Privacy Policy

The short version

• Your business data is yours. We don't sell it for money, and we don't use it to advertise to you.
• To run the app, your data is stored and handled by outside companies, and by the integrations you switch on yourself — described below. It does not all live only on Workeey.
• You can export your data, or delete your account and the data in it, from your account settings in the app — what the export file contains, and how to ask us for anything it leaves out, is set out under “Your rights” below. It is removed from the live app right away, and we cannot undo it for you, subject to the narrow exceptions set out under “How long we keep it” — routine backups roll over within about 30 days, and there are cases where the law, or a legal claim, requires us to keep something. One thing deleting your account does not do by itself is withdraw the permission you gave Google — disconnect Google Calendar first if you want that too.
• We do not use your data to train any AI model — not one of our own, and we do not hand it to anyone else to train theirs — and we choose providers whose published terms say the same. The detail, including what does get sent and what we cannot control, is under “Artificial intelligence” below.
• If you connect your bank: the permission Plaid issues us is read-only — it does not let us move money — and your banking password does not reach us, because you give it to Plaid, not to us. We did not ask for the permissions that would show us your account number or your routing number, and we do not store those. We do not currently keep a record of your balance. What we do receive, what we keep and for how long, is under “Your bank connection” below.
• If you connect Google Calendar: what Workeey reads from Google, what it stores, how long it keeps it and how to delete it is set out under “Google user data” below.

Who we are

Workeey is a sole proprietorship: the Workeey app and the website at workeey.com are run by Yossi Grunwald, trading as Workeey, in New York, USA ("Workeey", "we", "us"). We are the data controller for your own account information — the details you give us to sign in and be billed. For the business data you enter about other people, such as your clients, the roles are different, and we explain that below. You can reach us at privacy@workeey.com.

What we collect

Account information

Your email address, and your name if you give one. If you sign in with Google, we receive your email address and name from Google — never your Google password. If you sign in with Apple, Apple gives us an identifier for your Apple ID, the email you chose to share (this may be an Apple private relay address that forwards to you) and, the first time only, the name you chose to share; we keep a token from Apple so that, when you delete your account, we can tell Apple to end Workeey's sign-in for your Apple ID. If you continue as a guest, we create a guest account tied to your device, with no email at all.

Your business data

Everything you enter into the app: clients (names, phone numbers, email addresses, postal addresses), jobs, prices, invoices, expenses, notes, your schedule, and the photos and videos you attach. This is the substance of the service — the app cannot show you your clients without storing your clients.

Profile and settings

Your trade and your default rates, the permissions you have granted in the app, and the switches you set — which notifications you want, your quiet hours, how the app looks. Some of these are kept on your device and some on our servers, so that a switch you set can follow you to another phone.

Location

Only when a feature you have switched on needs your device’s own location — for example routing and directions, or the reminder that tells you when to leave for your next job. In both cases your device asks you first and you have to allow it, and you can take that permission back at any time in your device settings or in Workeey’s own settings; the rest of the app keeps working without it. The address features described next work without your device’s own location. We send a job address to a mapping provider to convert it into coordinates, and we store those coordinates on the job so we do not have to look them up again. When you type an address, what you type is sent to an address provider so it can suggest and complete it, and enough about where the request came from is passed on for the suggestions to start near you rather than on the other side of the country. Workeey does not track your location in the background.

Contacts

Only when you ask for it, and only through your device’s own contact picker. When you tap "Import from contacts", your device shows you your own contact list, you choose who to bring in, and only what you chose reaches the app. There is a second place this happens: "Check my phone contacts" lets you pick several people at once, so Workeey can note which of their numbers it already has and stop offering to save the same person twice — it keeps a short list of those numbers on your own device. In both cases the picker belongs to your device, not to us: Workeey does not read your address book, and does not receive the contacts you did not choose.

Camera and microphone

Only while you are taking a photo or dictating. Photos and videos are compressed before they are stored, usually on your own device. Dictation is generally not done on your phone: what you say into a Workeey microphone is sent to a speech-to-text provider and turned into text there, which receives the recording and a short list of names from your account, so it can spell them. The recording itself is not kept, unless you turn on the diagnostic setting, which files your clips in private storage so a bad transcription can be looked into. It is off unless you turn it on in the app, and anything already filed stays until you delete your account, which deletes it. We do keep a count of the seconds you dictated, so we can tell you what the feature costs.

Google Calendar data

Only if you connect Google Calendar. The names and ids of your calendars, and, for the events on them, each event's Google id, title, date, start and end times and link back to Google. We keep a copy on our servers so your schedule can show them. In full, including how long we keep it and how to delete it, under “Google user data” below.

Your bank connection

Only if you switch on bank matching. You connect through Plaid, and from then on Workeey receives, for each transaction on that account, the amount, the date, the description your bank prints on it — which usually carries the other person’s name — the merchant name where the bank supplies one, the category the bank assigns it, whether your bank had settled it, and the bank’s own id for it. We also receive the name of the institution and which connected account it came from. We keep a copy on our own servers, because that is what lets the app tell you weeks later which deposit paid which invoice. Your banking username and password do not reach us — you give them to Plaid, not to us — and we did not ask for the permissions that would let us see your account number or your routing number, so we do not hold those. We do not currently keep a record of your balance. Transactions arrive from the moment you connect a bank until you disconnect it; what is kept, for how long, and the things that outlive the connection are set out under “Your bank connection” and “How long we keep it” below.

