Privacy Policy

Thank you for using Workd. This Privacy Policy explains how we collect, use, disclose, and protect personal information in connection with our websites, products, and services (collectively, the “Service”).

If you are a customer using the Service as an organization, this Privacy Policy should be read together with your agreement with us and our Data Processing Addendum (“DPA”). If there is a conflict, the DPA or your agreement controls with respect to Customer Data (defined below).

1) Who we are and scope

Workd, Inc. (“Workd”, “we”, “us”) provides CRM/ERP software to business customers. This policy applies to personal information we process as a controller (e.g., our website visitors, prospects, and users of our Service accounts) and to the extent applicable describes our role as a processor/service provider when we process Customer Data on behalf of customers.

Contact: info@workd.com

Our websites and the Workd product. This policy covers two settings, and we label which one a section applies to where it matters:

• Websites and marketing (workd.com and related sites, forms, events, and sales outreach): Workd decides how the information is used and is the controller.
• The Workd product (the hosted CRM/ERP, mobile apps, voice and AI features used by our customers’ teams): the customer decides how Customer Data is used and is the controller; Workd is the processor/service provider under the customer’s agreement and our DPA. Features such as visit tracking, photo capture, and voice likeness exist only in the product.

2) Key definitions

• Customer Data: Content and data a customer or its users submit to the Service (e.g., contacts, notes, order and payment history records, visit logs) that we process on the customer’s behalf per our agreement and DPA. The customer is the controller of Customer Data; Workd is a processor/service provider.
• Personal information / personal data: Information that identifies or can be linked to an individual. This includes business contact details when linked to a person.
• Sensitive Personal Information (SPI) / sensitive data / special categories: Certain categories of data defined by law (e.g., precise geolocation; account log-in credentials; government IDs; genetic/biometric; health; race/ethnicity; religion; union membership; sex life/sexual orientation; contents of communications where we are not the intended recipient).

3) What we collect

We collect personal information in ways that are aligned with our privacy objectives and applicable law:

• Data minimization , We collect only the personal information that is reasonably necessary to provide, operate, and secure the Service and to meet legal requirements.
• Fair and lawful collection , We obtain personal information by fair and lawful means. Before we introduce new collection methods (for example, a new telemetry event or a new cookie), we review them to confirm the collection is appropriate, our notices are accurate, and any required consents are in place.
• Reliable sources , When we receive personal information from sources other than the individual (for example, an integration partner or a customer’s system of record), we take reasonable steps to confirm those sources collect and share information fairly and lawfully (including through contractual commitments).
• Notice when additional information is acquired , If we develop or obtain additional information about you for our use (for example, enrichment from a reliable source), we provide notice at or before that use, or as soon as practical thereafter, and we honor your choices.

We collect the categories of personal information below, the purposes for which we use them, and our retention approach. We do not sell personal information. On our marketing websites (not inside the Service), we may share personal information for targeted advertising; see Do Not Sell or Share in Your privacy choices and rights below. This never includes mobile phone numbers or text messaging consent (see Section 8).

Retention: We retain personal information for as long as needed to provide the Service and fulfill the purposes described, which generally aligns with (a) the duration of an account or contract, (b) legal/financial recordkeeping and compliance periods, and (c) security and fraud-prevention needs. We apply deletion or de-identification when no longer needed. Customers may instruct us to delete Customer Data at any time in accordance with the DPA and the Service’s capabilities.

Payment information: Workd uses third-party, PCI-compliant payment processors for ACH/credit card transactions. We do not collect, store, or have access to full payment card numbers, bank account numbers with security codes/passwords, or other sensitive payment data. We receive only limited billing metadata (e.g., last-4, token, status) for record-keeping.

4) How we use information

1. Provide, operate, maintain, and secure the Service
2. Authenticate users and manage accounts
3. Process transactions and administer billing (via our payment processors)
4. Provide customer support and respond to inquiries
5. Analyze, improve, and develop the Service (including safety/security analytics)
6. Comply with law, enforce terms, and protect rights, safety, and property

Customer Data and AI: We do not use Customer Data to train machine-learning or AI models. AI features process Customer Data only to deliver the feature the customer has enabled, and we do not permit our AI sub-processors to train their models on Customer Data.

Advertising: We do not sell personal information. On our marketing websites (not inside the product), we may share personal information for targeted advertising; see Do Not Sell or Share in Your privacy choices and rights for opt-out methods. This never includes mobile phone numbers or text messaging consent (see Section 8).

