Worklific Service Privacy Notice

Controller and processor roles

AMURA VENTURES, S.L.U., NIF B67681650, C/ Joan Ripoll Trobat 34, 2º A, 07013 Palma, Spain, Registro Mercantil de Palma, Tomo 2923, Folio 88, Sección 8, Hoja PM-92384, is the controller for account, commercial, billing, support, security, and website data. Contact: hello@worklific.com. There is no appointed data protection officer. Complaints may also be made to the Spanish Data Protection Agency (AEPD), www.aepd.es.

For personal data that a business customer places in a workspace, task, message, file, prompt, output, or connected service, the customer is normally the controller and Worklific is its processor under the DPA.

Data, purposes, and legal bases

We process account identity and contact data; company and authority details; workspace, AI employee, task, message, file, prompt, output, and usage data; provider connections and encrypted credential material; support communications; Stripe customer, subscription, invoice, and payment references; and device, network, security, audit, and backup records.

We use this data to contract for and deliver the service, authenticate users, execute customer instructions, meter entitlements, bill and account for payments, provide support, secure and diagnose the service, prevent abuse, recover from failures, meet legal obligations, and improve reliability. The legal bases are performance of the business service contract, legitimate interests in operating and protecting the service, compliance with tax/accounting and other law, and consent where it is specifically requested. We do not sell personal data. Brevo is used for transactional service email, not unrelated marketing; any future marketing requires a separate lawful basis and opt-out.

Connected Google and Microsoft services

When a customer connects Google Drive, Gmail, OneDrive, or Outlook, Worklific uses delegated OAuth access only for that customer and AI employee. File and mailbox connections default to read-only. The customer must separately enable file changes or email sending before the employee can perform those actions. For Gmail and Outlook, Worklific may process message identifiers, headers, recipients, subject lines, bodies, and provider metadata needed to list, read, summarize, or send messages as instructed by the customer.

OAuth tokens are encrypted at rest and scoped to the applicable tenant, employee, provider, and access level. Message content read for a task may be stored with that task in the customer's encrypted workspace and follows the retention and deletion rules below. Disconnecting an account removes Worklific's stored credentials; customers may also revoke access directly in their Google or Microsoft account. Worklific does not sell connected-service data, use it for advertising, or use it to train its own models.

Worklific's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Worklific uses raw or derived Google Workspace API user data only to provide or improve user-facing features requested by the user. It does not use that data to develop, improve, or train generalized or non-personalized AI/ML models, and it does not transfer that data to third-party AI/ML services that use it for such training.

Recipients, model processing, and transfers

We disclose data only as needed to personnel, professional advisers, authorities where legally required, and these providers: Cloudflare for edge delivery and security; Hetzner for EU compute and networking; Backblaze B2 for encrypted object storage and backups; OpenAI for model inference through Worklific's centrally controlled account; Stripe for payments, tax rates, invoices, and fraud controls; and Brevo for transactional email. Customer-configured integrations receive data when the customer instructs the service to use them.

Prompts and outputs required for an AI task are sent to the selected model provider. Worklific does not use customer workspace content to train its own model. Provider handling is governed by the applicable business terms, privacy commitments, and data-processing safeguards available to Worklific. Transfers outside the EEA rely on an adequacy decision or safeguards such as the European Commission's Standard Contractual Clauses.

Retention and deletion

Active account and workspace data is kept while the service is used. After workspace termination or a verified deletion request, live customer content is deleted through the service's deletion workflow; protected backup copies remain inaccessible to ordinary use and expire through normal backup rotation. Security and operational logs are generally kept for up to 90 days unless an incident requires longer preservation. Support records are generally kept for up to 24 months after closure. Contract, invoice, payment, and accounting records are kept for six years or longer where tax law requires. A legal hold, dispute, fraud investigation, or security incident may require limited longer retention. Model-provider retention follows its applicable business data controls and legal obligations.

Rights and automated decisions

People may request access, rectification, erasure, restriction, portability, or objection, and may withdraw consent without affecting earlier processing, by emailing hello@worklific.com. We may need to verify identity and, for customer-controlled workspace data, refer the request to the business customer. People may complain to the AEPD.

Worklific AI employees generate recommendations and outputs, but Worklific does not use them to make solely automated decisions that produce legal or similarly significant effects about account users. Customers are responsible for human review if they use outputs in their own decision-making.