Worky, Inc. ("Worky", "we", "us", "our") provides field service and operations software for home service businesses through our website at useworky.com, our web application, our mobile applications (Worky and Worky Crew), and related services (together, the "Service").

This Privacy Policy explains what information we collect, why we collect it, how we use and protect it, who we share it with, and the choices and rights you have. It applies to business owners and their team members who use Worky ("Customers"), to the end clients of those businesses who interact with the Worky Client Hub, and to visitors of our website. By creating an account or using the Service you agree to this policy.

1. Who we are and our role

Worky, Inc. is a company organized in the United States and is the entity responsible for the personal information described in this policy.

As a controller: for information about our Customers (account holders, team members, billing contacts) and website visitors, Worky decides how and why the data is used.
As a processor: for the business data a Customer uploads into Worky about their own clients, properties, jobs and invoices, Worky acts on the Customer's instructions. The Customer is the controller of that data. If you are an end client of a business using Worky and want your data corrected or deleted, please contact that business directly; we will assist them where required.

2. Information we collect

2.1 Account information

When you create a Worky account we collect your first and last name, email address, password (stored only as a salted hash), business name, business address, phone number, industry, timezone, and any logo or profile photo you upload.

2.2 Team and employee information

If you invite team members, we collect their name, email address, phone number, role and permissions, hourly rate or payroll settings you configure, time entries, and (when the employee enables it in the Worky Crew app) live location during working hours for job dispatch and route visibility. Location tracking can be disabled by the employee from their device settings at any time.

2.3 Business and client data

Worky stores the business and operational data you create and manage through the Services, including client contact information, service locations and property addresses, requests, quotes, jobs, schedules, tasks, invoices, payments, agreements and electronic signatures, referral records, notes, photos, documents, file attachments, and other content you upload or generate while using the Services.

This information belongs to you. Worky does not sell, rent, or share your business or customer data with third parties for their marketing or advertising purposes. We access your data only as necessary to provide, maintain, secure, improve, or support the Services, or as required by law or with your explicit permission. Your customer list is your business, not ours. Worky never sells your customer information or uses it to market products or services to your clients.

Data Ownership

As between you and Worky, you retain all ownership rights to the business and customer data you upload to the Services. Worky does not claim ownership of your data. We process your data solely to provide the Services you request and for the limited purposes described in this Privacy Policy.

2.4 Payment and billing information

Subscription payments and in-app client payments are processed by Stripe, Inc. Worky does not store full card numbers or CVC codes. We receive and store payment tokens, card brand and last four digits, billing name and email, subscription plan and status, invoice history, and payout metadata for Customers who connect a Stripe account to collect payments from their own clients.

2.5 Communications

We store transactional emails and SMS messages sent through the Service (quotes, invoices, reminders, invitations), their delivery status (delivered, opened, bounced), and any support messages you send us.

2.6 Usage, device and log data

Server and application logs, IP address, browser and operating system, device model and identifiers, app version, pages and screens viewed, feature usage, timestamps, crash and error reports, and approximate location derived from IP address.

2.7 Push notification tokens

If you enable notifications in our mobile apps, we store the device push token issued by Apple or Google so we can deliver job, payment, and reminder notifications. You can turn notifications off in your device settings.

2.8 AI features

Worky includes optional AI assistance (for example rewriting a service description or the Worky Copilot). When you use these features, the relevant text you submit is sent to our AI provider to generate a response. Provider inputs and outputs are not used to train third-party models, and we do not send payment card data to AI providers.

2.9 Cookies and similar technologies

We use strictly necessary cookies for authentication, session management and security; preference cookies to remember settings such as your selected business or theme; and analytics and marketing cookies (including Meta Pixel on our marketing pages) to understand traffic and measure campaigns. You can control cookies through your browser settings; disabling strictly necessary cookies will prevent you from signing in.

2.10 Information we do not collect

We do not intentionally collect government identification numbers, health information, biometric data, or precise location from business owners' end clients.

3. Google user data

When you choose "Sign in with Google" we use Google OAuth to authenticate you. We request only the following scopes:

openid: to authenticate your identity.
email: to obtain your primary Google email address.
profile: to obtain your name and profile picture URL.

From these scopes, Worky receives and stores:

Your email address (used as your Worky login identifier).
Your first and last name (used to populate your Worky profile).
A Google account identifier (used to link the OAuth identity to your Worky account).

How we use Google user data: solely to create and authenticate your Worky account, populate your profile, and let you sign back in. We do not use Google user data for advertising, do not sell it, and do not share it with third parties for their own purposes.

How we store Google user data: the email, name, and Google identifier are stored in our authentication database, encrypted in transit (TLS) and at rest. We do not store your Google password or long-lived Google access tokens beyond the active session.

How we share Google user data: we do not share Google user data with any third party except the sub-processors listed in section 6, which are strictly required to operate the Service and are contractually bound to confidentiality and security.

