01What we collect
What you give us
- Account details: your name, email address, mobile number, business name, and the sign-in codes we send you.
- Business information: what you tell us in the setup interview — what your business does, where it is, what is going wrong, your goals and the rules for your employees.
- Your website and public listing: when you give us a website or Maps link we read the public pages to describe your business back to you.
- Customer lists you import or paste, and standing rules such as do-not-contact.
- Connected accounts: with your permission, your Gmail, Google Calendar, WhatsApp, phone numbers and business tools, so your AI employees can work on them. Access tokens are encrypted and used only for that purpose.
- Payment details are collected by our payment providers (Paddle for US dollars, Razorpay for rupees). We do not store credit card, debit card or similar card data.
What is created while the service runs
- Work records: messages sent and received, call recordings, transcripts and summaries, bookings, reminders, approvals you gave or declined, and the memory each employee keeps about your business and your preferences.
- Usage: pages opened, features used, events on the website and in the app, device and browser type, IP address, and a visitor identifier so a visit on the website can be connected to the account it becomes.
Information about your customers
Your customers' names, contact details and messages reach us because your business uses the service. For that data you are the controller and we are your processor; we use it only to do the work you hired for and to honour opt-outs.
02How we use it
- To run the service: read your business, propose a plan, hire and run AI employees, answer customers, book, remind and collect on your behalf, and show you what happened.
- To bill you, send receipts, sign-in codes, low-balance warnings and service notices.
- To keep the service safe: rate limiting, fraud and abuse prevention, security monitoring, internal record keeping.
- To improve the service, using aggregated or de-identified usage measurements, and for internal training and quality assurance of our own staff.
- To contact you about the service and, if you agree, about new features and offers. You can opt out of marketing at any time.
Lawful basis
We process personal data on the basis of contract (providing the service you signed up for), legitimate interests (security, fraud prevention, service improvement) where those are not overridden by your rights, legal obligation, and consent where we ask for it — for marketing and certain tracking. Consent can be withdrawn at any time by writing to privacy@workfast.ai or using the unsubscribe link; withdrawal does not affect processing already carried out, and without some data we may not be able to provide the service.
03Google user data
If you connect Gmail or Google Calendar, WorkFast reads and sends email and reads and creates calendar events only to perform the tasks you set — answering inquiries, following up, booking appointments — and to show you what it did. We do not use Google user data for advertising, we do not sell it, and humans at WorkFast do not read it except with your permission, for security, or to comply with the law.
You can disconnect Google at any time from Settings or from your Google account permissions page; we then delete the stored connection and its tokens.
04Who we share it with
We share data only with providers who process it for us under contract, and only as much as the task needs:
- Cloud hosting and database (the backend that stores your workspace).
- AI model providers that generate replies, summaries and plans from the text we send them; they are contractually barred from training on it.
- Telephony and messaging providers that place calls and send texts and WhatsApp messages.
- Email delivery for our own service mail (sign-in codes, receipts, notices).
- Payment providers (Paddle, Razorpay) for checkout, subscriptions and refunds.
- Business-tool connectors you choose to connect (for example your CRM or accounting tool).
- Group companies, auditors and advisers to the extent they need it to perform their services for us.
We may also disclose data when the law requires it, to governmental, regulatory or law-enforcement authorities under our legal obligations, to protect the rights and safety of WorkFast, our customers or others, or as part of a merger or acquisition (we would tell you first). We do not sell personal information and do not share it for cross-context behavioural advertising.
05How long we keep it
For as long as your account is active. After you close it, data stays available for export for 30 days and is then permanently deleted from live systems, with backups expiring within a further 35 days, except for records we must keep for tax, accounting or legal reasons. Setup sessions that never become an account are deleted within 30 days.
06Security and breaches
WorkFast holds SOC 2 Type II. Data is encrypted in transit and at rest; connected-account credentials are encrypted with a key kept apart from the data; access inside the company is limited and logged; public endpoints are rate-limited and every incoming webhook is verified.
07Your rights
Wherever you live you can access, correct, export or delete your personal information, object to or restrict some processing, and withdraw consent. You can do most of this yourself in the app (export, disconnect, delete account); for anything else, email privacy@workfast.ai and we respond within one month. We will not treat you differently for exercising your rights.
California residents have the rights above under the CCPA/CPRA, including the right to know what we collect and the right to delete; we do not sell or share personal information as those terms are defined there. EEA and UK residents have the rights in the GDPR/UK GDPR and may complain to their local supervisory authority. Residents of India have the rights in the Digital Personal Data Protection Act, 2023, including the right to nominate and to grievance redressal below.
08Cookies and similar
We use a small number of first-party cookies and browser storage: to keep you signed in, to remember your preferences, and one visitor identifier (wf_vid) that lets us see how the website leads to the app so we can improve it. We do not use third-party advertising cookies. You can clear or block cookies in your browser; signing in will still work with a code each time, though some conveniences may not.
09International transfers
WorkFast is operated from India and uses providers in the United States and elsewhere; we collect personal data from people in India, the United States, the European Union and wherever our customers and their customers are. Where data moves across borders we rely on the providers' standard contractual clauses or equivalent legally recognised safeguards, and transfer only for the purposes in this policy. US customers' data is processed primarily by US-based providers.
10Children
WorkFast is a business service and is not directed at children under 18. We do not knowingly collect their data; if you believe a child has given us personal information, contact us and we will delete it.
11Grievances and payment issues
If a payment is deducted but the service is not activated, our systems detect the failure and initiate a refund to the original payment source within one working day; it may take 3–7 working days to appear in your account depending on your bank. For any other grievance about this policy or how your data is handled, write to our Grievance Officer at hello@workfast.ai; we acknowledge within 48 hours and resolve within 30 days.
12Changes
We may update this policy. Material changes are announced by email or in the app before they take effect. The date at the top shows the current version.
13Contact and Data Protection Officer
Data Protection Officer: Chinthamani K · hello@workfast.ai
Privacy requests: privacy@workfast.ai · Support: support@workfast.ai
Pepul Tech Private Limited, 70 Gomathi Nagar, Srinivasa Nagar, Velachery, Chennai, Tamil Nadu 600042, India