5) Sensitive Personal Information & special-category data

• We process limited SPI as necessary to provide the Service,specifically account log-in credentials (passwords stored using industry-standard hashing) and, where a user enables the feature, precise geolocation for visit tracking. We do not use SPI for secondary purposes that would require offering a separate “Right to Limit” under California law.
• Geolocation controls: We collect precise location only when a user or customer enables location features and the device/OS permission is granted. Users can disable collection at the OS level. We do not use precise geolocation to infer home addresses or for general monitoring beyond the enabled feature. Visit-tracking location logs are retained for up to 2 years by default unless a customer requests earlier deletion. Visit-tracking records are visible to the user and to the customer organization’s authorized leadership (e.g., sales managers/administrators) per customer configuration. Workd personnel access is limited to support/security purposes, role-based, and logged.
• Customer-entered content: Customers control the free-text content, notes, attachments, photos/images, voice recordings and transcripts, and other Customer Data they or their users choose to input. Such content may incidentally include SPI/special-category data (e.g., health information, racial/ethnic origin, religion, union membership, contents of communications). Where present, Workd processes that material solely as a processor/service provider under customer instructions and our DPA. We do not sell or share SPI and we instruct users not to include sensitive data in free-text fields unless necessary and authorized.
• Voice likeness (Workd product): Where a customer enables it, a user may create a synthetic version of their own voice, for example to answer voicemail in their own voice. We create a voice model only from recordings the user provides for that purpose and only with that user’s express consent, given in the product before recording. The voice model and recordings are used only to provide the features the user enabled, are never sold or shared, and are not used to identify anyone. A user may withdraw consent at any time. We delete the voice model and source recordings within 30 days of withdrawal, of the feature being turned off, or of the end of the customer’s subscription, whichever comes first.
• U.S. state consent: In jurisdictions that require opt-in consent for processing sensitive data (e.g., precise geolocation), we obtain that consent and provide an easy way to withdraw it.

6) Cookies and similar technologies

We use cookies and similar technologies to operate and secure the Service and to understand usage. Where required by law (e.g., EU/UK), non-essential cookies are used only with consent. Users can manage preferences through browser settings and our cookie controls (where provided). We honor Global Privacy Control (GPC) and similar universal opt-out signals for relevant state-law purposes.

Tools we use on our marketing websites: Google Analytics to measure usage, and the Meta Pixel and LinkedIn Insight Tag for advertising measurement and targeted advertising. These load only after you click Accept on our cookie banner. If your browser sends a Global Privacy Control signal, the advertising tools do not load even if you click Accept. You can change your choice at any time using the Cookie Preferences link in the site footer. None of these tools run inside the Workd product.

7) Sharing and disclosure

• Service providers/sub-processors that host our infrastructure, provide analytics, customer support tooling, email delivery, logging/security, payments, and other operational services,bound by contract to use data only to provide services to us.
• Professional advisors (lawyers, accountants) and authorities where required by law.
• Business transfers: In connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.

Mobile phone numbers and text messaging consent are excluded from all of the sharing above. They are used only as described in Section 8.

Sub-processors: We maintain a current list of sub-processors in our Data Processing Addendum and notify customers of material changes per our agreement.

8) Text messages (SMS)

This section explains how Workd uses text messages (SMS and MMS) and how we handle mobile phone numbers and text messaging consent. If anything else in this policy conflicts with this section, this section controls for mobile phone numbers and text messaging. Our Text Messaging Terms also apply.

Who sends the messages. Workd, Inc. sends text messages in two settings:

• Workd’s own messages (websites and marketing, and Workd accounts): Workd sales and support team members text with current and prospective customers from Workd business phone numbers, and the Workd platform sends one-time sign-in codes and account and security notices to people who use Workd accounts. Workd is the sender and the controller of this information.
• Messages sent through the Workd product: When a business that uses Workd (for example, a distributor you buy from) turns on text notifications, the Workd platform sends order, delivery, and account notifications, and sign-in codes for that business’s online ordering site or app, on that business’s behalf. Those messages name the business, and the business is responsible for obtaining your consent. Workd handles your number for that business as its processor/service provider under its agreement with us and our DPA, and the protections in this section apply.

What we collect. Your mobile phone number; your name and company if you give them to us; a record of your consent (date, time, method, and the wording you agreed to); your opt-in and opt-out history; and the content, timing, and delivery status of the messages we exchange with you.

