Privacy Policy
How we handle personal data on workaist.com and in WorkAist Cloud.
Effective: 2026-07-10
1. Controller
The controller for the processing described in this notice is ILIN & SADOVENKO, LDA, Rua de Xabregas, nº 2, Escritório 3.21, 1900-440 Lisboa, Portugal, NIF 517251876. Contact: [email protected].
We have not appointed a Data Protection Officer, because we are not required to under Article 37 GDPR. Data-protection enquiries and data-subject requests reach a responsible person directly at [email protected].
2. Scope
This notice covers workaist.com, all WorkAist-operated subdomains, and WorkAist Cloud, where we act as controller — that is, for our own visitors, prospects and account holders.
It does not cover personal data that a customer uploads into their own WorkAist workspace. For that data the customer is the controller and we are their processor; the terms of that processing are in our Data Processing Agreement. If your data is in a customer's workspace and you want to exercise your rights, please contact that customer.
3. What we process and why
| Category of data | Purpose | Legal basis |
|---|---|---|
| Account data — name, work email, company, password hash | Creating and administering your account, authentication, support | Art. 6(1)(b) GDPR — performance of a contract |
| Billing data — billing address, VAT number, payment status, invoices | Taking payment, issuing invoices, meeting tax and accounting obligations | Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR — legal obligation |
| Inquiry and signup forms — name, email, company, message, requested subdomain | Answering your enquiry and preparing a contract at your request | Art. 6(1)(b) GDPR — steps prior to entering a contract |
| Usage and telemetry — feature usage, agent runs, token consumption, error logs | Operating, securing, metering and improving the Service | Art. 6(1)(f) GDPR — our legitimate interest in a working, secure, correctly billed service |
| Security logs — IP address, user agent, timestamps, authentication events | Detecting and preventing abuse, fraud and unauthorised access | Art. 6(1)(f) GDPR — our legitimate interest in security |
| Support correspondence | Handling your support request and improving our documentation | Art. 6(1)(b) and Art. 6(1)(f) GDPR |
| Website analytics — pseudonymous identifiers, pages viewed, referrer, approximate location | Understanding how the website is used so we can improve it | Art. 6(1)(a) GDPR — your consent, given through the cookie banner |
Where we rely on legitimate interest, we have carried out a balancing test and concluded that the processing is necessary, proportionate, and does not override your interests or fundamental rights. You may object at any time — see section 9.
Providing account and billing data is necessary to enter into the contract. Without it we cannot provide the Service. Analytics is entirely optional and refusing it has no effect on your use of the site.
4. Cookies and similar technologies
We set strictly necessary storage without asking, because it is required to deliver a service you have requested. Everything else runs only after you have given consent through our cookie banner.
| Category | What it does | Examples and retention | Consent needed |
|---|---|---|---|
| Strictly necessary | Session management, CSRF protection, load balancing, remembering your language | Session cookies; deleted when you close the browser or shortly after | No — Art. 6(1)(f) GDPR |
| Consent record | Remembers the choice you made in the cookie banner so we do not ask again | workaist-consent-v1, stored in your browser's local storage | No — required to honour your choice |
| Analytics | Google Analytics 4, loaded through Google Tag Manager, measures page views and navigation using pseudonymous identifiers | _ga, _ga_<container-id>; up to 24 months | Yes |
| Advertising | Remarketing and conversion measurement tags, when we enable them | Set by the relevant advertising platform | Yes |
Before you consent, Google Consent Mode is initialised in denied state, so no analytics or advertising storage is written and no measurement hit is sent.
You can withdraw or change your consent at any time, and it is as easy to withdraw as it was to give: open "Cookie settings" in the footer of any page, change your choice, and save. Withdrawal does not affect the lawfulness of processing carried out before you withdrew.