Notifications

Only if you allow notifications. Your browser or your phone issues Workeey an address for that one device, and we store it together with a short description of the device — so you can tell your phone from the laptop in your van and switch either one off. We also keep a note of which reminders we have already sent you, so you are not told the same thing twice.

Questions you ask the AI

Only if you use Workeey AI. The questions you ask it, and where in the app you asked them — set out under “Artificial intelligence” below.

AI ratings and reports

Only if you give an answer or a picture the AI made a thumbs up or thumbs down, or report it, anywhere in the app. A copy of what you rated, the question that led to it when you give a thumbs up, where in the app it was, and the reason you picked and any note you add for a thumbs down. We read each one to improve what the AI makes.

How you use the app

How long you spend in Workeey and on each of its screens, how often you open them, and whether something was saved there, counted only while you are actually using it. It does not record what you type or what is on the screen. We use it to find the places where the app is slow, confusing or hard to use.

Advertising ID

In the phone app, your phone's advertising ID, and the fact that Workeey was installed, opened or an account made — used only as described under "Advertising partners" below.

Technical information

Your IP address and browser type reach our hosting and security providers as part of ordinary web traffic, and we keep server logs and diagnostic records so we can fix crashes, investigate abuse and see that features are working — including, where a feature sends a request to an outside model, a short record of what was asked and of how our own system handled it. We also use a service that shows us how Workeey is used — which screens are opened, where taps land, and a replay of the visit, including what was on the screen at the time. We do not currently run advertising trackers, and we do not currently use analytics that follow you across other websites. We count visits to workeey.com pages — which page, the site or ad that sent you, and your country and state worked out from your connection at the time — without cookies and without storing your IP address or anything that identifies you; your browser remembers which site sent you so a later sign-up can be counted toward it. We also keep a short note on your account of whether you signed up in the phone app or on the website and the last day you used each, and, if your phone stops accepting Workeey's notifications, the date we were told so.

Information some laws treat as sensitive

A few of the things above are given a special name by some privacy laws: the coordinates we store against a job address, and the recording of your voice when you dictate. We use them to do the thing you asked for — to draw a route or complete an address, and to turn speech into text — and otherwise only as this policy describes. We do not use them to work out anything else about you, we do not use them to advertise, and we do not disclose them for anyone else’s purposes. We do not use your voice, your photographs or anything else to identify a person by face, voice or other physical characteristic, and we do not create, hold or use a voiceprint, a faceprint, a scan of face or hand geometry, or any other biometric identifier. The coordinates on a job address, and a recording of your voice, are used to produce the map result or the text you asked for; we keep them no longer than this policy says and may delete them sooner, we do not sell them, and we do not disclose them for another company’s purposes.

Your clients’ data — and who is responsible for it

Much of what you put into Workeey is personal information about other people — your clients’ names, addresses and phone numbers. For that information we treat YOU as the person in charge of it (the “controller”) and Workeey as the company that stores and handles it for you (your “processor” or “service provider”). We use it to run Workeey for you and on your instructions, and for the limited internal purposes this policy describes — keeping the service secure and working, finding and fixing the places it is confusing or broken, meeting our legal obligations, and billing you. We do not use it to build products for anyone else, to advertise, or to train artificial-intelligence models of our own.

That puts a few things on you, not us: that you have the right to hold your clients’ information; that you have obtained any consent the law where you operate requires; and that if a client asks to see, correct or delete what you hold about them, you handle that request — which you can, by showing, correcting or clearing that client’s details in the app and by exporting your data from your account settings, with the assistance described in the next paragraph where the app gives you no button for it. Who answers for a claim brought about your clients’ data is set out in our Terms of Service, which form part of this policy.

This section, together with our Terms of Service, is the written agreement governing our handling of your clients’ information on your behalf. We will keep it confidential; apply the safeguards described under “Security”; use it only to provide, secure and support the service and as this policy otherwise describes; engage only recipients of the kinds listed under “Who else sees your data”, and permit them to engage their own providers, in each case under written terms that require them to protect it; provide you with the assistance reasonably available to us with a request or a complaint from one of your clients; tell you without undue delay if we become aware of a breach affecting it; and delete it when you delete your account, subject to the exceptions under “How long we keep it”. On reasonable written notice, and no more than once a year, we will answer in writing reasonable questions about these commitments. In relation to your clients’ information we act as your service provider: we do not retain, use or disclose it outside our direct business relationship with you or for any purpose other than performing the services described in this policy, we do not sell or share it as those terms are used in California law, and we do not combine it with personal information from another source except where that law allows a service provider to do so — for example where you connect an outside account, such as your accounting software or your bank, and ask us to bring what it holds together with your own records; we understand these restrictions and will comply with them.

If one of your clients comes to us directly — about a message they received, or to see, correct or delete what is held about them — we will not act on it on our own account, because it is your data and yours to decide. We will generally direct them to you, or pass their request on to you at the email address on your account; we will do something different where the law requires or permits us to. If you instruct us, and we can identify the records, we will carry the instruction out on your behalf. When your account ends we delete what we hold about your clients as described under “How long we keep it” — if you would rather have a copy returned to you first, tell us before then, and in any case export your data while you still can.

