution cookie. Details and choices: see our Cookie Policy at /cookies.
8. Retention & deletion
- Workspace data is retained while the workspace is active.
- Workspace deletion is self-serve: deletion is scheduled with a cancellation window, then permanently removed; archives follow a retention schedule before hard deletion.
- A deleted record goes to Trash for 30 days with everything attached to it, and can be restored by the person who deleted it or by any workspace owner or admin. It is not erased when that window ends: it moves to your workspace bin and then to a platform-recoverable archive. Nothing available inside the product erases a record permanently - Remove and Clear my trash both move an item one tier down - so a permanent erasure is a support action you ask us for. Who deleted what is recorded, for every kind of record, with the person named at the time of the delete.
- Backups roll off on a fixed schedule after deletion.
- Billing records are kept as required by tax and accounting law.
9. Your rights
- Access and export: workspace admins can export workspace data; you can request a copy of your account data.
- Correction: update your profile and records directly in the product.
- Deletion: delete your account or workspace via the self-serve flow, subject to legal retention.
- Objection / restriction: contact us to exercise rights under applicable law (e.g. GDPR, CCPA).
To exercise rights, contact privacy@workbos.com. We acknowledge a request within 5 business days and respond substantively within 30 days of verifying your identity. Where the law you are relying on allows an extension for complex requests (for example a further 60 days under CPRA, or a further two months under GDPR Art. 12(3)), we will tell you inside the first 30 days why we need it. If you are an end user of a workspace operated by someone else (including a reseller’s client), we may direct your request to that workspace’s administrator, who controls that data.
10. Security
Every table is protected by database-enforced row-level security (tenant isolation), with role-based access control on top. Uploads are virus-scanned and fail closed. Secrets are stored encrypted. Payment webhooks are signature-verified. See /security for the full overview.
Passwords found in data breaches. When you choose a password, and when you sign in with one, we check it against the public Have I Been Pwned list of passwords exposed in other websites’ data breaches. The password is never sent: we turn it into a one-way fingerprint and send only the first five characters of that fingerprint, from our own servers, and the list answers with hundreds of possible matches that we compare ourselves, so the list cannot tell which password was checked, or whose. If your password matches, we record only that it matched and since when (never the password) until you change it, and the owners and admins of your workspace can see that your account is affected.
Browser security reports. Our pages tell your browser which scripts and connections they may use, and ask it to report anything it refused. From each report we keep the page’s path (never the full address), what was refused and where it came from, and a count, for 30 days. We do not keep who you are. To tell whether several different visitors are affected, we keep a scrambled fingerprint of the connection address (for IPv6, of its network) for two days. It is made with a secret key that changes every day, it is only ever counted, never looked up, and it cannot be matched from one day to the next.
11. International transfers
Your workspace data (database records, uploaded files and backups) is stored by Supabase in the ap-southeast-1 (Singapore) region. The web application and its serverless functions run on Vercel, whose primary region for us is sin1 (Singapore), in the same region as the database, with static assets served from Vercel’s global CDN. Personal data of individuals in the EEA, the United Kingdom and Switzerland is therefore transferred outside those territories in the ordinary course of providing the Service. The transfer mechanism is the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum for UK transfers, incorporated into our Data Processing Addendum and mirrored in our contracts with the subprocessors listed at /subprocessors. We do not offer regional data residency today: you cannot currently choose a different storage region. Full detail, including the position under each regulation, is at /compliance.
12. Children
The Service is not directed to children under 16 and we do not knowingly collect their data.
13. White-label workspaces
If your workspace is provided by one of our resellers under their brand, the reseller is your primary point of contact and may act as controller for your relationship with them. This policy governs WorkBOS’s processing as the underlying platform.
14. Legal bases (GDPR/UK GDPR)
- Contract: providing the Service you signed up for (account, workspace, billing).
- Legitimate interests: securing the platform, preventing abuse of free and discounted plans (see section 3), improving the product with aggregated data. You may object under Article 21.
- Consent: optional cookies (e.g. partner attribution) and marketing communications; withdrawable any time.
- Legal obligation: tax, accounting and lawful-request compliance.
15. US state privacy rights (CCPA/CPRA and similar)
- We do not sell or share personal information for cross-context behavioral advertising.
- You may request access, correction, deletion and portability of your personal information.
- We do not discriminate against you for exercising privacy rights.
- Authorized agents may submit requests with proof of authorization; we verify identity before acting.
16. Retention schedule (summary)
- Workspace content: life of the workspace + deletion retention window, then purged.
- Account data: life of the account + up to 90 days.
- Billing records: 7 years or as required by tax law.
- Security logs: 12 months.
- Browser security reports: 30 days (the daily-changing visitor fingerprints: 2 days).
- The record that your password matched a data breach: until you change the password.
- Sign-in security records: 12 months for the precise parts (connection address, city, postcode, coordinates, browser string); the country, region, timezone and coarse network block are kept beyond that.
- Backups: rolling window; deleted data ages out on schedule.
17. Changes
We will notify you of material changes in-product or by email before they take effect.
18. Contact
privacy@workbos.com