Privacy Policy
What we collect, why, who we share it with, and your rights.
This policy explains how Workpaper's developer, who runs Workpaper from India ("we"), handles personal data. It's written to meet India's Digital Personal Data Protection Act, 2023 and, for people in the European Union and United Kingdom, the GDPR. We are the "data fiduciary" (DPDP) and "controller" (GDPR) for this data.
The short version
- We collect what we need to run Workpaper and charge for it, and nothing else.
- No ads, no tracking cookies, no selling or renting your data. We count visits with PostHog, without cookies.
- We don't look at what's on your computers.
- You can see, correct, export or delete your data by emailing [email protected].
What we collect
| Data | Why |
|---|---|
| Email address, and your name and profile picture if you sign in with Google | To create your account, sign you in and contact you about it |
| Sign-in codes | To sign you in. They expire after 10 minutes. |
| Sessions: IP address, browser or device type, time of sign-in | To keep you signed in, show you where you're signed in, and spot misuse |
| Computer usage: names, sizes, when each started and stopped | To run your computers and bill you correctly |
| Free trial: a one-way scrambled ID of your device, and your IP address | To give one free trial per device and stop abuse |
| Payment details | Collected and handled by Dodo Payments, not us. We see only what's needed to match the payment to your account, such as your email, the amount and your country. |
| Messages you send us | To answer you |
| Technical logs: IP address, request times, errors | To keep Workpaper secure and working |
What's on your computers (files, programs, anything you run) is stored only to provide the service. We don't access it unless it's needed to keep the service running, to investigate abuse or a security problem, or because the law requires it.
Legal basis
Under the DPDP Act, we process your data for the purpose you gave it to us for, which is using Workpaper, and for legitimate uses the Act allows, such as meeting legal obligations. Under the GDPR, our bases are: performing our contract with you; our legitimate interests in keeping Workpaper secure and free of abuse; and complying with the law.
Who we share it with
Only with service providers that help us run Workpaper, and only what each needs:
| Provider | What for | Where |
|---|---|---|
| Vultr | Network server that carries traffic to our computers | India |
| Tailscale | Encrypted connections between our servers | Global |
| Vercel | Hosting our website, console and docs | United States and global |
| Cloudflare | Domain name and website delivery | Global |
| Resend | Sending sign-in codes and account emails | United States |
| PostHog | Counting visits and sign-ups, and recordings of how visitors use our pages, so we can improve them | European Union |
| Sign-in, only if you choose "Sign in with Google" | Global | |
| Dodo Payments | Taking payments and handling taxes, as merchant of record. It handles your payment details under its own privacy policy. | India / global |
The computers themselves run on hardware we own, in India. We may also disclose data when Indian law or a valid court order requires it.
Data outside India
Some providers above process data outside India, including in the United States. We only use providers that commit to protecting it, and, for data from the EU or UK, that offer the standard contractual safeguards the GDPR requires.
How long we keep it
- Account data: until you delete your account, then removed within 30 days.
- Deleted computers: removed straight away. There are no backups to clear.
- Sessions: until they expire or you sign out.
- Free trial records: the computer for 3 days after last use, the scrambled device ID for 30 days.
- Technical logs: up to 30 days.
- Billing records: as long as Indian tax law requires, currently up to 8 years. Dodo Payments keeps its own payment records under its policy.
Your rights
You can ask us to:
- tell you what data we hold about you, and who we've shared it with;
- correct or complete it;
- delete it, and close your account;
- give you a copy in a common format (GDPR);
- stop or limit some processing, or object to it (GDPR);
- withdraw your consent, where we rely on it;
- record someone to act for you if you die or become unable to (DPDP).
Email [email protected]. We'll answer within 30 days. If you're not happy with our answer, you can complain to the Data Protection Board of India, or, in the EU or UK, to your local data protection authority.
Children
Workpaper is not for anyone under 18, and we don't knowingly collect their data. If you think a child has signed up, tell us and we'll delete the account.
Security
Each computer is an isolated virtual machine. Traffic is encrypted in transit. Access to our servers is limited to the operator and protected by keys rather than passwords. No system is perfectly secure; if a breach affects your data, we'll tell you and the authorities as the law requires.
Cookies
We use only cookies that are needed to sign you in. See our Cookie Policy.
Changes
If we change this policy in a way that matters, we'll email you before it takes effect.
Contact
Workpaper's developer, [email protected]. This is also our grievance and data protection contact; see Contact and grievances.