Privacy Policy

1. Who We Are

Worqlo SHPK (translated as Worqlo Limited), referred to in this Privacy Policy as “Worqlo,” “we,” “us,” or “our,” provides an AI-assisted conversational workflow and data integration platform.

This Privacy Policy explains how we collect, use, disclose, store, and protect personal information when you visit our website, create or use a Worqlo account, connect third-party services, or otherwise interact with us.

For privacy questions, contact us at info@worqlo.com.

2. Scope and Our Role

This Privacy Policy applies to Worqlo’s public website and hosted application.

Worqlo generally acts as a data controller for website visitors, account details, billing administration, security records, and direct communications with us.

When an organization uses Worqlo to process information from its connected systems, files, databases, or workflows, that organization normally determines why and how the information is processed. In those circumstances, the organization is the controller and Worqlo acts as its processor or service provider under the applicable agreement.

If your Worqlo account is provided by your employer or another organization, that organization may administer your account and control the information processed through it. Requests concerning organization-controlled information should normally be directed to that organization.

3. Information We Collect

3.1 Account and profile information

We may collect:

• Your first and last name.
• Email address, job title, organization, and role.
• Account, tenant, subscription, and access permissions.
• Password hashes, authentication tokens, session information, and multi-factor authentication information.
• Communication preferences and information you provide in support requests.

3.2 Customer content

“Customer Content” means information submitted to, generated through, or made available to Worqlo by you or your organization. It may include:

• Chat messages, prompts, instructions, responses, and conversation history.
• Data retrieved from connected applications, databases, and services.
• Uploaded documents, spreadsheets, images, presentations, and attachments.
• Extracted document text, document chunks, and vector embeddings used for knowledge-base search.
• Workflow definitions, schedules, execution history, inputs, outputs, and approval decisions.
• Notebooks, reports, charts, tables, summaries, and generated documents.
• Email content, recipients, and attachments when you direct Worqlo to prepare or send an email.
• Comments, feedback, and other information you submit to the service.

3.3 Connected-service information

When you or your organization connects a third-party service, Worqlo may process:

• OAuth tokens, API keys, database credentials, connection settings, and service identifiers.
• Records that the connected account or database permits Worqlo to access.
• Schema, table, field, page, workspace, project, and other structural metadata.
• Synchronization checkpoints, webhook events, change events, and workflow triggers.

Supported connections may include Google Workspace, HubSpot, Salesforce, Notion, Jira, Odoo, CSV files, PostgreSQL, MySQL, SQL Server, SAP HANA, and other customer-configured or remotely connected data sources.

The information accessed depends on the connection, permissions, and queries configured by you or your organization.

3.4 Usage, device, and security information

When you use Worqlo, we may automatically collect:

• IP address, browser type, device type, operating system, and request timestamps.
• Pages, features, connectors, and tools used.
• Authentication attempts, session activity, and rate-limit events.
• Application logs, error records, performance data, and diagnostic traces.
• Tool-call counts, AI usage, model usage, latency, and associated cost information.
• Audit records, security events, suspected abuse, and anomalous access patterns.

3.5 AI safety and feedback information

To operate and secure AI-assisted features, we may process moderation results, safety categories, limited text previews of flagged output, user feedback, tool activity, and hashes or metadata associated with AI activity.

Where enabled, selected assistant outputs may be retained for safety monitoring and human review. Access is limited to authorized personnel with a legitimate operational, security, or compliance need.

3.6 Billing information

If you purchase a paid service, we may process your plan, payment status, invoice amounts, billing dates, and identifiers supplied by a payment provider. Payment card details are normally collected directly by the payment provider and are not stored by Worqlo unless expressly stated at checkout.

4. How We Use Information

We use information to:

• Create, authenticate, administer, and secure accounts.
• Provide AI chat, connected-data queries, knowledge-base search, workflows, notebooks, reports, and document-generation features.
• Connect to third-party services at your direction.
• Execute user-requested actions and scheduled workflows.
• Store conversation history and product outputs so they remain available to authorized users.
• Provide customer support and troubleshoot errors.
• Send account, verification, security, workflow, and service communications.
• Measure usage, allocate costs, enforce quotas, and administer subscriptions.
• Detect fraud, abuse, unauthorized access, and security threats.
• Maintain audit trails and meet legal or regulatory obligations.
• Improve the reliability, safety, accessibility, and user-facing functionality of Worqlo.

We do not sell Customer Content or use it for targeted advertising.

