Privacy Policy

Who we are

Worklexia is the service at https://worklexia.com. It helps organizations work through cross-border employment rules in the European Union and the United Kingdom. In this policy, “we”, “us”, and “Worklexia” mean the operator of that service.

Questions about this policy or your personal data: privacy@worklexia.com.

What this policy covers

This policy describes how we handle personal data when you visit the public site, create an account, sign in (including with Google, LinkedIn, or Slack), join an organization, upload documents, ask Advisory questions, or pay for a plan.

It is written for the people who use the product (members, admins, consultants, and staff) and for visitors who only read public pages. It is not a contract. The Terms of Service cover use of the service.

Personal data we collect

We collect only what we need to run the account, the organization, billing, and the product:

• Account: name, email address, locale, hashed password if you set one, and sign-in method.
• Sign-in with Google, LinkedIn, or Slack: the name, email address, and basic profile the provider shares with us after you consent. We do not receive your provider password. We do not store the provider’s access token for later API use.
• Organization: organization name, home country, currency, memberships, roles, and invitation emails.
• Workspace content you or your teammates submit: documents, Advisory questions and answers, citations, and related activity in that organization.
• Billing: plan, seat and usage meters, and the customer records Stripe needs. We do not store card numbers.
• Technical: security logs (for example IP address and user agent on privileged actions), cookie-based session data, and error reports.

How we use personal data

• Create and authenticate your account, including Sign in with Google, LinkedIn, or Slack.
• Invite teammates, enforce roles, and keep work inside the right organization.
• Provide Advisory answers, document storage, and other product features you use.
• Process subscriptions, trials, invoices, and entitlement limits through Stripe.
• Send transactional email (invites, verification, password reset, billing notices).
• Keep the service secure, debug faults, and meet legal obligations.

We do not sell personal data. We do not use Google, LinkedIn, or Slack profile data for advertising. We do not use your workspace content to train public models.

Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract (providing the service you signed up for); legitimate interests (security, product reliability, and communicating about the account); consent (optional social sign-in, and any optional cookies if we add them later); and legal obligation (tax, accounting, and responding to lawful requests).

Sign in with Google, LinkedIn, or Slack

Social sign-in is optional. You can also create an account with email and a password. When you choose a provider, that provider authenticates you and sends us the identity data listed above so we can create or recognize your Worklexia account.

You can stop using a provider later by adding a password and unlinking that method in Settings → Profile, or by deleting your account. Google’s own policy is at https://policies.google.com/privacy.

An invitation must be accepted with the same email address it was sent to. Signing in with a different Google, LinkedIn, or Slack email will not join that organization.

Cookies and sessions

We use httpOnly, Secure, SameSite cookies to keep you signed in. The session is managed by our authentication provider (Supabase Auth). Access tokens are not stored in localStorage or in cookies the page can read.

These cookies are necessary to sign in and stay signed in. The public Privacy Policy and Terms pages do not set an account session.

Who else sees data

We use processors to run the product. They see only what they need:

• Supabase (database, authentication, file storage) in the EU (Frankfurt).
• Railway (application and background workers) in the EU (Amsterdam).
• Vercel (the website). Dynamic, data-bearing rendering runs in Frankfurt; static assets may be served from a global CDN.
• Stripe (payments), under Stripe’s own data-processing terms. We never hold card data.
• Brevo (transactional email), under a signed DPA.
• Sentry (error tracking) in the EU.
• AI inference providers, only when you use Advisory, routed to EU data centres with zero-data-retention routing.
• Google, LinkedIn, or Slack, only if you choose that sign-in method — they see the sign-in event, not your workspace documents.

People in your organization can see what the product already shows them (for example names of teammates, shared Advisory threads, and documents). We do not claim that no data ever leaves the EU: payments, global CDN edges, and some sign-in providers are worldwide.

Where customer content is stored

Customer content — database records, uploaded documents, embeddings, and conversation history — is stored and processed in the EU (Frankfurt and Amsterdam). AI inference for Advisory is pinned to EU data centres and fails closed rather than running elsewhere.

How long we keep data

Account and organization data stay while the account or organization is active. Documents follow the retention rules you (or we) set for that file or organization, including legal hold where that feature applies. Billing records are kept as long as tax and accounting rules require. Security logs are kept only as long as needed for security and audit. When you delete an account or we close an organization, we delete or irreversibly anonymize personal data that we no longer need, except where the law requires us to keep it.

Your rights

If the GDPR or UK GDPR applies, you can ask us to access, correct, delete, or export your personal data, or to restrict or object to certain processing. You can also withdraw consent for optional sign-in methods. Write to the contact email above. You may lodge a complaint with your supervisory authority (for example the AEPD in Spain, the CNIL in France, or the ICO in the United Kingdom).

Organization admins manage teammate access. If your data lives in an employer’s Worklexia organization, we may need to involve that organization when you exercise your rights.

Children

Worklexia is a workplace tool. It is not directed at children. You must be 18 or older to create an account.

Changes

We will update this page when our practices change and set a new “Last updated” date. The current version is always at https://worklexia.com/privacy.