What we do with it

• Run the features you use — show your jobs, build your invoices, store your photos.
• Sign you in, and use access controls designed to keep your data separate from other users'.
• Send you the messages that come with having an account — the ones you ask for, such as a password reset or a welcome message, and the ones we need to send you, such as a security alert, a billing or payment notice, a change to these documents, a change to a feature you use, or anything the law requires us to tell you. If we ever send you marketing as well, you will be able to opt out of it as the law requires, and opting out will not stop the messages in this bullet, which are part of the service itself.
• Fix bugs and keep the service secure and available — including looking into a problem you report, or one we find, and the records that problem touches.
• Make Workeey better: see which features are used and where people get stuck, test changes, and develop new features. This does not change three things we say elsewhere on this page — we do not use your data to train artificial-intelligence models of our own (see “Artificial intelligence”), we do not use data received from Google APIs this way (see “Google user data”), and it does not widen what we do with your clients’ information (see “Your clients’ data”).
• Bill you, if you are on a paid plan.

We do not show you ads, we do not build advertising or marketing profiles about you ourselves, and we do not sell your information to data brokers. We do advertise Workeey itself on other apps and websites, and we tell the companies that run those ads when one led to an install or a new account — that, and nothing more, is described under "Advertising partners" below. To run the features above, your data is shared with the service providers and integrations described below — that is how the app works, and it means your data does not sit only on Workeey’s own systems.

The legal basis (if you are in the UK, EU or EEA)

If you use Workeey from the UK, EU or EEA, we voluntarily apply the following bases to our handling of your information. Doing so is a choice we have made about how to run the service, not an acknowledgement that any particular law applies to us, and it does not give us an establishment in the UK, the EU or the EEA.

• Performing our contract with you — storing and showing your business data is the service you signed up for.
• Your consent — for location, camera, microphone and contacts, each asked for at the moment you first use the feature, and each revocable in your device settings or in Workeey’s own settings. Where you switch on a connection such as Google Calendar, QuickBooks or your bank, we handle what that connection carries in order to perform our contract with you, and you can end it at any time by disconnecting it.
• Our legitimate interests — keeping the service secure, preventing abuse, and fixing faults.
• Legal obligation — keeping records we are required by law to keep, such as tax records for payments.

Who else sees your data

We use a number of outside companies to run Workeey. They process your data on our instructions and, except where an entry below says otherwise, are contractually bound to protect it. Each of them may in turn use its own providers — data centres, infrastructure, and support services. By using Workeey you authorise us to engage companies of the kinds listed below, and any company that replaces one of them or is added to a kind, on that basis; if you object to one, write to privacy@workeey.com and we will tell you what your options are. We group them by what they do rather than naming every one, because the companies in a group change as better ones come along. If you want to know more about the companies in a group, email us at privacy@workeey.com and we will tell you what we reasonably can about the ones that handle data from your account. The ones worth knowing before you switch something on — your bank, your accounting, your payments, your Google account — are named:

Hosting, storage and security

The companies that keep workeey.com running and hold your account, your business data and the photos and videos you upload. As part of ordinary web traffic they also receive the technical information described under "What we collect" above, which is what lets them keep the site up and tell a real visitor from an attack.

How the app is used

Shows us how Workeey is actually used, so we can find the places it is confusing or broken. It records which screens are opened, where taps and clicks land, and a replay of the visit, on the website and in our Android app — and because we do not blur the screen, whatever you had on screen at the time is part of that replay. Each replay is marked with your account ID, so that when you tell us something went wrong we can find the visit and see it. We use it to improve the app; we do not use it to advertise to you.

Advertising partners

We advertise Workeey on other apps and websites. When Workeey is installed or first opened on a phone, and when an account is made in it, we tell the advertising companies that run our ads that it happened, together with your phone's advertising ID and basic information about the device and its connection, such as its model, its operating system and the IP address. That lets us see which of our ads bring people to Workeey, and lets those companies show our ads to people likely to want it; they may combine it with what they already know from their own services. They never receive your business data — your clients, jobs, invoices, notes, or anything you type into Workeey. You can stop it on your phone by deleting or resetting its advertising ID (on Android: Settings, then Privacy, then Ads), or by writing to us as set out under "Your rights".

Email delivery

Delivers the emails Workeey sends you, such as a password reset. The provider receives your email address and the message.

Text message delivery

Delivers the text messages Workeey sends for you — such as invoice payment reminders to your clients. The provider receives the recipient's phone number and the message text.

Notification delivery

Delivers the notifications Workeey sends to your phone or your browser. Your device's own notification service — Google's for an Android phone or for Chrome, and your browser maker's for other browsers — receives the address for that device and each notification, sealed so that only your device can read its words. On an iPhone, notifications travel through Google's Firebase Cloud Messaging and Apple's Push Notification service, sealed the same way, so neither service can read their words.

Addresses, maps and routing

When you type a job address, what you type is sent to an address provider so it can suggest and complete it. A mapping provider is used so Workeey can place a finished address and plan a route to it. Enough about where the request came from is passed on for the suggestions to start near you rather than in another state.

Speech to text

Turns speech into text. When you dictate, what you say is generally sent to a speech-to-text provider and comes back as words; where a Workeey microphone can do this on your device instead, nothing is sent. That provider receives the recording, along with a short list of names from your account so it can spell them. It happens wherever you dictate, and it is set out under "Camera and microphone" above.

Artificial intelligence

Only if you use Workeey AI. The companies that build the models, the companies that host and run them, and the companies that route a request between them receive your request and return the answer, and more than one of them can be involved in a single request. What is sent, and what is not, is set out under "Artificial intelligence" below.

Stripe

Processes subscription payments, and card payments your clients make on an invoice you sent them. Card details are entered in the payment form and go to the payment processor; we do not receive card numbers through it.

Plaid

Only if you switch on bank matching. Connects your bank to Workeey, so money arriving in your account can be matched against your unpaid invoices. The permission Plaid issues Workeey is read-only and does not let Workeey move money, and your banking password is given to Plaid, not to us. Set out in full under "Your bank connection" below.

