Privacy Policy

Thank you for using Workd. This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our websites, products, and services (collectively, the “Service”).

If you are a customer using the Service as an organization, this Privacy Policy should be read together with your agreement with us and our Data Processing Addendum (“DPA”). If there is a conflict, the DPA or your agreement controls with respect to Customer Data (defined below).

1) Who we are and scope

Workd, Inc. (“Workd”, “we”, “us”) provides CRM/ERP software to business customers. This policy applies to personal information we process as a controller (e.g., our website visitors, prospects, and users of our Service accounts) and to the extent applicable describes our role as a processor/service provider when we process Customer Data on behalf of customers.

Contact: info@workd.com

Our websites and the Workd product. This policy covers two settings, and we label which one a section applies to where it matters:

• Websites and marketing (workd.com and related sites, forms, events, and sales outreach): Workd decides how the information is used and is the controller.
• The Workd product (the hosted CRM/ERP, mobile apps, voice and AI features used by our customers’ teams): the customer decides how Customer Data is used and is the controller; Workd is the processor/service provider under the customer’s agreement and our DPA. Features such as visit tracking, photo capture, and voice likeness exist only in the product.

2) Key definitions

• Customer Data: Content and data a customer or its users submit to the Service (e.g., contacts, notes, order and payment history records, visit logs) that we process on the customer’s behalf per our agreement and DPA. The customer is the controller of Customer Data; Workd is a processor/service provider.
• Personal information / personal data: Information that identifies or can be linked to an individual. This includes business contact details when linked to a person.
• Sensitive Personal Information (SPI) / sensitive data / special categories: Certain categories of data defined by law (e.g., precise geolocation; account log-in credentials; government IDs; genetic/biometric; health; race/ethnicity; religion; union membership; sex life/sexual orientation; contents of communications where we are not the intended recipient).

3) What we collect

We collect personal information in ways that are aligned with our privacy objectives and applicable law:

• Data minimization , We collect only the personal information that is reasonably necessary to provide, operate, and secure the Service and to meet legal requirements.
• Fair and lawful collection , We obtain personal information by fair and lawful means. Before we introduce new collection methods (for example, a new telemetry event or a new cookie), we review them to confirm the collection is appropriate, our notices are accurate, and any required consents are in place.
• Reliable sources , When we receive personal information from sources other than the individual (for example, an integration partner or a customer’s system of record), we take reasonable steps to confirm those sources collect and share information fairly and lawfully (including through contractual commitments).
• Notice when additional information is acquired , If we develop or obtain additional information about you for our use (for example, enrichment from a reliable source), we provide notice at or before that use, or as soon as practical thereafter, and we honor your choices.

We collect the categories of personal information below, the purposes for which we use them, and our retention approach. We do not sell personal information. On our marketing websites (not inside the Service), we may share personal information for targeted advertising; see Do Not Sell or Share in Your privacy choices and rights below.

Retention: We retain personal information for as long as needed to provide the Service and fulfill the purposes described, which generally aligns with (a) the duration of an account or contract, (b) legal/financial recordkeeping and compliance periods, and (c) security and fraud-prevention needs. We apply deletion or de-identification when no longer needed. Customers may instruct us to delete Customer Data at any time in accordance with the DPA and the Service’s capabilities.

Payment information: Workd uses third-party, PCI-compliant payment processors for ACH/credit card transactions. We do not collect, store, or have access to full payment card numbers, bank account numbers with security codes/passwords, or other sensitive payment data. We receive only limited billing metadata (e.g., last-4, token, status) for record-keeping.

4) How we use information

1. Provide, operate, maintain, and secure the Service
2. Authenticate users and manage accounts
3. Process transactions and administer billing (via our payment processors)
4. Provide customer support and respond to inquiries
5. Analyze, improve, and develop the Service (including safety/security analytics)
6. Comply with law, enforce terms, and protect rights, safety, and property

Customer Data and AI: We do not use Customer Data to train machine-learning or AI models. AI features process Customer Data only to deliver the feature the customer has enabled, and we do not permit our AI sub-processors to train their models on Customer Data.

Advertising: We do not sell personal information. On our marketing websites (not inside the product), we may share personal information for targeted advertising; see Do Not Sell or Share in Your privacy choices and rights for opt-out methods.

