Privacy Policy

1. Who we are

Worql, Inc. ("Worql," "we," "us," or "our") operates the website at worql.app and its agreement-assembly and shared commercial-record services. Worql, Inc. is a Delaware corporation. Worql may designate successor marketing and application domains during a verified domain migration.

For any privacy-related matter, contact us at privacy@worql.app. For data-subject requests in India under the Digital Personal Data Protection Act, 2023 ("DPDPA"), contact our Grievance Officer (Section 11 below).

2. Scope of this policy

This policy describes how Worql collects, uses, stores, and shares personal information when you visit the Site, sign up for an account, or use the service to assemble agreements, manage services engagements, connect external sources, and record changes, evidence and human-authorized decisions.

It applies to data we control as a "controller" (registrations, account billing, marketing). For data you process through the service about your own counterparties (clients, vendors, employees and contractors), Worql generally processes data under the relevant customer's instructions. Each participating party controls its own submissions and permissions; the roles depend on the processing activity. See our Data Processing Addendum.

3. What we collect

We collect only what we need to deliver the service and run the company.

a. Account data. When you sign up, your authentication provider (Clerk, Inc.) collects your email address, name where provided, and an identifier used to associate your sessions. We receive the same fields and store them against your Worql user record. If you authenticate with a third-party identity provider (Google, GitHub), Clerk additionally receives the standard OAuth profile claims (sub, email, name).

b. Commercial engagement data. Information added to or imported into an engagement, including project briefs, SoWs, contracts, negotiated changes, deliverables, acceptance criteria, delivery evidence, comments, decisions, billing-review state, supporting notes and counterparty information. This may include personal data about your counterparties (legal names, contact information, jurisdiction of incorporation). You are responsible for ensuring you have a lawful basis to provide that data to us and for executing our DPA before processing personal data about EU, UK, or Indian data subjects.

c. Billing data. When you upgrade to a paid plan, Stripe, Inc. handles the payment flow and stores your card information. We receive only the subscription status, plan tier, current period end, and a Stripe customer identifier. We never see, store, or log your card number.

d. Technical data. Standard request logs (IP address, user-agent, request path, response status, timing). We retain these for up to 90 days for security and abuse prevention. We do not build behavioral profiles from them.

e. Cookies and similar technologies. We use a small number of strictly necessary cookies for authentication and security. We use Vercel Analytics and Vercel Speed Insights, which are cookieless and do not place identifying cookies on your device or track individual users across sessions. See our Cookie Policy for the full list.

f. Contact and marketing data. If you submit the contact form, we store the fields you submit (name, email, company, project type, role, budget band, source) to respond. You can request deletion at any time.

g. Connected repository data. When you connect a GitHub repository to an engagement (by installing the Worql Review GitHub App), Worql reads — through that installation — the repository's source file contents, pull-request diffs and changed-file lists, referenced issues, commit history, and contributor metadata (commit author and committer details, GitHub account logins, and GitHub's commit-signature verification status). We use this only to audit the delivered work against the engagement's Statement of Work and to produce the delivery-provenance and contribution-attribution records described to both parties. We read commit counts and authorship; we do not infer location, working hours, time zone, or lifestyle from commit activity. Contributor identities are pseudonymized (keyed hash of the commit email) before they are stored in our provenance records; the raw commit email is not retained there. The repository contents and diffs are sent to our AI sub-processor (Anthropic) at audit time to produce the review — see the Sub-processors list. You control this access: it begins when you install the App and ends when you uninstall it or remove the repository from the installation.

h. Jira, Confluence and Linear. When an authorized customer connects a supported work tracker, Worql can receive Jira issue identifiers, titles, descriptions and acceptance criteria, status, assignee account identifiers, links, priorities, changes, timestamps, estimates and related metadata. Free-text fields can include names or other personal data that users added in the source. Jira integration operations can also send selected evidence summaries back into Jira. A requested Confluence interpretation may send page text to Anthropic for analysis. API-token Jira and Linear integrations can fetch referenced tickets, including descriptions and assignee information. Disconnecting a source stops future collection through that connection; previously recorded evidence and commercial history are not automatically deleted merely because the integration is disconnected.

