Privacy Notice

WorkSpring is the data controller for personal data about WorkSpring account holders and website visitors. Where you use WorkSpring to store information about your own customers, you are the controller of that information and we act as your processor.

• Account data — name, email address, password hash, business name, phone number and business contact details.
• Business content you create — customers, jobs, schedules, estimates, invoices, notes, uploaded logos and generated documents.
• Billing data — subscription plan, status, renewal dates and transaction identifiers. Card numbers are handled by Paddle and never reach our systems.
• Copilot interactions — the prompts you type or speak, and the resulting conversation history.
• Technical and usage data — IP address, browser and device information, application version, error reports and feature usage.
• Communications — support messages and email delivery records.

• To provide the Service, including generating documents and sending them for you.
• To authenticate you and keep accounts secure.
• To process subscriptions, renewals, retries and refunds.
• To provide support and respond to your requests.
• To diagnose faults, monitor reliability and improve the product in aggregate. We do not sell personal data or use it for third-party advertising.

We share personal data with the following service providers so we can operate:

• Paddle.com Market Ltd — Merchant of record — payment processing, invoicing, sales tax and billing support.
• Supabase — Database, authentication and file storage hosting for your workspace data.
• Cloudflare — Application hosting, content delivery and network security.
• Google (Gemini) and OpenAI — AI model providers powering the Copilot, voice transcription and spoken responses. Prompts are processed to return a result and are not used to train their models.
• Resend — Delivery of transactional email such as documents, receipts and payment notices.

Paddle.com is the Merchant of Record for all WorkSpring orders and independently processes billing data as a controller for that purpose. We may also disclose data where required by law or to establish or defend legal claims.

We use cookies and local browser storage that are strictly necessary to keep you signed in and to remember interface preferences such as whether the sidebar is collapsed. The checkout provider sets its own cookies during a purchase. We do not run third-party advertising or cross-site tracking cookies.

We never delete your workspace data automatically. Content is retained for as long as your account exists, including after a trial expires or a subscription is cancelled — the account simply becomes read-only so you can still view and export your records.

If an account stays unpaid for 90 days after becoming read-only, the workspace is archived rather than erased, and renewing restores it in full. Archived data is retained for 24 months (2 years) from the date of archiving, after which it may be permanently deleted. When you ask us to delete your account we remove your workspace data within 30 days, other than records we must keep for legal, tax or fraud-prevention reasons. Error and delivery logs are retained for up to 12 months.

Access to your workspace requires authentication, and database access rules restrict every record to the account that owns it. Data is encrypted in transit, and stored documents are served through short-lived signed links rather than public URLs. No system is perfectly secure; please report suspected vulnerabilities to security@workingspring.com so we can investigate.

Depending on where you live you may have the right to access, correct, delete, port or restrict the use of your personal data, and to object to certain processing. You can export your customer data at any time from the Customers page. To make any other request, email privacy@workingspring.com. We respond within 30 days and will not charge you or treat you differently for asking.

Our providers may process data in countries other than yours, including the United States. Where required, transfers are covered by standard contractual clauses or an equivalent safeguard.

WorkSpring is a business tool and is not directed at anyone under 16.

We will post any update to this notice here and change the date above. Questions or complaints: privacy@workingspring.com.