Legal
Privacy Policy
Effective: February 19, 2026
Last updated: February 19, 2026
The Short Version
- •We collect only what we need to provide the service — your account info, the business data you enter, and basic usage analytics.
- •We never sell your data. Not to advertisers, not to data brokers, not to anyone.
- •Third-party services: Stripe handles payments, OpenAI handles AI features (with your API key). That's it.
- •You control your data. You can access, export, or delete your data at any time.
- •Your clients' payment info never touches our servers. Stripe handles all card processing directly.
1. Who We Are
WorkCentral is a project management and invoicing platform for freelancers, agencies, and consultants. This policy explains how we handle your information when you use our platform at app.workcentral.app and our marketing site at www.workcentral.app.
2. What We Collect
Information you provide directly
- Account information: Name, email address, password (hashed, we never store it in plain text)
- Business information: Organization name, business details, logo, contact information
- Client data: Client names, email addresses, and contact information you enter
- Business content: Quotes, projects, tasks, time entries, invoices, expenses, and notes you create
- OpenAI API key: If you use AI features, stored encrypted in our database
- Payment information: When you subscribe to a paid plan, payment details are collected and processed by Stripe — we store only a reference to your Stripe customer ID, not your card details
Information collected automatically
- Usage data: Pages visited, features used, and general interaction patterns (to help us improve the product)
- Device and browser information: Browser type, operating system, screen resolution
- IP address: Used for security, abuse prevention, and approximate location for regional features
- Cookies: Session cookies to keep you logged in, and preference cookies to remember your settings
Information we do NOT collect
- Your clients' credit card or bank account numbers (Stripe handles this entirely)
- Your OpenAI API key in plain text (it's encrypted at rest)
- Data from your other accounts or services (we don't scrape or import from external sources)
- Biometric data, precise location data, or contact lists from your devices
3. How We Use Your Information
We use your information for these purposes and no others:
- Providing the service: Displaying your data, generating quotes, creating invoices, tracking time, managing projects
- Account management: Authentication, password resets, subscription billing
- Communication: Service notifications (invoice reminders, payment confirmations), important updates about the platform, and responses to your support requests
- Improvement: Understanding how people use WorkCentral so we can make it better — we look at aggregate patterns, not individual user behavior
- Security: Detecting and preventing fraud, abuse, and unauthorized access
We do not use your data for advertising. We do not build behavioral profiles. We do not sell, rent, or share your personal information with third parties for their marketing purposes.
4. Third-Party Services
We use a small number of third-party services to operate WorkCentral. Here's exactly who they are and what they do:
Stripe
Purpose: Subscription billing (your WorkCentral plan) and payment processing (your clients paying invoices via Stripe Connect)
Data shared: Your email and billing information for subscriptions. For client payments, Stripe handles the entire transaction — card data goes directly from your client to Stripe, never through our servers.
Their policy: stripe.com/privacy
OpenAI
Purpose: AI-powered quote generation, task breakdown, and description improvement
Data shared: When you use AI features, the project description, budget range, timeline, and requirements you enter are sent to OpenAI's API using your personal API key. We do not send client names, email addresses, or other personally identifiable information to OpenAI.
Your control: AI features are entirely optional. You choose when to use them. You provide and manage your own API key.
Their policy: openai.com/policies/privacy-policy
Hosting & Infrastructure
Purpose: Hosting the application and database
Your data is stored on servers we manage. We use standard security practices including encrypted connections (HTTPS/TLS), encrypted data at rest, and regular backups.
That's the complete list. We don't use advertising networks, tracking pixels from social media companies, or third-party analytics platforms that sell data.
5. Cookies
We use cookies sparingly and only for functional purposes:
- Session cookies: Keep you logged in while you use the platform. These expire when you close your browser or after a set period.
- Preference cookies: Remember your settings (like timezone or display preferences).
- Security cookies: CSRF tokens and other security measures to protect your account.
We do not use advertising cookies, tracking cookies, or third-party cookies for behavioral profiling.
6. Data Security
We take reasonable measures to protect your data:
- All connections use TLS/HTTPS encryption
- Passwords are hashed using industry-standard algorithms (bcrypt)
- OpenAI API keys are encrypted at rest
- Two-factor authentication is available on all accounts
- Role-based access controls for team accounts (Business plan)
- Regular database backups
No system is 100% secure. If we ever discover a breach that affects your data, we will notify you promptly and take immediate steps to address it.
7. Your Rights
Regardless of where you're located, we believe you should have control over your personal information. You have the right to:
- Access your data: You can view all the data you've entered in WorkCentral at any time through the platform
- Export your data: You can export your data from the platform
- Correct your data: You can update any information in your account at any time
- Delete your data: You can request complete account and data deletion by contacting us
- Withdraw consent: You can stop using optional features (like AI) at any time, and you can unsubscribe from non-essential emails
To exercise any of these rights, email privacy@workcentral.app. We'll respond within 30 days.
For California Residents (CCPA)
Under the California Consumer Privacy Act, you have additional rights including the right to know what personal information we collect and how we use it, the right to request deletion, and the right to non-discrimination for exercising your privacy rights. We do not sell personal information as defined by the CCPA.
For European Users (GDPR)
If you're in the European Economic Area, your rights also include data portability and the right to restrict processing. Our legal basis for processing your data is: (a) performance of our contract with you (providing the service), (b) our legitimate interests (improving the platform, preventing fraud), and (c) your consent (for optional features like AI and marketing emails).
8. Data Retention
We retain your data for as long as you have an active account. If you delete your account:
- Your personal information and business data will be deleted within 30 days
- Backups containing your data are overwritten on a rolling schedule
- We may retain anonymized, aggregated data that cannot identify you (e.g., "X users created quotes this month")
- We may retain transaction records as required by law (financial record-keeping obligations)
9. Children's Privacy
WorkCentral is a business tool. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, please contact us and we'll remove it promptly.
10. Changes to This Policy
We may update this privacy policy as our practices evolve. When we make meaningful changes, we'll notify you via email or an in-app notice. We won't retroactively reduce your privacy protections without your consent.
11. Contact
Questions about how we handle your data? We're happy to explain.
Privacy inquiries: privacy@workcentral.app
General support: support@workcentral.app