i. Slack channel evidence. If an organization connects the Worql Slack application and an engagement links a selected channel after the required party consents, Worql can receive message text, author and reactor Slack identifiers, edits and deletion events, reactions, threading context and metadata about shared files. The integration does not require downloading the contents of every file listed in a message. Up to the 15 most recent messages may be imported when a channel is linked. Relevant message text may be processed by Voyage AI and Anthropic to match delivery evidence against agreed acceptance criteria. Disconnecting or withdrawing a channel consent stops future collection; it does not automatically erase evidence already retained in a commercial record.

j. Inbound engagement email. Where the inbound-email integration is enabled and an engagement creates an address, Resend receives messages and Worql may store sender and recipient addresses, subject, body, headers, delivery authentication results, attachments and the original message. Private object storage (Vercel Blob) may hold attachments, HTML and the original message. Unmatched senders can be retained for review without being treated as accepted evidence. This integration is configuration dependent; listing it here does not mean it is active for every customer.

Worql is not designed for special-category information (such as health or biometric data), and customers should avoid uploading it without an appropriate legal basis and protective controls. Because connected-source text and inbound messages originate outside Worql, we cannot guarantee they never contain such information. We do not knowingly invite children under 16 to use the service.

4. Sub-processors

The following sub-processors process personal data on our behalf to deliver the service. Each is bound to confidentiality and security obligations by contract. The full, version-stamped list with hosting region, purpose, and data category is published on our Sub-processors page.

Our DPA and Sub-processors page require advance notice for new or replacement sub-processors. This October 2026 correction also discloses data paths that were in use before they were fully described on the public list. Publication of this correction is not a representation that advance notice was delivered for those historical additions. Affected customers can contact privacy@worql.app for the processing history, relevant agreements and available remedies. You may object in writing to a proposed change for material privacy or security reasons; if we can't resolve the objection, you may terminate the affected plan and receive a pro-rata refund of any prepaid fees.

5. How we use the data

We process the categories above to provide contracted services and for legitimate operational purposes where applicable law permits them. The legal basis for an activity depends on the data, user, jurisdiction and whether Worql acts for a customer as processor. For customer-controlled engagement data, the customer is responsible for identifying and documenting an applicable basis; this policy does not substitute a blanket lawful basis.

• Providing the service — to authenticate you, render the workspace, assemble SoWs, maintain commercial records, connect authorized sources, support review, export and evidence matching. Our basis for account-level processing includes performance of the service contract; customer data is processed on the customer's lawful instructions.
• Billing and tax compliance — to charge for paid plans, issue invoices, and meet tax-reporting obligations. Basis: performance of the contract and compliance with a legal obligation.
• Service-related communications — to send account, security, billing, and product-update notices. Basis: performance of the contract and legitimate interest in keeping users informed.
• Marketing communications — to send newsletters and product announcements to people who opted in via the contact form. Basis: consent. You can unsubscribe at any time using the link in any marketing email.
• Security, abuse prevention, and rate limiting — to detect, prevent, and respond to abuse, fraud, or attacks against the service. Basis: legitimate interest in protecting the service and our users.
• Aggregate analytics and product improvement — to understand which features are used and where users encounter friction. We use only cookieless, non-identifying analytics (Vercel Analytics and Speed Insights). Basis: legitimate interest.

Worql does not sell customer personal information or intentionally use customer content to train its own general-purpose models. The Anthropic API may process submitted documents, connected-source text and engagement evidence to provide advisory analysis. Anthropic's handling of data is governed by the applicable commercial terms. Voyage AI receives acceptance-criteria and evidence text to produce numerical embeddings used for matching. Its retention, model-training settings and exact processing regions are subject to the provider agreement and have not been independently established by this application's source code; customers should contact privacy@worql.app before submitting regulated or highly sensitive material that depends on particular provider restrictions.

6. Cross-border transfers

The application database is configured for AWS us-east-1 (United States), but connected-source and third-party processing may occur in additional regions under those providers' own terms. If you are located in the European Economic Area, the United Kingdom, Switzerland or India, your information may be transferred to the United States and to other countries involved in operating the selected services.

For transfers from the EEA, UK, or Switzerland we rely on the European Commission's Standard Contractual Clauses (2021/914) supplemented by the UK International Data Transfer Addendum where applicable, and we maintain a transfer impact assessment available on request.