Intuit (QuickBooks)

Only if you connect QuickBooks. Workeey and your QuickBooks company keep each other current, so your customers, invoices and expenses pass between them in whichever direction you chose. Set out in full under "QuickBooks connection" below.

Google

If you sign in with Google, Google confirms your identity to us. If you connect Google Calendar, we exchange calendar data with Google — set out in full under "Google user data" below. Some address suggestions and maps come from Google, and parts of the site are served from Google, so ordinary technical information about your visit reaches Google as part of that.

Apple

If you sign in with Apple, Apple confirms your identity to us. When you delete your account, we tell Apple to end Workeey's sign-in for your Apple ID.

Integrations you connect yourself. If you turn on an outside integration — for example an accounting tool, a messaging service, or your bank — you are choosing to send your data to that company, and from that point they handle it under their own privacy policy, not this one. Some of them may use what you send for their own purposes, not only to serve you. This policy describes what each connection shares, and you can disconnect it at any time. Google Calendar is the exception to that middle sentence: data Workeey receives from Google APIs is used only as set out under “Google user data” below and, except as described in that section, is never transferred to anyone for any other purpose.

We may also retain, access, preserve and disclose information where we have a good-faith belief it is necessary to comply with the law, a court order or a legal request; to enforce our terms; to detect, prevent or address fraud, abuse, security or technical problems; to establish, exercise or defend a legal claim; or to protect the rights, property or safety of Workeey, our users, or the public. We may share it with our professional advisers, auditors and insurers, who are bound to keep it confidential. Where we are not permitted to tell you about a lawful request, we will not. If we are ever bought or merged, or sell part of the business, your data may transfer as part of that deal, and the acquirer may continue to use it under a privacy policy for the data it acquires; data we received from Google APIs transfers only as described under “Google user data”. We may also disclose information to someone not described here where you ask us to, or where we ask you first and you agree. And we may use and share information in a form that does not identify you — counts, totals and aggregates — to run, secure, measure, describe and improve Workeey. We do not do this with data we receive from Google APIs.

Text messages (SMS)

Workeey can send text messages for you — for example, a payment reminder to a client with an unpaid invoice, if you switch that feature on. These messages are transactional, not marketing: they go only to your own clients, about work between you and them, the message names your business — Workeey supplies the wording and you can change it before it goes out — and the recipient can opt out at any time by replying STOP (or get help by replying HELP). How often they arrive depends on your invoices, and the recipient's carrier may charge standard message and data rates.

Mobile information, phone numbers, and text-messaging opt-in data or consent collected through Workeey’s messaging features will not be shared with, sold to, or rented to third parties or affiliates for marketing or promotional purposes. Phone numbers are handled by the provider that delivers the message on our instructions, by the service providers and integrations described in this policy, and where this policy otherwise permits — for example to comply with the law, or to protect the service and the people using it.

Google user data

This section covers everything Workeey does with data that comes from your Google account — what we access, what we use it for, where we store it, who else sees it, how we protect it, how long we keep it, and how it gets deleted. It applies if you sign in with Google, and if you connect Google Calendar. The calendar connection is optional and off until you switch it on yourself in Settings.

What we access. Workeey asks for these Google permissions and no others:

Signing you in — openid, email, profile

Your Google account's email address, and the basic profile Google returns with it, which is where your name and picture would come from. We never receive your Google password.

The list of your calendars — calendar.calendarlist.readonly

For each calendar in your Google account we ask Google for its id, its name, whether it is showing in your calendar list, its time zone, what access you have to it, and whether it is your main calendar. We need this twice over: to find the “Workeey” calendar we created, and to know which of your calendars to read events from.

Events on your other calendars, read only — calendar.events.readonly

For each event we ask Google only for the event's id, whether it has been cancelled, its title, its start, its end, and its link back to Google Calendar. We do not ask for — and Google does not send us — event descriptions, locations, guest lists, organisers, meeting links, attachments or recurrence rules.

One calendar that Workeey creates — calendar.app.created

Lets Workeey create, change and delete events in a single calendar named “Workeey” that Workeey itself made in your account. It gives Workeey no access at all to your other calendars.

We did not ask for permission to change or delete anything on your own calendars, and we cannot.

How we use it.

• The Google email address you connected is shown in Settings, so you can see which account is on the other end.
• Your calendar list tells us which calendars to read: the ones showing in your Google calendar list, and the “Workeey” calendar Workeey itself created — that one so we can tell whether an event Workeey wrote has since been moved or removed in Google.
• The events we read are shown in your Workeey schedule alongside your jobs, are what the double-booking warnings check against, and — because they are part of that schedule — are among the things Workeey AI can look up when you ask it about your day. If you make Google Calendar your default calendar, they also count towards your “day ahead” and “starting soon” reminders, which your own phone puts together.
• Into the “Workeey” calendar we write your jobs and Workeey events, so they show up on your phone's calendar. Each carries the job’s details — such as the service and client name, your notes and the address — so you can see them there.
• If you move one of those Workeey events to a different time inside Google Calendar, we take that as rescheduling the job and update its time in Workeey. If you rename one, we put the title back — that event belongs to Workeey.
• Google data plays no part in advertising, profiling, scoring or ranking, and none of it is used to build or improve any product feature for anyone but you.