5) Sensitive Personal Information & special-category data

• We process limited SPI as necessary to provide the Service,specifically account log-in credentials (passwords stored using industry-standard hashing) and, where a user enables the feature, precise geolocation for visit tracking. We do not use SPI for secondary purposes that would require offering a separate “Right to Limit” under California law.
• Geolocation controls: We collect precise location only when a user or customer enables location features and the device/OS permission is granted. Users can disable collection at the OS level. We do not use precise geolocation to infer home addresses or for general monitoring beyond the enabled feature. Visit-tracking location logs are retained for up to 2 years by default unless a customer requests earlier deletion. Visit-tracking records are visible to the user and to the customer organization’s authorized leadership (e.g., sales managers/administrators) per customer configuration. Workd personnel access is limited to support/security purposes, role-based, and logged.
• Customer-entered content: Customers control the free-text content, notes, attachments, photos/images, voice recordings and transcripts, and other Customer Data they or their users choose to input. Such content may incidentally include SPI/special-category data (e.g., health information, racial/ethnic origin, religion, union membership, contents of communications). Where present, Workd processes that material solely as a processor/service provider under customer instructions and our DPA. We do not sell or share SPI and we instruct users not to include sensitive data in free-text fields unless necessary and authorized.
• Voice likeness (Workd product): Where a customer enables it, a user may create a synthetic version of their own voice, for example to answer voicemail in their own voice. We create a voice model only from recordings the user provides for that purpose and only with that user’s express consent, given in the product before recording. The voice model and recordings are used only to provide the features the user enabled, are never sold or shared, and are not used to identify anyone. A user may withdraw consent at any time. We delete the voice model and source recordings within 30 days of withdrawal, of the feature being turned off, or of the end of the customer’s subscription, whichever comes first.
• U.S. state consent: In jurisdictions that require opt-in consent for processing sensitive data (e.g., precise geolocation), we obtain that consent and provide an easy way to withdraw it.

6) Cookies and similar technologies

We use cookies and similar technologies to operate and secure the Service and to understand usage. Where required by law (e.g., EU/UK), non-essential cookies are used only with consent. Users can manage preferences through browser settings and our cookie controls (where provided). We honor Global Privacy Control (GPC) and similar universal opt-out signals for relevant state-law purposes.

Tools we use on our marketing websites: Google Analytics to measure usage; the Meta Pixel and LinkedIn Insight Tag for advertising measurement and targeted advertising; and a visitor identification service (leadsy.ai) that may match a visit to a business or professional profile so we can follow up with interested companies. These load only after you click Accept on our cookie banner. If your browser sends a Global Privacy Control signal, the advertising and visitor identification tools do not load even if you click Accept. You can change your choice at any time using the Cookie Preferences link in the site footer. None of these tools run inside the Workd product.

7) Sharing and disclosure

• Service providers/sub-processors that host our infrastructure, provide analytics, customer support tooling, email delivery, logging/security, payments, and other operational services,bound by contract to use data only to provide services to us.
• Professional advisors (lawyers, accountants) and authorities where required by law.
• Business transfers: In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.

Sub-processors: We maintain a current list of sub-processors in our Data Processing Addendum and notify customers of material changes per our agreement.

8) International transfers

Customer Data is primarily hosted in the United States. We may transfer personal information to countries other than where it was collected. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) and implement supplementary measures as needed.

9) Security

We implement technical and organizational measures designed to protect personal information, including encryption in transit and at rest, role-based access controls, network and application security, vulnerability management, and employee security training. Passwords are stored using industry-standard hashing and never in plaintext. No method of transmission or storage is 100% secure; we maintain incident response processes and will notify affected parties as required by law.

10) Your privacy choices and rights

Your choices include:

• Account & profile: Access, edit, or delete certain information in your account settings. Customers may manage user accounts directly in the admin console.
• Mobile app data deletion: Users of mobile apps published by Workd (e.g., distributor storefront apps) can request deletion of their account data at workd.com/app-data-deletion.
• Location & device permissions: Enable/disable OS-level permissions (e.g., precise location) at any time.
• Cookies: Adjust browser settings and our cookie controls (where provided).

U.S. state rights: Depending on where you live, you may have rights to access, correct, delete, obtain a portable copy, and opt out of certain processing (e.g., sale/sharing, targeted advertising, or profiling in furtherance of decisions producing legal or similarly significant effects). Where required, you may also opt in (and later withdraw consent) for processing sensitive data (e.g., precise geolocation). We honor Global Privacy Control (GPC) signals as opt-outs of sale/sharing and targeted advertising where applicable.

Do Not Sell or Share: We do not sell personal information. On our marketing websites (not inside the Service), we may share personal information for targeted advertising. To opt out: (i) use a browser that sends Global Privacy Control (GPC), which we honor, and/or (ii) email info@workd.com with “Do Not Sell/Share” in the subject. You may also mail a request to Workd Inc, 37000 Grand River Ave Ste 300, Farmington Hills, MI 48335.

