Privacy Policy
Effective date: June 12, 2026 · Version 1.0
1. Who We Are
Workliq Inc. ("Workliq," "we," "us," or "our") operates the Workliq workflow automation platform accessible at workliq.com. We are the data controller for the personal data we collect about visitors and users. Data Protection contact: privacy@workliq.com
2. Information We Collect
2.1 Information you provide
• Account information: name, email address, company name, and role when you sign up • Billing information: payment details processed and stored securely by Stripe — we do not store card numbers • Profile information: preferences, settings, and content you create within the platform • Communications: emails and messages you send us, including support requests
2.2 Information collected automatically
• Usage data: the workflows you create, and a record of each time one runs and what the outcome was • Security log: for sign-ins, integration connections and other security-relevant actions, we record what happened, when, the IP address it came from and the browser user-agent string • Cookies: described in Section 8 below We do not set device identifiers, do not record which page referred you, and do not build a profile of your browsing. Our hosting provider keeps its own standard server access logs, as any web host does.
2.3 Information from third parties
Workliq connects to three services: HubSpot, Slack and Notion. When you connect one, we receive and store an access token for it, encrypted as described in Section 9. From HubSpot we read deal records — name, stage, owner and the date of last recorded activity — to decide whether a workflow should run. We store the deal identifier, name and stage on each workflow run so you can see what happened and so the same event does not fire twice. To Slack and Notion we send only the content your workflow produces, to the channel or database you chose. We do not read your HubSpot contacts, emails, call records or note contents.
3. How We Use Your Information
We use the information we collect to: • Provide, operate, and maintain the Workliq platform • Process transactions and send billing-related communications • Respond to your comments, questions, and support requests • Send product updates, security notices, and administrative messages • Monitor and analyse usage patterns to improve the Service • Detect and prevent fraud, abuse, or security incidents • Comply with legal obligations • Send marketing communications where you have opted in (you can opt out at any time)
4. Legal Basis for Processing (EU/UK Users)
If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases: Contract — Processing necessary to provide the Service you have subscribed to. Legitimate interests — Processing for fraud prevention, security, product improvement, and analytics, balanced against your rights. Consent — Marketing communications, which you can withdraw at any time. Legal obligation — Processing required to comply with applicable law.
5. How We Share Your Information
5.1 Service providers
We share information with trusted third-party vendors who help us operate the Service, including: • Stripe — payment processing and subscription billing • Supabase — database hosting and authentication • Vercel — application hosting • Resend — transactional email delivery • Anthropic — AI processing for workflow steps you configure, described in full in Section 6 This list is complete. We do not use product analytics or error-monitoring services, and no advertising or tracking service receives your data.
5.2 Business transfers
If Workliq is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email and prominent notice on our website before your data is transferred and becomes subject to a different privacy policy.
5.3 Legal requirements
We may disclose your information where required by law, regulation, legal process, or governmental request, or where necessary to protect the rights, property, or safety of Workliq, our users, or others.
5.4 With your consent
We will share your information with third parties when you have given explicit consent for us to do so.
6. AI Processing
Some workflow steps use AI to write text — for example drafting a follow-up email or summarising a deal. An AI step runs only if you add one to a workflow, and only on the deals that workflow matches. Accounts on the Free plan have no AI budget, so no AI step runs and nothing described here is sent. Our AI sub-processor is Anthropic, PBC. What is sent When an AI step runs, exactly the following leaves our infrastructure: • The deal name • The deal's current stage • The deal owner's name • A one-sentence description of what triggered the workflow • The number of days since the deal's last recorded activity — only when staleness is what triggered the workflow • Any additional instruction you typed into that workflow step, passed through as written That list is exhaustive. What is never sent Contact records, email addresses, phone numbers, the contents of notes, emails or calls, deal amounts, and every other field in your CRM. Data about your own customers is not sent to the model. The payload is built as a fixed set of named fields rather than by forwarding a CRM record, so broadening what Workliq reads from HubSpot cannot quietly increase what is sent. Adding a field is a deliberate change to that list. Because the final item above is free text you write, please do not type personal data into a workflow instruction unless you intend it to be sent. What comes back, and where it is kept The generated text is delivered to the Slack channel or Notion database your workflow names. A copy is also stored against the workflow run in our database, so that a delivery which fails partway can be retried without losing what was already generated, and so you can see what was produced. It is retained as described in Section 7. We also record the token counts and the cost of each call. Those records contain no deal data and no generated text. Model training Under Anthropic's commercial terms, inputs and outputs submitted through its API are not used to train its models.
7. Data Retention
We retain your personal data for as long as your account is active. Deleted automatically • Completed background jobs — 30 days after they finish • Rate-limiting counters — after 24 hours Retained for the life of the account • Account details and workflow configuration • Workflow run history: the deal identifier, name and stage for each run, and any text an AI step generated • Records of events received from HubSpot and Stripe • AI usage records — token counts and cost, with no deal data or generated text • The security audit log We want to be plain about this rather than imply more than we do: apart from the two items above, nothing is currently deleted on a schedule. If that changes we will say so here. On request You may ask us to delete your personal data at any time, and we will do so within 30 days. Billing records are the exception: we keep those for 7 years to meet financial reporting obligations. Disconnecting an integration removes the stored access token for it.
8. Cookies
Workliq sets only the cookies it needs in order to work. These are the complete set: sb-access-token and sb-refresh-token — keep you signed in between requests. Both are HTTP-only, so page scripts cannot read them. hubspot_oauth_state, slack_oauth_state and notion_oauth_state — short-lived random values that let us confirm an integration connection you started is the one that came back, which is what prevents someone else's connection being attached to your account. Each is cleared the moment that connection finishes. We use no analytics cookies, no advertising cookies and no third-party trackers, so there is nothing here to opt out of. Blocking these cookies will prevent you from signing in.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data: • Encryption of data in transit (TLS 1.2+) and at rest (AES-256) • Third-party credentials (HubSpot, Slack, Notion) encrypted with AES-256-GCM at the application layer, so they cannot be read from the database alone • Row-level access controls restricting each account to its own data • An audit log of security-relevant events, which the application only ever appends to • Incident response procedures with breach notification within 72 hours of discovery Despite these measures, no transmission over the internet is completely secure. If you believe your account has been compromised, please contact us immediately at privacy@workliq.com.
10. Your Rights
Depending on your location, you may have the following rights regarding your personal data: Access — Request a copy of the personal data we hold about you. Rectification — Request correction of inaccurate or incomplete personal data. Erasure — Request deletion of your personal data, subject to legal retention requirements. Portability — Request your personal data in a structured, machine-readable format. Objection — Object to processing based on legitimate interests. Restriction — Request restriction of processing in certain circumstances. Opt-out of marketing — Unsubscribe from marketing emails at any time via the link in each email. To exercise any of these rights, please contact us at privacy@workliq.com. We will respond within 30 days.
11. International Transfers
Workliq may transfer your personal data to countries with different data protection laws. When we transfer data internationally, we rely on EU Standard Contractual Clauses for transfers from the EEA, UK International Data Transfer Agreements for transfers from the UK, and adequacy decisions where applicable.
12. Children's Privacy
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us at privacy@workliq.com and we will take steps to delete it.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by prominent notice on the Service at least 30 days before the changes take effect. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.
14. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us: Workliq Inc. Email: privacy@workliq.com Website: workliq.com If you are in the EEA or UK and are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.