Accountability and Scope
Workzo ("we", "our", or "us"), located at 137 Glasgow St, Kitchener, Ontario N2M 5E3, Canada, is accountable for personal information under its control. Our Privacy Officer oversees this policy and Workzo's privacy management program. This policy describes how we collect, use, disclose, retain, and protect personal information through workzo.ca, the Workzo platform, and our communications. The Personal Information Protection and Electronic Documents Act (PIPEDA) applies where Workzo handles personal information in commercial activities, together with any other applicable privacy law.
Interpretation and Definitions
In this Privacy Policy:
- Account means a unique account created to access all or part of the Service.
- Personal information means information about an identified or identifiable person; we use this term interchangeably with personal data unless applicable law requires a different meaning.
- Service means the Workzo website and platform, including the features available at workzo.ca.
- Service provider means a company or person that processes personal information on our behalf to help operate the Service.
- Usage data means information collected automatically from use of the Service or its infrastructure.
- You means the person using the Service, or the organization on whose behalf that person is using it.
Data We Collect
We may collect the following information when you use Workzo:
- Account and profile information, including your email address, name, avatar, biography, account identifiers, and authentication credentials processed by Supabase; Workzo does not store your raw password
- Commercial information, including your selected plan. If paid products or subscriptions are introduced, we may also collect transaction and billing information described in an updated version of this policy and at the point of collection
- Communications and preferences, including support requests, newsletter or waitlist sign-ups, and your email and cookie preferences
- Technical and usage information, including IP address, browser and device information, pages visited, referring pages, features used, timestamps, cookie identifiers, and diagnostic or security logs
- Content you and your team upload, create, connect, or share in a Workzo workspace, including documents, data-room content, pipeline data, and information imported through integrations
How We Collect Information
We collect information directly from you when you create an account, acknowledge our legal terms, complete a profile, contact us, subscribe to our newsletter or waitlist, or submit content. We collect certain technical, security, and service-event data automatically when you use the Service. We may also receive information from services you choose to connect to Workzo. A connected provider sends only the profile or workspace information covered by the permissions you approve.
Purposes and Consent
We identify the purposes for collection at or before the time personal information is collected. At signup, you can review and acknowledge this policy and accept the Terms of Service. We use implied consent only for purposes a reasonable person would expect are necessary to provide or secure the Service. Optional analytics and marketing require separate choices and are not conditions of receiving the Service. We use personal information to:
- Provide and operate the features you request, manage your account, and maintain a record of your legal acceptance
- Create and secure accounts, authenticate users, prevent abuse, and troubleshoot the Service
- Organize and route your team's documentation to the right people
- Administer plans and, if paid products are introduced, process payments and maintain required transaction records
- Send account verification messages, service updates, security alerts, support replies, and other transactional emails
- Send newsletters or marketing emails when you opt in; you can unsubscribe using the link in an email, although we may still send necessary service messages
- Measure usage, reliability, and performance and improve Workzo, using optional browser analytics only when you enable them and limited server-side service events as described below
- Comply with legal obligations, enforce our agreements, and protect the rights, safety, and property of Workzo, our users, and others
Analytics and Service Events
When you enable analytics in cookie settings, the website sends first-party events such as starting signup, creating a project, or starting an upload. If you turn analytics off, those optional browser events stop. Separately, when a signed-in request succeeds, Workzo records limited account-linked service events such as login, signup, project creation, document upload, dataroom creation, grounded question, and answer rating. These server-side records do not depend on a cookie preference and are used to operate, secure, measure, and improve the Service; their metadata is limited to operational identifiers and counts, not document bodies or question-and-answer text. We do not use third-party advertising trackers or sell these events for advertising.
AI-Assisted Features
When you ask Workzo to ingest documents or answer a grounded question, the relevant document text, retrieved excerpts, and your question may be sent through OpenRouter to the model provider selected for that request. This processing occurs only to provide the feature you requested. Workzo configures OpenRouter requests to deny provider data collection where that routing control is available, does not use workspace content to train a general-purpose AI model, and does not make solely automated decisions that have legal or similarly significant effects. Do not submit personal information that is unnecessary for your intended use.
