Who this policy covers
This policy applies to people and organizations that visit Worqa marketing pages, create a workspace, administer a company account, use the product as an employee or manager, apply for a role through a Worqa-powered careers page, receive communications from the platform, or connect third-party services to a workspace.
When a company uses Worqa to manage its workforce operations, that company controls the business decisions behind the data it submits to the platform. Worqa acts as the service provider that hosts, secures, and processes that information on the company’s behalf.
Information we collect
We collect information directly from customers and users, including account details, workspace setup records, names, email addresses, role assignments, authentication and session records, profile details, attendance submissions, payroll information, scheduling activity, uploaded documents, recruiting workflows, approvals, and support communications.
We also collect technical and operational information such as device and browser data, IP address, log events, audit history, notification delivery status, API activity, usage telemetry, and integration metadata needed to operate, secure, and improve the service.
Workforce, applicant, and payroll data
Because Worqa supports HR and payroll operations, customers may store employment records, compensation data, tax and statutory deduction settings, attendance histories, check-in responses, leave records, bank export preparation data, document acknowledgements, and recruiting submissions. Customers are responsible for ensuring they have a lawful basis to submit that information to Worqa.
We process these records to provide product features requested by the customer, such as calculating payroll inputs, routing approvals, generating reports, managing onboarding, storing policy documents, supporting scheduling flows, and maintaining auditability across workspace actions.
How we use information
We use information to provide and maintain the platform, authenticate users, personalize workspace access based on roles and permissions, deliver notifications, process transactions, secure accounts, prevent abuse, investigate incidents, support integrations, respond to customer requests, and improve product reliability and performance.
We may also use aggregate and de-identified operational insights to understand service health, adoption trends, and feature quality, provided those insights do not identify a specific customer, employee, or applicant.
How information is shared
Worqa shares information only as needed to operate the service, comply with the law, protect rights and safety, or follow a customer’s instructions. This can include infrastructure providers, payment processors, email and messaging vendors, storage providers, security services, analytics tools, and integration partners enabled by the customer.
We do not sell customer data or personal information submitted to Worqa for advertising purposes. Access to workspace information is limited to authorized customer users and authorized Worqa personnel who need that access to support, secure, or maintain the service.
Connected services and third-party integrations
Worqa lets a customer connect optional third-party services to a workspace, such as Google (Google Workspace and Google Calendar), Microsoft 365 (Outlook Calendar), Google Drive, Slack, payment processors, and email delivery providers. These connections are off by default and are enabled by a workspace administrator, who authorizes them through each provider’s standard OAuth consent screen. Only the specific permissions (scopes) shown on that consent screen are requested, and a customer can review or revoke any connection at any time from Settings → Integrations or from the third-party account’s own security controls.
The data Worqa accesses depends on the scopes granted for each connector. Calendar access (Google Calendar or Microsoft 365) is used to read calendars and events and to create meetings, Google Meet or online-meeting links, scheduling holds, and workspace events on the connected calendar. Google Drive access is limited to the per-file scope, so Worqa only sees files a user explicitly opens or creates with Worqa, not the entire Drive. Identity scopes (name and email) are used only to confirm which account is connected. Payment, messaging, and email-delivery connectors receive only the information needed to complete a specific action, such as initiating a charge, delivering a notification, or sending a transactional email.
Information obtained through a connected service is used only to provide the workspace features the customer enabled. It is not sold, is not used for advertising, and is not used to develop, improve, or train generalized or non-personalized machine-learning or AI models. When a connection is revoked, Worqa stops requesting new data from that provider and deletes the stored access tokens for that connection.
Google user data and Limited Use
When a workspace connects a Google account, Worqa requests only the scopes needed for the features that have been enabled: sign-in identity (openid, userinfo.email, userinfo.profile) to confirm which account is connected; Google Calendar (calendar.events) to read calendar events and to create meetings, Google Meet links, scheduling holds, and workspace events; the read-only list of the person’s calendars (calendar.calendarlist.readonly) to show which calendars they can choose to import or add meetings to; and, where a workspace connects Google Drive, the per-file scope (drive.file), which reaches only the files a person opens or creates with Worqa. Worqa does not request access to Gmail.
