Privacy Policy

What we keep

• Account: your email address and display name, and either a password (handled by Supabase Auth) or a linked Google identity.
• Sign-in sessions: for each browser or device you are signed in on, its user agent, IP address and sign-in time. Your account page shows them and lets you sign out other sessions.
• Company and workspaces: the company name and, if you add them, its industry, size, contact person and logo; its workspaces; its members and their roles; and the email addresses it has invited.
• What you give the AI employees: your task messages, the files you upload and the knowledge you save for them.
• What the employees produce: their replies and the Word, Excel, PowerPoint and PDF documents they create.
• Web pages the employees read: a saved copy of the public web pages an employee reads for a task, kept with the task's history. Anyone who can see the task can see the pages it read.
• Usage: the tokens used and estimated cost of AI work, and how much file storage a company uses. WorkPier has no billing or payments today, so we collect no payment card details.

Cookies and tracking

We set only the cookies needed to keep you signed in. They are httpOnly cookies on our API host, renewed while you keep using WorkPier and ending after 30 days without a visit. If you choose Google sign-in, one more cookie protects that sign-in for 10 minutes.

We use no analytics, advertising or tracking scripts. If you choose to connect Google Drive, authorization opens Google and Nango pages, and the file Picker loads Google's scripts and contacts Google services. These services may be inaccessible in mainland China. Your browser's local storage keeps your language, your chosen workspace and unsent task drafts on your device.

How we use it

We use your data to run WorkPier: to sign you in, show your company's work, let AI employees do the tasks you give them, send account emails (sign-up, password reset, invitations and security codes), keep the service secure and limit abuse, such as repeated requests from one IP address, and answer support requests. Account emails also include a notice when WorkPier staff lock your account, and AI credit notices: to a company's owners when its credits run low or run out, and to its owners and administrators when we grant or decline a request for more. A credit notice gives the company's name and balance, or our reply to the request.

We do not sell personal data. We show no advertising. WorkPier does not use customer content to train AI models.

Service providers and where they run

• Supabase: database, sign-in and file storage, in Singapore.
• Alibaba Cloud: the servers that run the application, in Singapore.
• Cloudflare: delivers the website and carries traffic between your browser and our servers.
• Microsoft Azure OpenAI: runs the AI model, so your task messages and files are sent to it. Our Azure resource is in the Southeast Asia region (Singapore), but its deployment type is Global Standard, so Microsoft may process requests in any region where it runs the model, not only in Singapore. Azure's default content filter checks each request and reply and can block one. Microsoft states that it does not use Azure OpenAI prompts and outputs to train its models. When an employee has a code tool, the task's files sit in a temporary Azure workspace where that tool can open them; the workspace is deleted when the run ends or expires 20 minutes after its last use.
• Bing web search, through Azure: when an employee researches a public question, it can search the web. The employee writes its search queries from your task, so a query can contain words from it. Search queries leave Azure's region and are handled under Bing's own terms and the Microsoft Privacy Statement.
• Public websites: an employee that can read web pages may open a public page that your task names or a search found. The request goes from WorkPier's servers straight to that website, names WorkPier's page reader and carries none of your cookies or sign-ins. The website sees the page address, which can contain words from your task, and our server's IP address. The page's content goes to Microsoft Azure OpenAI with the rest of the task.
• Resend: sends our emails, from its Tokyo region, so it receives each recipient's email address and the message.
• Google: if you choose Google sign-in, we receive your email address and Google account ID. Connecting Google Drive is a separate choice, described below.
• Nango Cloud: handles Google Drive authorization and credential refresh, and proxies authorized Drive requests. It receives connection identifiers for your WorkPier user and company. Its data handling is described below.

Some of these providers may process data outside Singapore.

Google Drive data

Google Drive is optional. WorkPier requests the drive.file permission and only accesses files you explicitly pick for WorkPier. We do not scan your Drive. Connecting an account does not select any files or authorize a scheduled duty. We keep the connected account identity and the selected file's identifier, name, type and access information, linked to your WorkPier user and company.

When you choose a file for an ordinary task, we read it for that task. When you save a file to a scheduled duty, you authorize reading it for future runs of that scheduled duty while your permission and the connection remain valid. That choice does not authorize use in other tasks, and selecting a file for an ordinary task does not create a recurring duty. File content used for AI work goes to Microsoft Azure OpenAI as described above.

We retain the file version actually used as task history, subject to the same company and workspace access and permanent-deletion rules described below. Disconnecting does not erase task history. Selecting or binding a file is not permission to keep a permanent copy outside those rules.

We comply with the Google API Services User Data Policy, including its Limited Use requirements, when using or sharing data received through Google APIs. We use this data to provide the features you choose, not for advertising, sale or training generalized AI models. Our operations console does not expose your original Drive file content or connection credentials.

How Nango Cloud handles Drive connections

Nango Cloud holds and refreshes encrypted Google credentials. Selected-file requests and responses pass through its proxy to WorkPier. Nango operates from the United States and lists AWS hosting there; its public documentation does not identify a specific storage region for our account. We do not promise that connector data stays in Singapore.

According to Nango's published policy, proxy bodies are not stored in logs; request metadata is logged with sensitive headers redacted. Operational logs remain for 15 days and audit records for one year by default. A successful connection deletion first makes it inaccessible, then permanently removes credentials, configuration and metadata 31 days later. Logs and audit records expire separately. These are Nango's published retention periods, not a promise of immediate erasure by WorkPier.

Disconnecting Google Drive

Disconnecting stops future WorkPier use of that connection and does not sign you out of WorkPier. A completed deletion at Nango is not proof that Google authorization has been revoked. If cleanup fails or its result is unknown, it remains pending rather than being reported as complete. You can also manage WorkPier's access in your Google Account settings.

In our UAT test environment, the current policy deletes the retained Nango connection without revoking at Google: Google consent remains. This avoids revoking other grants through an unverified revocation flow.

For production, the policy is to use an isolated Drive project and revoke Google authorization before deleting the Nango credential. If revocation would affect another valid connection, we must explain the impact and obtain confirmation first. Production Drive connections remain unavailable until this revocation flow is implemented and verified. Local disconnection alone must never be presented as complete Google revocation.

Who can see your data

Inside your company, what each person sees depends on their role and workspace access. Other companies cannot see your company's data. Browsers never talk to our database directly: every request goes through our server, which checks who you are first.

WorkPier staff use an internal console to support customers, for example to suspend an account. Their actions are recorded in an audit log that we keep for three years. We may disclose personal data if the law requires it.

Keeping and deleting data

We keep your data until you delete it or ask us to. In WorkPier you can:

• Permanently delete an archived task or project. Its conversation, uploaded files, documents and saved web pages are removed from our database, and a background job removes the stored files. What stays: knowledge you saved (it holds its own copies of files), the history of scheduled runs, usage and cost figures, and a record of the deletion that holds only ids and counts, never content.
• Stop a knowledge item; its earlier versions are kept.
• Leave a company, or remove a member. The company keeps a record that the person was a member.

Counters we use to limit abuse are deleted shortly after their time window ends. For anything else, including deleting your account's data, email support@workpier.ai.

Your choices

You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, or withdraw your consent to our using it (we may then be unable to provide the service). Email support@workpier.ai.

Children

WorkPier is for businesses and is not meant for anyone under 18. If you think a child has given us personal data, please contact us.

Changes and contact

We update this page and its date when our practices change. For privacy questions and data requests, email support@workpier.ai. The Terms of Service also apply to your use of WorkPier.