How to exercise rights / appeals: Submit a request to info@workd.com with “Privacy Request” in the subject or by mail at the address above. We will verify your request and respond within the timeframe required by law. If we deny your request, you may appeal by replying with “Appeal” in the subject; we will respond with our decision and rationale. You may use an authorized agent where permitted; we may require proof of authorization and identity verification.

How we handle deletion requests: When we receive a verified deletion request, we log and track the request, identify and flag associated records for destruction or de-identification, and complete deletion in a manner designed to prevent unauthorized access or reconstruction. Where data must be retained for legal or security reasons, we restrict it to those purposes and place it beyond use until it is automatically purged.

California and other U.S. states, response and non-discrimination: We respond to verified requests within 45 days and may extend once by another 45 days when reasonably necessary, in which case we will tell you. We will not discriminate against you for exercising your privacy rights. In the past 12 months we have not sold personal information. We have shared identifiers and internet activity from our marketing websites with advertising partners for targeted advertising, as described in Section 6.

Canada: If you are in Canada, you may have the right to access and correct your personal information and to withdraw consent, subject to legal limits. Your personal information is stored and processed in the United States, where it may be accessible to courts and law enforcement under U.S. law. To make a request or ask about our practices, contact our privacy lead at info@workd.com.

EEA/UK rights: If applicable, you also have the right to lodge a complaint with a supervisory authority. Contact info@workd.com for the appropriate authority details for your location.

11) Children

The Service is intended for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. We do not sell or share the personal information of anyone we know to be under 16. If you believe a minor has provided personal information, contact info@workd.com and we will delete it.

12) Data retention

We retain personal information consistent with the purposes described in this policy and our agreements, taking into account the amount, nature, and sensitivity of the data; potential risk of harm; legal, tax, accounting, and regulatory requirements; and customer instructions. We apply deletion or de-identification when retention is no longer necessary. Visit-tracking geolocation logs are retained for up to 2 years by default unless a customer requests earlier deletion.

Secure disposal: We delete or de-identify personal information using controls appropriate to the data and storage medium (for example, cryptographic erasure for encrypted systems, logical deletion with suppression, and backup expiry/rotation). Deletions applied to active systems propagate to backups in the ordinary course of our backup lifecycle.

13) Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with its effective date and, if changes are material, we will provide additional notice (e.g., in-app or by email).

14) How to contact us

For questions or requests concerning this Privacy Policy or our privacy practices, contact info@workd.com.

Controller / Service Provider Roles Summary

• Controller: We control and are responsible for personal information we collect about website visitors, prospects, and account administrators.
• Processor/Service Provider: We process Customer Data solely to provide the Service, under customer instructions and our DPA. We do not sell or share Customer Data for cross-context behavioral advertising.

Change Log

We publish a brief summary of notable updates. Most edits are organizational (formatting, clearer wording) and do not change how we collect, use, or share information.

September 24, 2026 , Annual review

• Distinguished our websites and marketing from the Workd product throughout.
• Added sensory data (photos, e-signatures, voice recordings and transcripts) and voice likeness, with express consent and 30-day deletion on withdrawal.
• Stated plainly that Customer Data is not used to train AI models.
• Named the analytics, advertising, and visitor identification tools used on our marketing websites, and added the Cookie Preferences control.
• Added a Website inquiries category with a 24-month retention period.
• Added response timelines and non-discrimination for U.S. state requests, a Canada section, and mobile app data deletion requests.
• Set the children’s threshold at 18.

September 16, 2025 , Routine clarifications & DPA

• Introduced a standalone Data Processing Addendum (DPA) for customers.
• Clarified scope (websites + apps + hosted services) and consolidated definitions.
• Added explicit details on precise geolocation for visit tracking and noted the default 2-year retention.
• Confirmed no sale of personal information; clarified that any targeted-ads “sharing” applies to marketing websites only (not in-product) and that we honor Global Privacy Control (GPC).
• Noted that payments are handled by PCI-compliant processors and that we do not store full card/ACH credentials.
• Unified privacy contact to info@workd.com and added a postal method for requests.

These updates improve clarity and do not materially change our privacy practices.

June 2, 2025 , Structure & transparency refresh

• Reorganized the policy for readability; added clearer headings and definitions.
• Expanded cookie/consent information and state-privacy rights summaries.
• Outlined security measures and our breach-notification approach.
• Provided more detail on retention and disposal practices.
• Added monitoring/enforcement and version-history language.