5. Recipients and subprocessors
We do not sell personal data and we do not share it for anyone else's own marketing. We do use a small number of service providers who process personal data on our documented instructions, under Article 28 GDPR contracts.
| Provider | Purpose | Location of processing | Transfer safeguard |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of application servers and database | Germany (EU) | Not applicable — processing stays in the EU |
| Cloudflare, Inc. | DNS, reverse proxy, TLS termination, protection against denial-of-service attacks | Global edge network, including the EU | EU Standard Contractual Clauses; EU-US Data Privacy Framework |
| Stripe Payments Europe, Ltd. | Payment processing, subscription management, invoicing | Ireland (EU), with group support from the United States | EU Standard Contractual Clauses; EU-US Data Privacy Framework |
| Anthropic PBC | Large-language-model inference that powers the AI features of the Service | United States | EU Standard Contractual Clauses |
| Resend, Inc. | Transactional email — account verification, notifications, support replies | United States | EU Standard Contractual Clauses |
| Google Ireland Limited | Google Tag Manager and Google Analytics 4, only after you consent | Ireland (EU), with onward transfer to the United States | EU-US Data Privacy Framework; EU Standard Contractual Clauses |
This list is kept current. We also disclose personal data to professional advisers, and to public authorities or courts where we are legally obliged to, or where it is necessary to establish, exercise or defend legal claims.
6. International transfers
Our application servers and database are in Germany. Some of the providers listed above process personal data outside the European Economic Area, principally in the United States.
Every such transfer is covered by an Article 46 GDPR safeguard: the European Commission's Standard Contractual Clauses, supplemented where appropriate by additional technical and organisational measures, and — where the recipient is certified — by the European Commission's adequacy decision for the EU-US Data Privacy Framework. You can request a copy of the relevant safeguards from [email protected].
7. Retention
| Data | Retention period |
|---|---|
| Account data | For the life of the account, then 6 months after closure |
| Invoices and accounting records | 10 years, as required by Portuguese tax law |
| Customer Data in your workspace | Deleted after the contract ends — see the Terms of Service and the Data Processing Agreement |
| Security logs | 12 months |
| Aggregated, non-identifying analytics | 24 months |
| Inquiry-form submissions that do not lead to a contract | 24 months, then deleted |
| Record of your cookie choice | Until you clear it or change it |
8. Automated decision-making and AI
WorkAist is a platform for building AI agents. When an agent runs, the content it handles is sent to a large-language-model provider to generate a response. Customers choose that provider themselves: they may connect their own API key from any provider, in which case that provider acts on the customer's instructions and not on ours, or they may use our managed token billing, in which case we route requests to the providers listed in our subprocessor table above. What content is sent depends entirely on how the customer configures their agents.
We do not use your personal data, or our customers' Customer Data, to train large language models. Where we select the model provider, it is contractually barred from training on the data we send it. Where a customer brings their own provider, the terms of that provider apply and we have no control over them.
We do not carry out automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. Agents that you build may do so — in that case you are the controller of that processing and it is your obligation to provide the safeguards Article 22 requires, including meaningful human review.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you, and receive a copy (Art. 15);
- have inaccurate data corrected and incomplete data completed (Art. 16);
- have your data erased (Art. 17);
- restrict our processing of it (Art. 18);
- receive the data you gave us in a structured, commonly used, machine-readable format, and have it transmitted to another controller (Art. 20);
- object at any time to processing based on our legitimate interest, on grounds relating to your particular situation, and to object at any time and without reason to direct marketing (Art. 21);
- withdraw any consent you have given, at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).
Send any request to [email protected]. We answer within one month of receipt. If a request is particularly complex, we may extend that period by up to two further months and will tell you why within the first month. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with a supervisory authority — in particular in the Member State of your habitual residence, place of work, or the place of the alleged infringement. Our lead supervisory authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa, Portugal.
10. Security
We protect personal data with technical and organisational measures appropriate to the risk, including encryption in transit (TLS), encryption of stored credentials and secrets with AES-256-GCM, strict tenant and per-agent isolation, role-based access control, least-privilege access for staff, audit logging of administrative actions, and regular backups. The measures we apply to Customer Data are described in Annex II of the Data Processing Agreement.
No system is perfectly secure. If a personal-data breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay, as Article 34 GDPR requires.
11. Children
The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
12. Changes to this notice
We may update this notice. The version in force, with its effective date, is always the one on this page. If a change materially affects how we process your personal data, we will notify account holders by email before it takes effect.
13. Contact
For any privacy question or data-subject request: [email protected], or ILIN & SADOVENKO, LDA, Rua de Xabregas, nº 2, Escritório 3.21, 1900-440 Lisboa, Portugal.