5. Artificial Intelligence

Worqlo uses artificial intelligence and machine-learning systems to understand requests, retrieve information, generate answers, create reports, operate workflows, and provide other user-facing features.

When you use an AI-assisted feature, Worqlo may send your prompt and the portions of Customer Content needed to complete your request to an AI model. Depending on your organization’s configuration, that model may be:

• Hosted by Worqlo.
• Hosted within your organization’s or an on-premises environment.
• Provided by a third-party AI provider acting as a subprocessor.

Knowledge-base document text and search queries may also be sent to an embedding provider to generate numerical vector representations used for retrieval.

Worqlo does not use Google Workspace API data to train or improve generalized or non-personalized AI or machine-learning models. Additional restrictions concerning Google user data appear in Section 6.

Worqlo does not use solely automated processing to make decisions that produce legal or similarly significant effects concerning individuals.

6. Google User Data

This section applies when you connect Gmail, Google Calendar, or Google Sheets to Worqlo.

Worqlo’s use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

6.1 Google data we access

You choose which Google services to connect. Worqlo currently requests read-only access:

• Gmail: messages, threads, labels, drafts, senders, recipients, timestamps, message bodies, attachments, and related metadata accessible to the connected account.
• Google Calendar: calendars, events, titles, dates, attendees, descriptions, and related metadata accessible to the connected account.
• Google Sheets: spreadsheet identifiers, sheet structure, named ranges, cell values, and related metadata for spreadsheets you connect.
• Connection information: Google account or mailbox identifiers and OAuth tokens needed to maintain the connection.

Worqlo does not request permission to write, send, alter, or delete Gmail, Google Calendar, or Google Sheets content.

6.2 How we use Google data

We use Google user data only to provide or improve user-facing features that you or your organization request, including:

• Searching, retrieving, filtering, and summarizing relevant information.
• Answering questions about connected Gmail, Calendar, or Sheets data.
• Running workflows and triggers configured by authorized users.
• Displaying requested results in conversations, tables, reports, notebooks, or generated documents.
• Maintaining, securing, and troubleshooting the connected feature.

6.3 AI and Google user data

When you request an AI-assisted feature that requires Google data, Worqlo may send only the relevant retrieved content to an AI provider acting as our subprocessor, solely to produce the response or action you requested.

Worqlo does not use or transfer data obtained through Google Workspace APIs to develop, improve, or train generalized or non-personalized AI or machine-learning models.

Google user data is not placed in shared model-training datasets or used to train foundational models.

6.4 Prohibited uses

We do not use or transfer Google user data for:

• Advertising, retargeting, or interest-based advertising.
• Sale to data brokers or information resellers.
• Credit-worthiness, lending, or insurance decisions.
• Creating databases unrelated to Worqlo’s user-facing functionality.
• Training generalized or non-personalized AI or ML models.

6.5 Storage, sharing, and human access

Worqlo stores OAuth credentials and connection records while necessary to operate the integration. Requested Google content may appear in chat history, workflow records, reports, notebooks, or other outputs created at your direction.

Google user data may be processed by cloud infrastructure, AI, security, logging, and operations providers acting on Worqlo’s behalf and only as needed to provide or secure the requested feature.

Human access is limited to cases where it is necessary for security, legal compliance, operation of the service, or support requested or authorized by you.

6.6 Disconnecting and deleting Google data

When a Google connection is disconnected, Worqlo stops using that authorization to access new Google data and disables the associated credentials.

Information already included in conversations, workflows, reports, or other records is retained and deleted according to Section 11 or upon a valid deletion request, unless retention is required by law or for legitimate security purposes.

You may request deletion by emailing info@worqlo.com. You may also revoke Worqlo’s authorization through your Google Account permissions.

7. Cookies and Local Storage

Worqlo uses cookies and similar browser storage for:

• Authentication, session management, and security.
• Short-lived registration or invitation flows.
• Remembering interface preferences such as sidebar state, theme, and layout.
• Measuring performance and usage where analytics are enabled.

Necessary cookies are required for the service to function. Where required by law, optional analytics or similar cookies will be used only after obtaining consent.

You can control cookies through your browser settings. Blocking necessary cookies may prevent account or application features from working correctly.

8. Legal Bases for Processing

Where the GDPR, UK GDPR, or similar law applies, we rely on one or more of the following legal bases:

• Contract: processing necessary to provide the service you or your organization requested.
• Legitimate interests: securing, operating, supporting, and improving Worqlo, provided those interests are not overridden by your rights.
• Consent: where you authorize an optional integration, marketing communication, or non-essential cookie.
• Legal obligation: where processing is required to comply with applicable law.