Where we store it, and for how long. Your Google Calendar data does not stay only on your phone — we keep a copy on our own servers, in the United States. It holds:

• A mirror of the events we read. Each row holds the event's Google id, which calendar it came from, its title, its date, its start and end times, whether it is all-day, its link back to Google, and when we last wrote the row. The mirror covers a limited window around today rather than your whole calendar history, and we refresh it, so it does not pile up.
• The connection itself: the Google account email you connected, the id of the “Workeey” calendar, your time zone, and the access and refresh tokens Google issues us. We store the tokens because they are what keeps the connection working without asking you to sign in again. They live for as long as the connection does.
• The ids of the events Workeey created in its own calendar, so we update those rather than making duplicates.
• While instant sync is on, a registration with Google for each calendar we watch, so Google can tell us when something changes.
• One more thing can appear incidentally: if a calendar fails to sync, that calendar's name can appear in the error message we save and show you in Settings.

Who we share it with. Nobody, except as described in this section and in the narrow cases Google’s Limited Use requirements themselves allow: where the law or legal process requires it of us, where it is necessary to investigate abuse or protect the security of the service, and — in a merger, acquisition or sale of part of the business — with your prior explicit consent. Data received from Google is not sold, not used for advertising, and not passed to another company for that company’s own purposes. It sits on our own servers because that is where Workeey's database lives, and our hosting provider handles it on our instructions. The AI feature never reaches into your Google account. It reads your Workeey schedule — and because the appointments we mirror are part of that schedule, an appointment that came from your calendar is something it can look up there, exactly like one you typed in yourself, when you ask it about your day. It crosses the other way too: if you move a Workeey event to a different time inside Google Calendar, that new time is written onto the job in Workeey and is an ordinary Workeey job from then on. We do not use data received from Google Workspace APIs to create, train or improve any machine-learning or artificial-intelligence model beyond your own personalised use of Workeey, and we do not transfer it to anyone else to develop, improve or train theirs. A company that runs the AI for us receives it only to produce your answer; we choose them on published terms that say the same, and where one offers a setting or a contract term that keeps our requests out of training and out of retention, we use it.

How we protect it. It travels over HTTPS and is encrypted at rest by our database provider. Access is restricted at the database level: your Google tokens are held server-side, and your mirrored events can be read only by your own signed-in account.

How it is deleted.

• Disconnect it in Workeey’s settings, and Workeey stops Google's change notifications, deletes every mirrored event, deletes the connection and your tokens, and asks Google to revoke the permission you gave us. Disconnecting is what sets all of that off.
• One thing survives a disconnect on purpose: the list of ids of events Workeey itself created in the “Workeey” calendar, so that if you reconnect we update those instead of duplicating them. Ids only — no titles, no times. Beside each id we keep a fingerprint of what we last wrote, so we can tell whether an event still needs updating; a fingerprint is one-way and cannot be turned back into the details it was made from.
• Deleting your Workeey account deletes all of it — connection, tokens, mirrored events, channels and ids — along with the rest of your account. What deleting the account does not do by itself is withdraw the permission at Google, so disconnect first if you want that too.
• Either way you can withdraw the permission yourself, at any time, at myaccount.google.com/permissions.
• The “Workeey” calendar, and the events in it, stay in your Google account after you disconnect or delete. They are yours — remove them in Google if you want them gone.
• As everywhere else on this page, deleted data can sit in encrypted backups until those backups roll over on our hosting providers’ own cycle, which today is about 30 days.

Workeey's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The policy is at developers.google.com/terms/api-services-user-data-policy. Google Calendar is a Google Workspace API, so this applies as well: the use of information received from Google Workspace APIs will adhere to the Google Workspace API User Data and Developer Policy, including the Limited Use requirements.

Your bank connection

Bank matching is optional and off until you switch it on yourself. If you never connect a bank, nothing in this section happens and there is nothing to switch off. If you do connect one, this section is the whole of it.

How the connection is made. You connect through Plaid, which is the company that holds the relationship with your bank. You type your bank details into Plaid’s own screen, never into Workeey — we do not see or collect your banking username or password. Plaid then hands Workeey a single permission, and that permission is read-only: it lets Workeey read transactions, and it does not let us move money. We did not ask for the permissions that would let us see your account number or your routing number, and we do not store those or your banking password. We do not currently keep a record of your balance.

What Workeey receives. For each transaction on a connected account: the amount, the date, the description your bank prints on it, the merchant name where the bank supplies one, the category the bank or Plaid assigns it, whether your bank had settled it, and the bank’s own id for the transaction. We also receive the name of the institution and which connected account the transaction belongs to. The description is the part worth being plain about: on money coming in it usually carries the name of the person who paid you, and on money going out the name of the business you paid. So your clients’ names, and the places you shop, arrive here inside ordinary transaction text.

What we keep, and where. We keep our own copy, on our own servers, in our database in the United States — not merely a passing look at your bank. That copy is what lets Workeey tell you weeks after the fact which deposit paid which invoice, and notice if the bank later takes that deposit back. We also store the read-only permission Plaid issued us, the name of the institution, and when the connection last refreshed. That permission is held server-side.

What it is used for. Matching money arriving in your account against your own unpaid invoices, so you do not have to mark them paid by hand; letting you file money going out as a business expense, if you choose to; recognising the same client or the same supplier next time, so the match works without asking you again; noticing when a deposit that paid an invoice is later reversed, so the invoice can go back to unpaid and you can be told; and the other ways Workeey uses your own records to show you how your business is doing, as this policy describes. It is not used to advertise to you, it is not sold, and it is not shared with another Workeey user. Beyond the providers that host, store and secure it for us on our instructions, the limited internal access described under “Security” below, and the narrow legal and security disclosures described under “Who else sees your data” above, we use and disclose it only as this policy describes.