For transfers from India, we comply with the DPDPA's cross-border transfer framework, and where the Indian government issues a list of restricted countries, we will update our practices accordingly.

We do not represent that every provider offers United States-only data residency. Region-specific commitments should be confirmed in writing before connecting a source subject to contractual data-residency restrictions.

7. Retention

Personal data may be retained while an account or engagement is active, and for applicable operational, legal or contractual periods after it ends.

• Account information: generally retained while the account is active, then handled through the user-erasure workflow and applicable exceptions.
• Shared commercial records and connected-source evidence: disconnection does not by itself delete events, accepted deliverables, change history, supporting messages or other evidence already recorded. Records needed to establish contractual decisions or meet legal obligations may survive the deletion of an individual account, with personal data minimized or pseudonymized where appropriate.
• Inbound email: where enabled, messages and their stored attachments may remain with the engagement until an applicable deletion workflow is performed.
• Billing and request logs: kept as needed for tax, accounting, security, abuse prevention and legal duties, subject to applicable law and provider storage policies.

The DPA specifies the contractual return/deletion obligations after termination. Their fulfillment is not equivalent to unlinking a connector or deleting a user in the UI. An erasure request is reviewed against legal retention and evidence obligations, and fulfilled through available product and operator procedures. No automatic thirty-day deletion of every backup, signed instrument or shared event is asserted by this notice. For a processing-specific retention schedule or deletion request, contact privacy@worql.app.

8. Your rights

Depending on where you live, you have some or all of the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your data, subject to retention obligations.
• Restriction or objection — ask us to limit or stop certain processing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — withdraw consent for any processing based on it, without affecting the lawfulness of prior processing.
• Lodge a complaint — with your local data protection authority. EEA users may complain to the supervisory authority of their habitual residence; UK users to the Information Commissioner's Office; Indian users to the Data Protection Board of India (and see Section 11 below).

To exercise any right, email privacy@worql.app from the address associated with your account. We respond within 30 days, or sooner where required by law.

9. Security

We protect personal data with the following controls:

• TLS 1.2+ for all transport between client, application, and database.
• Authentication delegated to Clerk, with MFA available to all users on all plans.
• Database hosted on Neon in AWS us-east-1, encrypted at rest, with point-in-time recovery for paid plans.
• Application infrastructure on Vercel; deployments require code review.
• Anthropic API keys, Stripe secret keys, and database credentials are scoped to least privilege and stored only in our hosting provider's secret manager — never in source control.
• Production access requires SSO with the founder account; activity is logged.
• Connected-repository access is scoped to the GitHub App installation you grant and uses short-lived installation tokens that are minted per request and never persisted. Repository contents are read at audit time and are not stored wholesale; we retain the structured audit findings, the delivery-provenance records (with pseudonymized contributor identities), and short-lived diagnostic logs. Revoking the installation (uninstalling the App) ends our access immediately and the engagement is marked disconnected.

No system is perfectly secure. If you discover a vulnerability, please report it to security@worql.app; we acknowledge receipts within two business days.

10. California residents (CCPA / CPRA)

If you are a California resident, you have the rights described above plus the right to know the specific pieces of personal information we hold, the right to opt out of "sharing" or "selling," and the right to limit the use of sensitive personal information. We do not "sell" personal information as defined by the CCPA and we do not engage in cross-context behavioral advertising. To exercise California rights, email privacy@worql.app with "California rights request" in the subject line.

11. Indian users (DPDPA 2023)

If you are an Indian Data Principal, send DPDPA grievances and data-principal requests to our Grievance Officer at grievance@worql.app. This is the primary contact for DPDPA matters, and we respond within the period required by the DPDPA.

• Grievance email (primary): grievance@worql.app
• Grievance Officer: Aayush Chopra, Worql, Inc.

You may also contact the Data Protection Board of India at the address published on its official website.

12. Changes

We will update this policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be notified by email to active account holders at least 14 days before they take effect.

13. Contact

Questions or requests: privacy@worql.app. Legal notices: legal@worql.app. Security reports: security@worql.app. Abuse reports: abuse@worql.app. General support: support@worql.app.