How We Disclose Information
We disclose only what is reasonably necessary for an identified purpose. Current recipients and service providers include:
- Supabase for managed authentication, database, and file storage services
- DigitalOcean for application hosting and Cloudflare for network delivery and security
- Loops for transactional email and marketing messages you request, and Grafana Cloud for restricted operational logs, metrics, and traces
- OpenRouter and the selected underlying model provider for AI-assisted features you invoke
- GitHub when you choose to connect a GitHub account or installation, subject to the permissions you approve
- Other people you authorize when you collaborate, share content, create a public link, or connect an integration
- Professional advisers, authorities, or other parties when reasonably necessary to comply with law, enforce our agreements, or protect rights and safety
- A buyer, successor, or participant in a merger, financing, reorganization, or sale of all or part of our business, subject to appropriate safeguards
Service Providers and Cross-Border Processing
Workzo's application is hosted in Canada, but some service providers may process or store information in the United States or other countries where they or their subprocessors operate. Information in another country may be accessible to courts, law enforcement, or national-security authorities under that country's laws. Workzo remains accountable for personal information transferred to a processor and uses contracts, access limits, security review, and other measures intended to provide a comparable level of protection. Contact our Privacy Officer for information about current processing locations or providers.
No Sale or Sharing for Cross-Context Behavioral Advertising
We do not sell personal information for money, and we do not share personal information for cross-context behavioral advertising as those terms are defined under California law. We also do not use or disclose sensitive personal information to infer characteristics about you, and we do not have actual knowledge that we sell or share the personal information of anyone under 16.
Retention and Deletion
We keep personal information only as long as necessary for its identified purpose, then securely delete or de-identify it unless law requires a longer period. Current periods include:
- Account, profile, and workspace information while your account is active and while reasonably needed to complete a verified closure or deletion request, subject to legal holds and time-limited backups
- Account-linked and optional product analytics events for up to 13 months
- Routine authentication and security audit logs for up to 12 months
- A record of legal acceptance while an account is active and for up to two years after closure, where needed to establish the agreement and consent history
- Cookie and product preferences for up to one year, unless you delete them sooner
- Privacy-breach records for at least 24 months where PIPEDA requires them
Safeguards and Privacy Breaches
We use administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including access controls, encrypted transport, restricted server-side credentials, secure session cookies, database row-level protections, logging, and vendor review. Access is limited to people and providers who need it for an authorized purpose. No system is completely secure. We assess suspected breaches, preserve a record of every breach involving personal information under our control, and report to the Office of the Privacy Commissioner of Canada and notify affected individuals when a breach creates a real risk of significant harm, as required by PIPEDA.
Your Privacy Choices and Rights
Subject to applicable law, you may ask whether we hold personal information about you and request access to it, an account of its use and disclosure, correction of inaccurate or incomplete information, or deletion. You may withdraw consent to optional processing at any time, subject to legal or contractual restrictions and reasonable notice. Withdrawing consent needed to provide an essential feature may mean that feature or the account can no longer be provided. You may change cookie choices through cookie settings and unsubscribe from marketing emails through the message link. We will not retaliate or discriminate against you for exercising a privacy right.
Access, Correction, and Complaints
Send a written request or complaint to the Privacy Officer using the contact details below and describe the information or concern involved. We may ask for information reasonably necessary to verify your identity and will use it only for that purpose. For a written access or correction request under PIPEDA, we respond within 30 days unless a permitted extension applies and we notify you of it. If access is refused or limited, we will explain the lawful reason and available recourse. We investigate complaints, document the outcome, and correct practices where appropriate. If you remain unsatisfied, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Legal Bases for European Users
Where the GDPR or UK GDPR applies, we process personal information as necessary to perform our contract with you, comply with legal obligations, pursue legitimate interests such as operating, securing, and improving the Service, and with consent where required. You may withdraw consent at any time without affecting earlier processing. Information may be processed outside your country; where required, we use an approved transfer mechanism and appropriate safeguards. We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects on you.
California Online Privacy Disclosures
California residents may use the rights described above under the CCPA as amended by the CPRA. Our disclosures in the Data We Collect, Purposes and Consent, and How We Disclose Information sections describe the categories collected, business purposes, and recipients for the preceding 12 months. We do not respond to browser Do Not Track signals because there is no consistent industry standard, but we honor applicable consent controls and legally recognized opt-out preference signals where required.
Children's Privacy
Workzo is not directed to children under 13, and our Terms require users to be at least 18 years old. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, contact us so we can investigate and delete it as appropriate.
Third-Party Links and Services
The Service may link to or allow you to connect third-party services. Their collection and handling of information is governed by their own privacy notices and terms, not this Privacy Policy. We encourage you to review those notices before using a third-party service.
Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised policy with a new last-updated date and provide prominent or direct notice when a change is material. If a new purpose is not reasonably connected to the purpose for which information was originally collected, we will identify it and obtain new consent where required before using the information for that purpose.
Contact the Privacy Officer
You may also contact us through the support page on our website or by mail at 137 Glasgow St, Kitchener, Ontario N2M 5E3, Canada.
To ask a question, exercise a privacy right, or make a complaint, contact Workzo's Privacy Officer at [email protected].