Privacy Policy

• Contact details you give us - name, work email, phone number, and company when you book a demo, request a call, or create an account.
• Call data - when an AI agent makes or answers a call, we process the audio, a transcript, and a short automated summary and sentiment so our customers can review their calls.
• Account and billing data - login identity, organization details, plan, and payment status. Card and banking details are handled by our payment providers and never touch our servers.
• Usage data - pages visited, device and browser type, and IP-derived country (used, for example, to show prices in your currency).

• To provide the service: placing and answering calls, producing transcripts and summaries.
• To respond when you ask us to contact you, including the live demo call you request on this site.
• To bill for usage, prevent abuse, and keep the platform secure.
• To improve our agents and website. We do not sell personal data to anyone.

A business using WorkflowHQ can connect its Facebook Page, Instagram professional account or WhatsApp Business number so its AI agent answers messages there. Where that happens we act on that business’s behalf, and the business remains responsible for the conversation.

• What we receive.The messages sent to and from the connected account, the sender’s display name and platform-scoped ID, profile picture where the platform provides it, and the timestamps. For WhatsApp, the phone number the person messaged from.
• Why.Only to deliver the message to the agent, generate a reply, show the conversation in that business’s shared inbox, and keep a record they can search.
• What we never do. We do not use this data for advertising or ad targeting, we do not sell or rent it, we do not combine it across unrelated businesses, and we do not use it to train or improve any AI or machine learning model.
• Retention and deletion.Messages are kept under the connected business’s account and are deleted when they delete them or close the account. Disconnecting the channel revokes our access and deletes the stored access tokens. See our data deletion instructions for how to request removal.

WorkflowHQ’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

We do not use Google Workspace data to develop, train, improve, or fine-tune any artificial intelligence or machine learning model, whether foundational, generalized, or our own, and we do not transfer or sell it to anyone who would.

• What we access. Only when you connect your own Google account: Google Calendar, to see which calendars you have, check when you are busy, and create, update or cancel the appointments your agent books; and Google Sheets, to read or write rows in the specific spreadsheet you select in an automation.
• Why. Solely to perform the actions you configure. We do not read the contents of unrelated events, files, or spreadsheets, and we do not build profiles from your calendar.
• AI processing. Where information from these APIs appears in a conversation, for example an available appointment slot your agent offers a caller, it is sent to our language model provider only to produce that reply. It is not retained for training by us or by them.
• Human access. Nobody at WorkflowHQ reads your Google data except when you explicitly ask us to help with a support request, where required to investigate a security incident, or where the law requires it.
• Removing access. Disconnecting the account in Settings deletes our stored credentials for it immediately, and you can also revoke access at any time from your Google Account permissions page.

• In transit. All traffic to and from our services runs over TLS (HTTPS).
• At rest. Sensitive credentials, including Google OAuth access and refresh tokens and the keys you enter for other connected services, are encrypted with AES-256-GCM before they are written to the database, and are decrypted only in memory at the moment a request needs them. Our managed Postgres database and our backup storage are themselves encrypted at rest.
• Separation.Every record is scoped to the organization that owns it and every request is authorized against that organization, so one customer’s data is never served to another.
• Access control. Secrets live in the deployment environment, never in source code. Server-to-server endpoints require a shared secret, and staff access to production is limited to the people who need it to operate the service.
• Deletion. Disconnecting an integration deletes its stored credentials, and closing your account removes your data as described under Data retention.

No system is perfectly secure. If you believe you have found a vulnerability, please write to hello@workflowhq.co and we will respond promptly.

Calls handled by WorkflowHQ agents may be recorded and transcribed to deliver the service. Where our customers use WorkflowHQ to call their own users, the customer is responsible for having a lawful basis and providing any notice or consent required in their jurisdiction.

We rely on a small set of infrastructure providers to run the service, including cloud hosting (Vercel, Railway, Neon), real-time voice infrastructure (LiveKit), speech and language providers (Deepgram, Sarvam, OpenAI, Cartesia), authentication (Clerk), and payments (Razorpay for India, Stripe elsewhere). Each processes data only to provide their service to us.

We use a small number of cookies and similar technologies: strictly necessary cookies for sign-in and security, and basic analytics to understand how the site is used. We do not use third-party advertising cookies. You can control cookies through your browser settings; blocking essential cookies may prevent sign-in from working.

We keep personal data for as long as needed to provide the service and meet legal obligations. Call transcripts and recordings are retained under the controlling customer’s account and are deleted when the customer deletes them or closes their account. Demo-call details are kept only as long as needed to follow up on your request.

Depending on where you live - including under India’s Digital Personal Data Protection Act, 2023 and the EU/UK GDPR - you may have the right to access, correct, export, or delete your personal data, and to withdraw consent. To exercise any of these rights, email us and we will respond within a reasonable time.

For any privacy question or request, write to hello@workflowhq.co.