How to revoke access: you can revoke Worky's access to your Google account at any time at https://myaccount.google.com/permissions. You can also delete your Worky account from Account settings or by emailing privacy@useworky.com; deletion removes the stored Google email, name, and identifier from our systems.

Worky's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

Provide, operate, maintain and improve the Service and its features.
Create and manage accounts, teams, permissions and business profiles.
Schedule and dispatch jobs, generate quotes, invoices, agreements and PDF documents.
Process subscription billing and, for Customers using Stripe Connect, facilitate payments from their clients.
Send transactional email, SMS and push notifications such as receipts, password resets, invitations, job assignments, reminders and payment confirmations.
Provide customer support and respond to your requests.
Detect, investigate and prevent fraud, abuse and security incidents.
Analyze aggregate usage to understand product performance and prioritize improvements.
Send product updates and marketing communications where permitted; you can unsubscribe at any time using the link in the email.
Comply with legal, tax and accounting obligations and enforce our terms.

5. Legal bases for processing (EEA and UK)

If you are located in the European Economic Area or the United Kingdom, we rely on:

Contract: to provide the Service you have signed up for.
Legitimate interests: to secure the Service, prevent fraud, improve our product and communicate about it.
Consent: for optional analytics and marketing cookies, marketing email, and push notifications, where required.
Legal obligation: to retain records required by tax and accounting law and to respond to lawful requests.

6. Sub-processors and sharing

We share information only with service providers that help us operate the Service, each bound by contractual confidentiality and security obligations:

Provider	Purpose
Supabase	Database, authentication and file storage
Cloudflare	Hosting, CDN, DDoS protection and edge compute
Stripe	Subscription billing and client payment processing
Resend	Transactional email delivery
Twilio	SMS notifications and team invitations
Google Maps Platform	Address autocomplete, geocoding and maps
Firebase Cloud Messaging and Apple Push Notification service	Mobile push notifications
Sentry	Error monitoring and crash reporting
AI model providers	Optional AI writing and assistant features

We may also disclose information:

To authorities when required by law, subpoena or valid legal process.
To protect the rights, property or safety of Worky, our Customers or the public.
To an acquirer or successor in connection with a merger, acquisition, financing or sale of assets, subject to this policy.
With your direction or consent.

We do not sell personal information and we do not share it for cross-context behavioral advertising.

7. Data retention

Account and business data: retained while your account is active.
After account deletion: personal data is deleted or anonymized within 30 days, except where longer retention is required by law.
Billing and tax records: retained up to 7 years to comply with accounting and tax obligations.
Server and security logs: typically retained up to 12 months.
Backups: encrypted backups may retain data for up to 90 days before being overwritten.

8. Security

We maintain administrative, technical and physical safeguards including:

TLS encryption for all data in transit and encryption at rest.
Passwords hashed with industry-standard algorithms; we never store them in clear text.
Row-level access controls so each business can only reach its own records, plus role-based permissions inside each account.
Least-privilege, audited access to production systems by authorized personnel.
Continuous error and anomaly monitoring, plus regular dependency updates.

No method of transmission or storage is completely secure. If we become aware of a breach affecting your personal data, we will notify affected users and regulators as required by applicable law and without undue delay. To report a vulnerability, email security@useworky.com.

9. Your rights and choices

Depending on where you live (for example under GDPR, UK GDPR, CCPA/CPRA or similar laws), you may have the right to:

Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Delete your account and personal information.
Receive a portable copy of your data.
Object to or restrict certain processing.
Withdraw consent at any time, without affecting prior processing.
Not be discriminated against for exercising your privacy rights.

Most of these actions are available directly in the app under Account settings. You can also email privacy@useworky.com. We respond within 30 days and may need to verify your identity first. EEA and UK users may also lodge a complaint with their local supervisory authority.

Communication preferences: unsubscribe from marketing email using the link in any message, reply STOP to marketing SMS, and disable push notifications in your device settings. Transactional messages required to operate your account cannot be turned off while the account is active.

10. Children

The Service is intended for businesses and is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact us and we will delete it.

11. International transfers

Worky is operated from the United States and our infrastructure providers may process data in the United States and other countries. Where required, we rely on the European Commission's Standard Contractual Clauses or equivalent safeguards for transfers out of the EEA and the UK. By using the Service you understand your information may be transferred to and processed in these countries.

12. Third-party links and integrations

The Service may link to or integrate with third-party websites and services. Their privacy practices are governed by their own policies, and we are not responsible for them. We encourage you to review those policies before sharing information.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the latest revision. Material changes will be notified by email or through an in-product notice at least 7 days before taking effect. Continued use of the Service after the effective date means you accept the updated policy.

14. Contact us

Worky, Inc.
Privacy: privacy@useworky.com
Security: security@useworky.com
Support: support@useworky.com
Website: useworky.com