How we use it. Only to send the text messages you agreed to receive, to reply to messages you send us, to verify your identity when you sign in, to keep a record of your consent and opt-out choices, to meet legal and carrier requirements, and to prevent fraud and abuse.

How you opt in. We text you only after you agree to receive texts from us, or to reply when you text us first. You can agree by asking a Workd team member, in writing or by phone, to text you; by texting one of our numbers; or by adding a mobile number to your Workd account and choosing text messages for sign-in codes. Consent to receive text messages is not a condition of any purchase. We do not send promotional or bulk text messages.

Message frequency and cost. Message frequency varies based on your conversations with us and your account activity. Message and data rates may apply.

Opting out and getting help. Reply STOP to any message to stop receiving texts from that number. We also honor END, CANCEL, UNSUBSCRIBE, QUIT, STOPALL, REVOKE, and OPTOUT, and any other reasonable request to stop, including by email or phone. After you opt out, you will receive one message confirming it and no further texts unless you opt in again. Reply HELP for help, or contact us at info@workd.com or (248) 522-9680.

No sharing of mobile information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. We do not sell, rent, or share your mobile phone number or your text messaging opt-in data and consent with any third party or affiliate for their marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding the messaging service providers and carriers (such as Twilio) that deliver our messages, which may use this information only to deliver them. All other sharing described in this policy, including targeted advertising on our marketing websites, excludes mobile phone numbers and text messaging opt-in data and consent. This does not prevent a disclosure that the law requires.

Retention. We keep records of your consent and opt-out choices for as long as needed to honor them and to show our compliance, generally at least four years after our last message to you. Other text message records follow the retention approach for the related category in Section 3.

9) International transfers

Customer Data is primarily hosted in the United States. We may transfer personal information to countries other than where it was collected. Where required, we use appropriate safeguards (e.g., Standard Contractual Clauses) and implement supplementary measures as needed.

10) Security

We implement technical and organizational measures designed to protect personal information, including encryption in transit and at rest, role-based access controls, network and application security, vulnerability management, and employee security training. Passwords are stored using industry-standard hashing and never in plaintext. No method of transmission or storage is 100% secure; we maintain incident response processes and will notify affected parties as required by law.

11) Your privacy choices and rights

Your choices include:

• Account & profile: Access, edit, or delete certain information in your account settings. Customers may manage user accounts directly in the admin console.
• Mobile app data deletion: Users of mobile apps published by Workd (e.g., distributor storefront apps) can request deletion of their account data at workd.com/app-data-deletion.
• Location & device permissions: Enable/disable OS-level permissions (e.g., precise location) at any time.
• Text messages: Reply STOP to any text to opt out, or HELP for help. See Section 8.
• Cookies: Adjust browser settings and our cookie controls (where provided).

U.S. state rights: Depending on where you live, you may have rights to access, correct, delete, obtain a portable copy, and opt out of certain processing (e.g., sale/sharing, targeted advertising, or profiling in furtherance of decisions producing legal or similarly significant effects). Where required, you may also opt in (and later withdraw consent) for processing sensitive data (e.g., precise geolocation). We honor Global Privacy Control (GPC) signals as opt-outs of sale/sharing and targeted advertising where applicable.

Do Not Sell or Share: We do not sell personal information. On our marketing websites (not inside the Service), we may share personal information for targeted advertising. To opt out: (i) use a browser that sends Global Privacy Control (GPC), which we honor, and/or (ii) email info@workd.com with “Do Not Sell/Share” in the subject. You may also mail a request to Workd Inc, 37000 Grand River Ave Ste 300, Farmington Hills, MI 48335.

How to exercise rights / appeals: Submit a request to info@workd.com with “Privacy Request” in the subject or by mail at the address above. We will verify your request and respond within the timeframe required by law. If we deny your request, you may appeal by replying with “Appeal” in the subject; we will respond with our decision and rationale. You may use an authorized agent where permitted; we may require proof of authorization and identity verification.

How we handle deletion requests: When we receive a verified deletion request, we log and track the request, identify and flag associated records for destruction or de-identification, and complete deletion in a manner designed to prevent unauthorized access or reconstruction. Where data must be retained for legal or security reasons, we restrict it to those purposes and place it beyond use until it is automatically purged.

California and other U.S. states, response and non-discrimination: We respond to verified requests within 45 days and may extend once by another 45 days when reasonably necessary, in which case we will tell you. We will not discriminate against you for exercising your privacy rights. In the past 12 months we have not sold personal information. We have shared identifiers and internet activity from our marketing websites with advertising partners for targeted advertising, as described in Section 6.