Assistant and agent features send only the records needed to answer a request to our AI processor, OpenAI, under its API terms, which do not use data submitted through the API to train models. Worqa does not run self-hosted or offline AI models. Google user data is never used by Worqa, or by any AI provider Worqa uses, to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models.
Worqa’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, Worqa uses Google user data only to provide and improve the user-facing features described above; does not transfer Google user data to others except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition with appropriate notice; does not use Google user data for advertising; and does not use Google user data to develop, improve, or train generalized or non-personalized artificial-intelligence or machine-learning models. Any human access to Google user data is prohibited except with the user’s explicit consent, for security purposes such as investigating abuse, to comply with applicable law, or where the data has been aggregated and anonymized for internal operations.
A workspace administrator can disconnect a Google connection at any time from Settings → Integrations, and any user can review or revoke Worqa’s access from the Google Account permissions page at https://myaccount.google.com/permissions. Revoking access stops future data access and removes the stored Google tokens Worqa held for that connection.
Questions about how Worqa accesses, uses, retains, or deletes Google user data — including our compliance with the Google API Services User Data Policy and its Limited Use requirements — can be sent to [email protected].
Cookies, logs, and product diagnostics
We use cookies and similar technologies to keep users signed in, remember preferences, maintain security controls, understand navigation through public pages, and measure the performance of the product. We also maintain logs and audit trails to support fraud prevention, troubleshooting, change history, and platform accountability.
Additional details about cookie categories and browser controls are described in the Cookie Policy.
Retention and deletion
Worqa is built on a continuity-first model: access may change when billing changes, but customer data is not removed without notice. When a paid subscription ends, the workspace may move through a short grace period, a read-only reactivation period, an archived state, and eventually permanent deletion if the account is not restored.
During the first seven days after expiry, the workspace may remain fully available while renewal reminders are sent. After that period, the workspace may become read only so administrators can still review historical records, reports, audit trails, and payroll exports while new operational activity is paused. Around day 61 after expiry, the workspace may be archived. Archived data is retained for a further period before permanent deletion. We issue a final warning before permanent deletion and do not hard delete archived customer data without advance notice.
Some records may be retained longer where required for security, fraud prevention, financial reporting, dispute handling, backup integrity, legal compliance, or other legitimate business continuity needs. Customers are responsible for exporting any records they need to preserve outside the platform before their retention window closes.
Security and access controls
Worqa uses administrative, technical, and organizational safeguards designed to protect information against unauthorized access, disclosure, alteration, and loss. These controls can include encryption in transit, role-based access, session and authentication controls, audit logging, backup procedures, and environment-level operational monitoring.
No system can guarantee absolute security. Customers are responsible for securing their own credentials, assigning appropriate roles, managing connected integrations responsibly, and notifying Worqa promptly about suspected unauthorized access.
International processing and customer instructions
Worqa may process and store information in locations where our infrastructure, support personnel, or service providers operate. Where cross-border transfers occur, we use appropriate contractual, technical, and organizational measures suitable for the nature of the processing.
Customers remain responsible for providing required notices to their users and workforce, obtaining necessary permissions, and configuring the platform in a manner that aligns with their legal and compliance obligations.
Your choices and contact
Customers can update workspace records, adjust user access, configure notifications, manage integrations, renew subscriptions, and request assistance with account data through the platform and support channels. Individuals should generally direct privacy requests to the company that controls their workspace data, since that organization determines how the information is used.
Questions about this Privacy Policy, retention, reactivation, deletion handling, or Worqa’s privacy practices can be sent to [email protected]. We may update this policy from time to time, and the current version will always display its latest effective date on this page.