Workeey AI does not read your bank feed today. There is one crossing point here too, and we would rather name it than have you find it: if you file a bank transaction as an expense, it becomes an ordinary Workeey expense, and from then on the AI can look it up like any expense you typed in yourself — which means your bank’s wording on it goes with it. That is set out under “Artificial intelligence” below.

Read-only, and worth being plain about, because it is the thing most worth being sure of: the permission Plaid issues us lets Workeey read transaction information. It does not let Workeey move money — not into your account, not out of it, not between your accounts, and not to us. We did not ask for a permission that would, and we do not hold one.

How to stop it. Disconnect the bank in Settings: we delete the connection and the permission that came with it, and no further transactions arrive. Deleting your Workeey account deletes the connection and the transactions we have stored, along with everything else. Separately from both, Plaid keeps its own record of the connection and handles it under Plaid’s End User Privacy Policy, which is published at plaid.com/legal and sets out what Plaid itself does with the information you give it. You can see and remove the connections you have made through Plaid at my.plaid.com.

How long we keep it — and the things that clock does not cover — is set out under “How long we keep it” below. It is the part of this section most worth reading, because it is where something your bank told us can outlive the bank connection.

QuickBooks connection

QuickBooks is optional and off until you connect it yourself. If you connect it, Workeey and that company keep each other current: you choose whether that is one-way — Workeey into QuickBooks — or two-way.

What Workeey can reach. Workeey asks Intuit for one permission, the accounting permission, and holds no others. Within it, Workeey reads and writes your customers, your invoices, your expenses, and the items and accounts they are booked to. When syncing in the QuickBooks-to-Workeey direction we ask Intuit for what is needed to bring your Workeey records up to date, rather than for more of your company file than that.

Workeey can change your books, and this is the part to understand before you connect: the permission is not read-only. When you create, change or delete an invoice or an expense in Workeey and it syncs, Workeey creates, changes or where your QuickBooks copy has not been sent or paid, deletes the matching record in your QuickBooks company. It works on the company you connected and no other, and what it touches there is your customers, your invoices, your expenses, and the items and accounts they are booked to.

What we store. The connection itself: the id of the QuickBooks company you connected, its name, and the access and refresh tokens Intuit issues us, which are what keep the connection working without asking you to sign in again. Those tokens are held server-side. We also store, against your own records, the QuickBooks id of anything already synced, so the next sync updates it instead of creating a duplicate.

What comes back from Intuit lands in your ordinary Workeey records and is used to run the sync you switched on. It is not sold and not used for advertising. Because it becomes part of your ordinary records — your invoices, your clients, your expenses — it can be looked up by Workeey AI when you ask the AI about your business, exactly like anything you entered yourself; that is set out under “Artificial intelligence” below. Disconnecting in Settings ends all access and deletes the tokens. Your records stay in both places, because both copies are yours.

Artificial intelligence

Workeey AI is optional. Nothing goes to an AI company unless a feature that uses one is involved — asking the assistant, dictating, or another AI-powered feature.

When you do use it, what you type or dictate is sent — and if you attach something to a message, a photo or a file, that attachment goes with it — sent to an outside company that runs the model, and the answer comes back the same way. More than one company can be involved in a single request — the one that built the model, the one that hosts and runs it, and, where one is used, the company that routes the request between them — and we treat every company that receives your request as handling your data. We change models and providers as better ones become available. If you want to know more, email us at privacy@workeey.com and we will tell you what we reasonably can.

It is not only your question that goes. To answer questions about your own business, the AI can look up what is in your account — such as your clients and their contact details, your jobs, invoices, expenses, notes and schedule, your photos and videos and the details attached to them, and earlier messages in the same chat — and whatever it looks up may be included in what is sent so the model can use it. Workeey AI does not only look things up. When you ask it to, it can also create, change, organise or delete your own Workeey records and settings — for example a client, a job, an invoice, an expense, a note, an appointment or a reminder — and it does that inside your own account, when you ask it to or when a feature you have switched on calls for it. A record it creates or changes is an ordinary Workeey record from that moment, treated exactly like one you entered yourself, including everywhere this policy describes your records going. That means your clients' personal information can be part of a request. If you ask it something that needs current information from the web, that part of your question is searched online.

What matters is that this follows your records, not where they came from. A client or an invoice that arrived from QuickBooks, or an expense you filed from a bank transaction, is an ordinary Workeey record from the moment it lands — so the AI can look it up like anything you typed in yourself. A calendar you connect works the same way: its appointments are mirrored into your Workeey schedule so your day is in one place, and the AI looks them up there, in your own records — never in your calendar account, and it cannot change them. The bank feed itself still sits outside what it can reach.

It is sent to answer you, and otherwise only as this policy describes. We do not use your business data, your clients' data, or anything received from Google APIs to create, train or improve any machine-learning or artificial-intelligence model — not one of our own, and we do not transfer it to anyone else to develop, improve or train theirs. We choose providers whose published terms say the same, and where a provider offers a setting or a contract term that keeps our requests out of training and out of retention, we use it. A provider may still hold a request for a time for its own abuse monitoring. What an outside company does with data it receives is not something we can control, and we do not warrant it.

We save the questions you ask our AI. Our team may read them to keep Workeey safe and make the AI work better. We never sell them or use them for ads.

One other part of Workeey uses an outside model even if you never open the AI, and we would rather name it here than leave you to discover it: dictation. Whenever you dictate, what you say — along with a short list of names from your account, so it can spell them — is turned into text by a speech-to-text provider, which receives both. If you would rather it did not, type instead of dictating.

