Who this covers
This policy explains how WorkHub handles personal information about:
- people who use a WorkHub workspace (owners, staff, managers, guests and client contacts);
- people who visit our website or join our beta waitlist.
For information inside a workspace, the company that owns the workspace decides what is collected and why; WorkHub handles it on that company's behalf. Questions about a workspace's data are best sent to that company first.
For the lawyer: confirm the controller/processor wording that fits Pakistani law, and the GDPR if we sign up EU customers later.
What we collect
Your account
- Name, email address, password (stored only as a one-way hash), and your Google account ID if you sign in with Google.
- Two-factor sign-in secrets, stored encrypted, and recovery codes, stored as one-way hashes.
- Sign-in sessions, with the IP address and browser they came from.
Attendance
- Check-in, check-out and break times.
- A selfie at check-in or check-out, if the workspace turns this on. Selfies are deleted automatically after 30 days.
- Your location at check-in (a GPS position) and the network address you checked in from, if the workspace uses office zones. This is used to check whether you were at an office.
- Times recorded by a fingerprint device, if the workspace imports them.
Your work
- Leave requests, timesheets, tasks, comments, files you upload, chat messages and announcements.
- CRM records such as leads, contacts and companies, including any notes and custom fields the workspace adds.
- Quotes, invoices and billing details, including the workspace's tax number if it enters one.
Using the service
- An audit log of important changes in a workspace (who did what, and when, and from which IP address).
- Feedback you send us, with the page you were on and your browser, so we can reproduce problems.
- Basic product usage events, such as "created a project", tied to your account and workspace IDs. These are only sent if we turn product analytics on.
Our website
- If you join the beta waitlist: your name, email, company, team size, the answers you give about your current tools and problems, and the IP address you signed up from.
For the lawyer: add anything collected for payments once a card provider is chosen.
Why we use it
- To run the service: sign you in, show your workspace, and do what you ask.
- To keep it secure: spot misuse, enforce limits, and investigate problems.
- To send emails you need, such as invitations, password resets, reminders and invoices.
- To understand which features are used, so we can improve them.
- To bill for paid plans and meet tax and accounting rules.
We don't sell personal information, and we don't use workspace data to show ads.
For the lawyer: list the legal basis for each use, if required.
Who we share it with
Only with services that help us run WorkHub, and only what they need:
- Render: hosting for the app and API.
- Neon: the database.
- Cloudflare (R2): file storage for uploads and selfies.
- Resend: sending email, once set up.
- PostHog: product analytics, only if turned on.
- Google: if you choose to sign in with Google.
- A payment provider (such as Safepay or PayFast), once card payments are available.
We may also share information if the law requires it.
For the lawyer: confirm where each provider stores data (some are outside Pakistan), and what we must say about transfers abroad.
How long we keep it
- Selfies: 30 days, then deleted automatically.
- Other workspace data: for as long as the workspace exists.
- Invoices and payment records: as long as tax law requires.
For the lawyer: set the retention period after a workspace is closed, and for backups.
Security
- Every workspace's data is separated at the database level, so one company can't see another's.
- Passwords are hashed; two-factor secrets are encrypted.
- Connections use HTTPS, and files are downloaded through short-lived private links.
Your choices
- You can see and change your own details in the app.
- Your workspace's owner or admins can export workspace data, and remove people, records and files.
- You can ask us for a copy of your information, or to correct or delete it, by emailing [email address]. To close a whole workspace and delete its data, the owner emails us; there's no button for this yet.
For the lawyer: list the rights people have under applicable law, and how quickly we must reply.
Children
WorkHub is for businesses and isn't meant for anyone under 18.
Changes to this policy
If we make important changes, we'll tell workspace owners by email and in the app.
Contact
Privacy questions: [email address], [postal address].