Privacy Policy

01Two kinds of data

Workspace data is everything your organisation puts into the Service: forms, requests, attachments, comments, approval decisions, audit records and data received from connected apps. Your organisation controls this data and we process it on its behalf.

Account and website data is the information we need to run accounts and this website, such as names, work email addresses, billing details, and basic technical data like browser type and pages visited.

02What we collect

• Details you give when you sign up or contact us: name, work email, company, team, role and number of users
• Workspace data entered by your users or received from connected apps
• Approval activity, including the channel used, such as the app, an email button or a WhatsApp link
• Device and log data needed for security, such as IP address, sign-in times and error reports
• Billing details processed by our payment provider; we do not store full card numbers

03How we use it

• To run the Service: route requests, send approval links and reminders, run connector actions and keep the audit trail
• To create your workspace and send your login details
• To provide support when you ask for it
• To keep the Service secure, detect abuse and fix faults
• To send service notices such as changes to plans or downtime; product news only if you opt in

04AI features

When you use the AI Workflow Builder, the description you type and relevant workspace settings, such as department and role names, are processed to produce a draft workflow. Drafts never run until a person publishes them, and the AI does not approve or reject requests.

Your workspace data is not used to train shared AI models.

05Connected apps

When an administrator connects an app, the Service requests only the access that the workflow needs. Data passed to or from that app is handled under this policy and the connected app’s own terms. Administrators can remove a connection at any time.

06Sharing

We do not sell personal data or workspace data, and we do not share it for advertising. We share data only with service providers who help us run the Service, such as hosting, email delivery, messaging and payments, under contracts that limit their use to that purpose, or where the law requires it.

07Security

• Encryption in transit and at rest
• Role based access, so users see only the requests their role allows
• An append only audit trail of actions in each workspace
• Restricted internal access to production systems, logged and reviewed

08Retention and deletion

Workspace data is kept for the retention period of your plan or the period your administrator sets. When a workspace is closed, its data is deleted within 30 days, except where the law requires us to keep certain records such as invoices.

09Your choices and rights

You can ask to access, correct or delete your personal data, or object to some uses of it. If your data sits inside an organisation’s workspace, we will pass your request to that organisation’s administrator, who controls it. You can unsubscribe from product news at any time.

10Cookies

This website uses only the cookies needed for it to work and to remember basic preferences. We do not use advertising cookies.

11Changes to this policy

If we make a material change, we will tell workspace administrators by email before it takes effect.