Where your data lives

Workeey is offered to businesses in the United States, and our providers store data on servers in the United States and other countries. It is not directed at, or marketed to, individuals or businesses in the United Kingdom, the European Union or the EEA, and we have no establishment, branch or office there. Where this policy describes rights or protections under UK or EU law, we extend them as a matter of choice to anyone who uses Workeey from those regions, and doing so is not an acknowledgement that any particular law applies to us. If you use Workeey from the UK, EU or EEA, your data will therefore be transferred outside your country. Where we transfer personal data out of the UK, EU or EEA we rely on the European Commission's Standard Contractual Clauses — and, for the UK, the Information Commissioner's International Data Transfer Addendum — or because the receiving provider is certified under the EU-US Data Privacy Framework. Email privacy@workeey.com for information about the safeguards that apply to your data.

How long we keep it

• Your business data: for as long as your account exists — unless something has to go because it is over a storage limit, which our Terms of Service explain.
• If you delete your account: removed from the live app straight away, subject to the exceptions in this list and below. Copies can remain in routine encrypted backups until those roll over. We may also keep information where the law requires us to, where we need it to establish, exercise or defend a legal claim, or to prevent fraud or abuse of the service — and where we cannot fully delete something for technical or operational reasons, we isolate it from any further use until we can.
• Backups: deleted data may persist in encrypted backups until those backups roll over — our hosting providers’ own cycle, currently about 30 days.
• Records we must keep by law (for example, payment and tax records): for as long as the law requires or permits, and for as long after that as we need them to establish, exercise or defend a legal claim, or to answer a regulator, an auditor or an insurer.
• Google Calendar events we mirror: only a limited window around today rather than your whole calendar history, refreshed as we sync, and deleted when you disconnect.
• Your Google connection and its tokens: for as long as the connection exists — deleted, and revoked at Google, when you disconnect.
• Voice recordings: not kept, unless you have turned on the diagnostic setting — clips filed that way are kept until you delete your account. The count of seconds you dictated is kept so we can show you what the feature costs.
• Your QuickBooks connection and its tokens: for as long as the connection exists — deleted when you disconnect.
• Diagnostic records of requests sent to an outside model — a short copy of what was asked, and of how our system handled it: for as long as your account exists, and deleted with it. Ordinary server logs are kept only for as long as our hosting and security providers hold them for us.
• The questions you ask Workeey AI: for as long as your account exists, and deleted with it.
• The thumbs up and thumbs down you give an AI answer or picture, and reports you make about one, anywhere in the app — a copy of what you rated, the question that led to it when you give a thumbs up, where in the app it was, and the reason you picked and any note you added for a thumbs down: kept so we can review them and improve what the AI makes, for as long as your account exists, and deleted with it. A thumbs up you take back is deleted.
• Which of the phone app and the website you signed up from, and the last day you used each: for as long as your account exists, and deleted with it.
• Notification addresses: until you turn notifications off for that device, the device stops accepting them, or you delete your account. An address that has stopped working is marked dead and skipped.
• What your bank told us: about 90 days. After that we delete what your bank told us about your transactions — the transactions themselves, and the record of which ones we have already seen. That window is our current practice rather than a fixed term, and it can change. One exception is deliberate: where a deposit marked one of your invoices paid, we keep the minimum needed to show that the invoice was paid — on a date, for an amount — without the wording that named the payer. We keep that much because it is what lets us notice later that your bank has taken the deposit back, and tell you. A deposit that never paid anything is deleted outright.
• Some things that window does not cover. (1) The bank connection itself — the institution name and the read-only permission — is not on a clock; it lasts until you disconnect it or delete your account. (2) If a deposit is reversed, the warning written on that invoice repeats what your bank said and stays there, because the invoice is the record of what happened. (3) The sender names we learn to recognise a client by are kept on that client, and that window does not expire them. (4) Merchant names we learn the same way. (5) An expense you filed from a bank transaction: your bank’s wording becomes that expense’s description, and from then on it is your own bookkeeping — it outlives that window and it outlives disconnecting the bank. Each of these goes when you delete the record it sits on — the connection, the client, the invoice or the expense — and all of them go when you delete your account.

Your rights

The first two you can do yourself, right now, without asking us. The rest are available to you where the law that applies to you gives you the right:

Export your data

Export my data, in your account settings. You get a file with what you have entered — such as your clients, jobs, invoices, schedule, notes, media records, expenses and AI chats, plus your profile and settings. It does not include everything we hold: copies of data that came from a connection you can re-sync, such as the mirror of your Google Calendar events, and our internal usage counts, are left out. If you need something it leaves out, email us — where the law that applies to you gives you a right to it, we will provide it.

Delete everything

Delete account, in your account settings. This erases your account and your data from the live app, and deletes the photos and videos you uploaded. It happens right away, and we cannot recover it for you afterwards. Copies held in our routine backups roll over on our hosting providers’ own cycle, currently about 30 days. A narrow set of things survives it, and they are set out under “How long we keep it” above: information the law requires us to keep, information we need to establish, exercise or defend a legal claim or to prevent fraud or abuse of the service, and anything we cannot fully delete for technical or operational reasons, which we isolate from any further use until we can.

Correct your data

Edit it in the app, or email us.

Object or restrict

Email us and tell us what you object to. We will consider it, tell you what we have done, and stop unless we have a legal reason, or overriding legitimate grounds, to continue.

Complain

If you are in the UK or EU you may complain to your data protection authority. We would rather you told us first so we can put it right.

