Privacy Policy

WorkCrews Ltd ("we", "us", "our") operates the WorkCrews platform at workcrews.ai. We are the data controller for personal data collected through the Service.

Contact us about privacy: hello@workcrews.ai

Account data:

• Name and email address (registration)
• Organisation name and details
• Encrypted password (we never store plaintext passwords)
• Two-factor authentication secrets (encrypted)

Usage data:

• Crew runs and their inputs/outputs
• Documents you upload
• Login timestamps and IP addresses (security purposes)
• Session data

Billing data:

• Subscription plan and billing history
• We do NOT store card numbers — Stripe handles all payment data

We do NOT collect:

• Advertising or tracking data
• Data from third-party sources
• Sensitive personal data beyond what you voluntarily provide

We use your data to:

• Provide, maintain, and improve the Service
• Process payments and manage subscriptions
• Send transactional emails (account verification, invoices, alerts)
• Detect and prevent fraud and security incidents
• Comply with legal obligations
• Respond to your support requests

Legal basis (UK GDPR): We process your data under contract performance (to provide the Service you signed up for), legitimate interests (security, fraud prevention), and legal obligation.

We share data only with:

• Stripe — payment processing. Stripe is PCI-DSS Level 1 certified. See Stripe's privacy policy
• Anthropic — AI processing. Your crew inputs are processed by Anthropic's Claude API. See Anthropic's privacy policy
• SendGrid — transactional email delivery

We do not sell, rent, or share your personal data with advertisers or data brokers. Ever.

We retain your data for as long as your account is active. When you:

• Delete your account — personal data deleted within 30 days
• Request deletion — we process requests within 30 days
• Cancel subscription — billing history retained for 7 years (legal requirement)

Crew run outputs and uploaded documents are retained for the life of your account and deleted on account deletion.

Under UK GDPR you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — request deletion of your data
• Portability — receive your data in a machine-readable format
• Restriction — limit how we process your data
• Objection — object to processing based on legitimate interests

To exercise any of these rights, email us at hello@workcrews.ai. We will respond within 30 days.

You have the right to lodge a complaint with the ICO (UK Information Commissioner's Office) at ico.org.uk.

We use only essential cookies:

• Session cookie — keeps you signed in. HttpOnly, Secure, SameSite=Strict. Expires on sign-out.
• Cookie consent — remembers your cookie preference. Stored in localStorage.

We do not use Google Analytics, Facebook Pixel, Hotjar, or any advertising or tracking cookies. Our cookie use falls under the "strictly necessary" exemption under UK PECR.

We protect your data with:

• HTTPS encryption for all data in transit
• Bcrypt password hashing (never stored in plaintext)
• HttpOnly, Secure cookies for session management
• Two-factor authentication (enforced for admin accounts)
• PostgreSQL database with encrypted backups
• Row-level access controls — organisations cannot see each other's data

Your data is processed in the UK and EU. Our AI processing (Anthropic) may involve transfer to the United States. Anthropic maintains appropriate safeguards including Standard Contractual Clauses under UK GDPR.

We will notify you of material changes by email or through the Service at least 14 days before they take effect. Continued use after changes constitutes acceptance.

Data protection enquiries: hello@workcrews.ai

WorkCrews Ltd · workcrews.ai · England and Wales