Privacy Policy

1. Introduction

WorkFlowHQ ("we", "us", "our") operates the workflowhq.net platform and related services. This Privacy Policy explains how we collect, use, store, and dispose of your personal and business data when you use our services.

2. Information We Collect

We collect the following categories of information:

• Account information: Name, email address, company name, billing address, and state.
• Billing data: Payment method details are processed securely by our payment providers (Stripe, PayPal, Razorpay). We store only the card brand, last four digits, and expiration date for display purposes.
• Tenant data: All data created within your workspace — including clients, tasks, documents, invoices, and staff records.
• Usage data: Server logs, IP addresses, browser type, and system events for security and operational monitoring.

2a. US Accounting & Tax Compliance Notice

WorkFlowHQ provides practice management infrastructure to accounting and tax professionals. Where Tenant inputs client tax data subject to US Internal Revenue Code (IRC) Section 7216 or financial data governed by the FTC Safeguards Rule, Tenant remains strictly responsible for obtaining all required written client consent disclosures prior to uploading or processing such data on the platform.

3. Use of Calendar & Video Conferencing Data (Google, Outlook & Zoom)

WorkFlowHQ enables voluntary integrations with Google Calendar, Microsoft Outlook Calendar, and Zoom Meetings. Data accessed via these integrations is handled as follows:

• Google Calendar & Microsoft Outlook Calendar: After explicit user authorization via OAuth, we access calendar data solely to display availability and create, update, or delete events initiated inside WorkFlowHQ. Calendar data is isolated per user, not shared across tenants, and never used for advertising or model training. Access can be revoked at any time via WorkFlowHQ settings or your Google/Microsoft account permissions page.
• Zoom Meetings: When connected via Zoom OAuth, WorkFlowHQ accesses your Zoom account strictly to schedule video meetings, generate meeting URLs, and display meeting status within your tasks and client portal. Zoom access credentials and meeting links are stored securely and never shared with third parties. Access can be revoked at any time by disconnecting Zoom in WorkFlowHQ or via the Zoom App Marketplace.

3a. How We Use Google User Data

WorkFlowHQ integrates with Google Calendar to provide online scheduling features. When a staff member connects their Google Calendar account, our application requests access to the following minimum necessary scopes to implement specific production features:

Principle of Least Privilege: We request only the most granular, restricted scopes needed for each feature. We do not access calendar metadata, settings, ACLs, secondary calendars, or any data outside of events on the primary calendar and busy/available status.

4. Third-Party API Compliance & Limitations

WorkFlowHQ’s use and transfer of information received from third-party APIs (Google, Microsoft, Zoom) strictly adheres to their respective developer policies, including the Google API Services User Data Policy and Microsoft / Zoom Developer Terms. Connecting third-party calendar or video accounts is completely optional and disabled by default.

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

5. How We Use Your Data

We use collected data to:

• Provision and maintain your isolated tenant workspace.
• Process subscriptions, generate invoices, and manage billing.
• Send transactional alerts, system notices, and payment receipts.
• Provide customer support and monitor platform security.

We do not sell, rent, or trade personal data or tenant records with third parties for marketing purposes.

6. Data Storage & Cross-Border Transfers

Your personal and workspace data is processed by our administrative and engineering teams in India and securely stored in professional datacenter facilities in Helsinki, Finland. By using the Service, US clients acknowledge and explicitly consent to the cross-border processing and storage of workspace data on our encrypted cloud infrastructure. Each tenant’s data is logically isolated in an independent database.

7. Data Retention

Data is retained for as long as your account is active and your subscription remains in good standing:

• Active accounts: All workspace data is retained and accessible throughout your subscription period, including during free trials.
• Cancelled accounts: Upon cancellation, data remains accessible until the end of the paid billing period, after which the account enters an inactive state.
• Past-due accounts: Unpaid accounts enter a 7-day grace period followed by suspension if unresolved.

8. Account Termination & Data Disposal

When an account is terminated due to cancellation, non-payment, or administrative action, we follow this disposal process:

1. Immediate suspension: Access to the workspace is revoked. Staff and admin users can no longer sign in.
2. 30-day retention window: Terminated data is retained for 30 calendar days in an inaccessible state to allow for potential account reactivation.
3. Permanent deletion: After 30 days, the tenant database, uploaded files, and tenant subdomains are permanently and irreversibly deleted from our servers.
4. Master records retained: Minimal records (tenant name, email, subscription history, and invoice records) are retained for 7 years as required by tax and financial regulations.

US State Law Threshold Notice: WorkFlowHQ is a B2B platform operating from India. WorkFlowHQ is currently exempt from US state consumer privacy laws (such as CCPA) as we do not meet statutory revenue or consumer data volume thresholds. We monitor traffic thresholds continuously and will update this policy if regulatory triggers are met.

9. Your Rights & CAN-SPAM Act Compliance

You have the right to access, correct, or export your workspace data while your account is active. All commercial and transactional emails sent by WorkFlowHQ comply strictly with the US CAN-SPAM Act. You may opt out of marketing communications at any time by clicking the "Unsubscribe" link in any promotional email or contacting [email protected]. Operational transactional alerts are excluded from opt-out privileges.

10. Third-Party Service Providers

We share necessary minimal data with PCI-compliant payment gateways to process transactions:

• Stripe: Payment processing.
• PayPal: Payment processing.
• Razorpay: Payment processing.
• Wise (ACH): Payment processing.

11. Artificial Intelligence (AI) Features & Dual-Engine System

WorkFlowHQ offers a dual-engine AI system:

• Local AI (default): AI processing occurs entirely on WorkFlowHQ’s own servers. No document text or tenant data is transmitted to external providers.
• Cloud AI (optional, opt-in): When explicitly enabled by the firm owner in Settings → AI, plain-text document extracts are transmitted to our cloud AI provider (currently Google Gemini).

Standard Tier Warning & Risk Assumption: WorkFlowHQ utilizes standard non-enterprise developer APIs for Cloud AI integrations. WorkFlowHQ does not control third-party AI provider data retention or model training policies once text leaves our platform. Activating Cloud AI is done at your own risk. You may switch back to 100% Local AI at any time from Settings → AI.

12. Cookies

We use essential session and security cookies to operate the platform. For details, please view our Cookie Policy.

13. Contact Us

If you have questions about this Privacy Policy, please contact our privacy team at [email protected] or [email protected].