In some cases your ability to access, correct, delete or otherwise control data will be limited, as required or permitted by the law that applies to you — for example where we cannot satisfy ourselves who is asking, where answering would reveal another person's information, where the information is also somebody else's record, or where a request is repetitive or excessive. Before we act on a request we need to be satisfied you are who you say you are, and we may decline a request we cannot verify, or charge a reasonable fee where the law allows one for a request that is manifestly unfounded or excessive.

Where the law that applies to you allows it, someone else may make a request for you: a person you have authorised in writing, or an agent that law lets act on your behalf. We will ask for proof that you gave them permission, and we may ask you to confirm it with us directly. If we refuse a request, we will tell you why. Where the law that applies to you gives you a right of appeal, you may appeal — reply to that email, or write to privacy@workeey.com with “appeal” in the subject line. An appeal is looked at afresh, and we will write back with our decision and our reasons. If we turn your appeal down and the law where you live gives you the right to take it further, you may complain to your state attorney general or your data protection authority, and we will tell you how when we give you our decision.

California residents: we do not sell your personal information for money. What we send to the companies that run our ads, described under “Advertising partners”, may count as “sharing” for cross-context behavioural advertising, or as a “sale”, as the CCPA/CPRA uses those words. You can opt out of it at any time: delete or reset your phone's advertising ID, or write to privacy@workeey.com with “Do not sell or share” in the subject line, and we will stop sending it for your account. Apart from that, the outside companies that run Workeey for us, described under “Who else sees your data”, receive your information to do the work we ask them to do, on terms that require them to protect it and that restrict what they may do with it. A disclosure of that kind is not, in our view, a sale or a share. An integration you switch on yourself — your accounting, your calendar, your bank — receives your information because you told us to send it, at your own direction, which is not a sale or a share either. You may also ask us what categories of personal information we have collected about you, where we got it, why we collected it and who received it, and we will tell you — email us at privacy@workeey.com. We will not discriminate or retaliate against you for exercising your rights under the CCPA/CPRA.

Security

We make real efforts to protect your data. It is encrypted in transit (HTTPS everywhere) and at rest by our storage providers. Access is restricted at the database level, so that one account’s records are not returned to another account, and passwords are hashed by the service that handles signing in, so that we do not see them. We keep the service under review for security weaknesses and address them as we judge appropriate. Access to stored information is limited to the people who need it to run, support or secure the service, or to comply with the law. It is granted on a need-to-know basis, it carries a duty of confidentiality that outlasts the access itself, and it can be withdrawn at any time.

No method of storing or sending data over the internet is perfectly secure, so we cannot promise absolute security. If a breach occurs, we will notify you and the relevant regulator where and as the law requires.

Children

Workeey is for people running a business, and is not directed at children. You must be 18 or over to use it. We do not knowingly collect personal information from anyone under 18, including anyone under 13, and if we learn that we have, we will delete it.

Cookies, and what Workeey keeps on your device

Workeey uses a small number of cookies and similar storage on your device. Some are necessary — they keep you signed in and remember your settings. One belongs to the service described above that shows us how the app is used, so it can tell one visit from another. On the website we do not run advertising trackers or cookies that follow you to other websites. The phone app's advertising measurement, described under “Advertising partners”, uses your phone's advertising ID rather than a cookie. The companies that host and protect workeey.com may set a cookie of their own — to tell a real browser from a bot, and to keep the site up — and those companies are described above. Your browser settings can block or clear any of them.

Do Not Track. Some browsers can send a “Do Not Track” signal. There is no common industry standard for what a site should do when it receives one, so Workeey does not respond to it. Where a law gives you a right to opt out of particular uses of your information, the way to exercise it is set out under “Your rights”, and we handle such a request as that law requires, whatever your browser sends.

What Workeey does use is ordinary browser storage on your own device. It holds the session that keeps you signed in, so you are not asked for your password on every screen; your own preferences, such as dark mode, which reminders you want, your quiet hours, how wide you like the gallery and your default invoice style; a private store of work you did with no signal, waiting to upload; a short-lived copy of things like your event types so screens open instantly; and, if you have used “Check my phone contacts”, a short list of the phone numbers you have already saved, so the same person is not offered to you twice. None of it leaves your device except where this policy says otherwise. Clearing your browser’s site data, or deleting the app, clears what is held there and signs you out.

Working offline

When you have no signal, Workeey saves your work in a private store inside the app on your own device, and uploads it the moment you are back online. Until it uploads, that data stays on your device and does not reach us. Deleting your account, or deleting the app, clears it. Signing out on its own does not erase work that is still waiting to upload — that work finishes uploading the next time you sign in on that device, which is why we keep it rather than throw it away.

Changes to this policy

If we change anything material — a new category of recipient, a new category of data, a new purpose — we will update the date at the top and, where the change materially affects your rights, tell you before it takes effect — in the app, by email to the address on your account, or on workeey.com. The date at the top is when this policy was last materially revised. Any other change takes effect when we post the revised policy.

Contact

Questions, requests, or complaints: privacy@workeey.com. We aim to reply promptly. Where the law sets a period for a particular kind of request, we follow that period, including any extension the law allows us.

Company details

Yossi Grunwald, trading as Workeey — a sole proprietorship in the State of New York, USA. Workeey runs the Workeey app and the website at workeey.com, and is the business you are contracting with when you use either.

Anything about your data — a question, or a request to see, correct, export or delete it: privacy@workeey.com; everything else, including any notice these documents ask you to send us: support@workeey.com. Both reach us.