Where Worqlo acts as a processor, the relevant customer is responsible for establishing the legal basis for processing Customer Content.

9. How We Share Information

We may disclose information to:

• Cloud and infrastructure providers used for application hosting, databases, object storage, networking, backups, and caching.
• AI and embedding providers used to complete the AI-assisted request you or your organization initiated.
• Connected services when Worqlo communicates with those services at your direction.
• Email providers used for account notices and user-directed email actions.
• Observability, logging, and security providers used to monitor reliability, usage, and threats.
• Search and content-rendering providers when you request web search, charts, or generated documents that require those services.
• Payment providers when purchasing a paid plan.
• Professional advisers and authorities where necessary for legal, accounting, security, or compliance purposes.
• A successor organization as part of a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.

Service providers may process information only to provide services to Worqlo and subject to applicable contractual and confidentiality obligations.

We do not sell personal information or share it for cross-context behavioral advertising.

10. International Transfers

Depending on the deployment selected by your organization and the service providers used, information may be processed outside your country.

Some customers may use on-premises or customer-controlled infrastructure, while others may use cloud-hosted services.

Where required, Worqlo uses lawful safeguards for international transfers, such as adequacy decisions, standard contractual clauses, or another recognized transfer mechanism.

11. Retention and Deletion

We retain information only for as long as needed for the purposes described in this policy, our agreements, security requirements, and applicable law.

• Accounts and profiles: retained while the account is active and afterward for the period needed for administration, disputes, security, and legal obligations.
• Sessions: ordinary application sessions may remain active for up to seven days unless they expire or are revoked sooner.
• Conversations and outputs: retained while available in the account or organization workspace, until deleted or the applicable customer retention schedule expires.
• Temporary AI runtime checkpoints: normally retained for up to 30 days.
• Uploaded files and knowledge-base content: retained until deleted by an authorized user, the associated service is terminated, or the applicable customer retention schedule expires.
• Integration credentials: retained while needed to operate the connection and disabled when the connection is removed or authorization is revoked.
• Workflow and audit records: retained according to the organization’s configured retention period and any legal or security requirements.
• Billing and transaction records: retained for the period required by accounting, tax, and other applicable laws.
• Backups: deleted through the normal backup lifecycle unless preservation is required by law or for security.

Deletion may involve removing, anonymizing, or isolating information from active systems. Limited records may be retained where required for legal compliance, fraud prevention, dispute resolution, or security.

To request account or personal-data deletion, email info@worqlo.com.

12. Security

Worqlo uses administrative, organizational, and technical measures designed to protect information, including:

• Encryption in transit.
• Encrypted storage for integration credentials and sensitive connection settings.
• Authentication, authorization, and tenant-isolation controls.
• Access logging, audit trails, rate limiting, and security monitoring.
• Restricted personnel access based on operational need.
• Secrets management and controls designed to prevent credentials from appearing in user-facing responses.

No service can guarantee absolute security. You are responsible for protecting your credentials and promptly notifying us if you suspect unauthorized account access.

13. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• Request access to personal information concerning you.
• Correct inaccurate or incomplete information.
• Request deletion of your information.
• Restrict or object to certain processing.
• Receive certain information in a portable format.
• Withdraw consent where processing relies on consent.
• Object to direct marketing.
• Complain to your local data-protection authority.

To exercise these rights, contact info@worqlo.com. We may need to verify your identity and authority before fulfilling a request.

If the information is controlled by your employer or another Worqlo customer, we may refer your request to that organization.

EEA residents may complain to the supervisory authority in their country of residence, place of work, or where an alleged infringement occurred.

14. Service Communications and Marketing

We may send necessary account, verification, security, support, and service communications. You cannot opt out of communications necessary to operate or secure your account.

Where we send optional marketing communications, you may unsubscribe using the link in the message or by contacting us.

15. Children’s Privacy

Worqlo is intended for business use and is not directed to children under 16. We do not knowingly collect personal information from children under 16. If we learn that such information has been collected, we will take appropriate steps to delete it.

16. Changes to This Policy

We may update this Privacy Policy to reflect changes in our services, legal requirements, or data-handling practices.

We will publish the revised policy on this page and update the Effective Date. Where required, we will provide additional notice of material changes through the application, by email, or through another appropriate channel.

17. Contact Information

Worqlo SHPK (translated as Worqlo Limited)
Website: worqlo.com
Email: info@worqlo.com