Canada: If you are in Canada, you may have the right to access and correct your personal information and to withdraw consent, subject to legal limits. Your personal information is stored and processed in the United States, where it may be accessible to courts and law enforcement under U.S. law. To make a request or ask about our practices, contact our privacy lead at info@workd.com.

EEA/UK rights: If applicable, you also have the right to lodge a complaint with a supervisory authority. Contact info@workd.com for the appropriate authority details for your location.

12) Children

The Service is intended for business use by adults. It is not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. We do not sell or share the personal information of anyone we know to be under 16. If you believe a minor has provided personal information, contact info@workd.com and we will delete it.

13) Data retention

We retain personal information consistent with the purposes described in this policy and our agreements, taking into account the amount, nature, and sensitivity of the data; potential risk of harm; legal, tax, accounting, and regulatory requirements; and customer instructions. We apply deletion or de-identification when retention is no longer necessary. Visit-tracking geolocation logs are retained for up to 2 years by default unless a customer requests earlier deletion.

Secure disposal: We delete or de-identify personal information using controls appropriate to the data and storage medium (for example, cryptographic erasure for encrypted systems, logical deletion with suppression, and backup expiry/rotation). Deletions applied to active systems propagate to backups in the ordinary course of our backup lifecycle.

14) Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version with its effective date and, if changes are material, we will provide additional notice (e.g., in-app or by email).

15) How to contact us

For questions or requests concerning this Privacy Policy or our privacy practices, contact info@workd.com.

Controller / Service Provider Roles Summary

• Controller: We control and are responsible for personal information we collect about website visitors, prospects, and account administrators.
• Processor/Service Provider: We process Customer Data solely to provide the Service, under customer instructions and our DPA. We do not sell or share Customer Data for cross-context behavioral advertising.

Change Log

We publish a brief summary of notable updates. Most edits are organizational (formatting, clearer wording) and do not change how we collect, use, or share information.

November 8, 2026 , Website tools

• Removed the visitor identification service (leadsy.ai) from the tools we use on our marketing websites; we no longer use it.

October 20, 2026 , Text messaging

• Removed the text message checkbox on Workd forms as a way to opt in, and the matching reference to recording web-form consent; no Workd form collects text messaging consent.
• Stated that the sign-in codes the Workd platform sends for a business’s online ordering site or app are sent on that business’s behalf.
• Stated that Workd does not send promotional or bulk text messages; our texts are conversations with people who asked us to text them or who texted us first, and sign-in and account notices.

October 12, 2026 , Text messaging

• Added a Text messages (SMS) section: who sends texts, what we collect, how you opt in, message frequency, message and data rates, STOP and HELP, and retention of consent records.
• Stated that mobile phone numbers and text messaging opt-in data and consent are never sold or shared with third parties or affiliates for marketing, and excluded them from targeted advertising on our marketing websites.

September 24, 2026 , Annual review

• Distinguished our websites and marketing from the Workd product throughout.
• Added sensory data (photos, e-signatures, voice recordings and transcripts) and voice likeness, with express consent and 30-day deletion on withdrawal.
• Stated plainly that Customer Data is not used to train AI models.
• Named the analytics, advertising, and visitor identification tools used on our marketing websites, and added the Cookie Preferences control.
• Added a Website inquiries category with a 24-month retention period.
• Added response timelines and non-discrimination for U.S. state requests, a Canada section, and mobile app data deletion requests.
• Set the children’s threshold at 18.

September 16, 2025 , Routine clarifications & DPA

• Introduced a standalone Data Processing Addendum (DPA) for customers.
• Clarified scope (websites + apps + hosted services) and consolidated definitions.
• Added explicit details on precise geolocation for visit tracking and noted the default 2-year retention.
• Confirmed no sale of personal information; clarified that any targeted-ads “sharing” applies to marketing websites only (not in-product) and that we honor Global Privacy Control (GPC).
• Noted that payments are handled by PCI-compliant processors and that we do not store full card/ACH credentials.
• Unified privacy contact to info@workd.com and added a postal method for requests.

These updates improve clarity and do not materially change our privacy practices.

June 2, 2025 , Structure & transparency refresh

• Reorganized the policy for readability; added clearer headings and definitions.
• Expanded cookie/consent information and state-privacy rights summaries.
• Outlined security measures and our breach-notification approach.
• Provided more detail on retention and disposal practices.
• Added monitoring/enforcement and version-history language.