Privacy Policy

1. Who we are and our role

Workpro.ai is operated by [to be confirmed: company legal name], [to be confirmed: registered address] ("we", "us").

Our customers are organisations ("Customers") that install the agent on devices they own or manage. For data collected from those devices and from the Customer's connected systems, the Customer decides what is monitored and why. The Customer is the data controller (a "Data Fiduciary" under India's Digital Personal Data Protection Act, 2023) and we process that data on the Customer's instructions as a processor.

We are the controller only for data about our own business contacts and website visitors — for example, people who contact sales or sign in to the portal.

If you are an employee of a Customer, your employer is responsible for telling you about monitoring, for having a lawful basis for it, and for answering your requests about your data. We support them in doing so.

2. Data collected from monitored devices

The Customer chooses, by policy, which of the following are switched on for which people and devices. Not every Customer uses every feature.

• Application and window activity — the name of the application in use, its process name, the window title, and start, end, active and idle times.
• Web activity — addresses and titles of pages visited in supported browsers, search terms entered in search engines (the Customer can switch search-term capture off), and file downloads (file name, save location, size and source address), read from the browser on the device.
• Screenshots — periodic images of the screen at an interval set by the Customer. Screenshots can be blurred by policy and are not taken while the device is idle.
• Live screen — a live view of the screen, started by an authorised administrator, for a limited session.
• Documents and uploads — names and locations of office, PDF and similar documents opened in user folders, and names, sizes and destinations of files uploaded through browsers and messaging apps.
• Removable storage and printing — USB device connection and removal, the names, paths and sizes of files written to USB storage, and print jobs (document name, printer and page count). The contents of files are not collected.
• Attendance signals — sign-in, sign-out, lock, unlock and idle/active transitions, used to calculate working time.
• Device information — computer name, Windows user name and identifiers, operating system, hardware model, serial number, processor, memory, disk, IP address, MAC address, installed applications and resource usage.

The agent does not record keystrokes or what you type, does not read clipboard contents, and does not use the camera, microphone or location services.

3. Data from systems the Customer connects

If a Customer connects them, we also process:

• Microsoft 365 — metadata of sent email — sender, recipients, subject and time. We do not read message bodies or attachments.
• HR systems (such as Keka) — the employee directory, attendance, leave, work-from-home and on-duty records, holiday calendars and shift policies.
• Telephony (such as Vitel Global) — call records: the numbers involved, time and duration. Calls are not recorded.

4. Account, portal and contact data

• User profile details: name, email address, phone number, employee code, job title, department, joining date, role and time zone.
• Sign-in records: time, IP address, browser details, failed attempts, and an audit log of administrative actions.
• Messages and details you send us when you contact sales or support.

Passwords are stored only as salted bcrypt hashes.

5. Why the data is used

• To provide the service the Customer configured: productivity and attendance reporting, security and data-loss alerts, device and asset management.
• To secure the service, investigate misuse and keep audit trails.
• To support Customers, fix faults and deliver agent updates.
• To meet legal obligations.

We do not sell personal data, use it for advertising, or use Customer data to train artificial-intelligence models.

6. Who can see the data

Within a Customer, access depends on role. Administrators, managers and team leads authorised by the Customer can view reports, screenshots and live screen for the people in their scope. Employees can view their own activity, application, website and productivity reports.

A small number of our staff can access Customer data where needed to operate, support or secure the service, under confidentiality obligations.

7. Service providers

We use the following providers to run the service:

• Hosting — our production servers, located in [to be confirmed: hosting location].
• Cloudflare — network delivery and protection for our website and API.
• Email delivery — [to be confirmed: email provider], for account and notification emails.
• Microsoft, Keka, Vitel Global — only where the Customer chooses to connect them.

Where data is transferred outside India or the European Economic Area, we rely on the safeguards required by applicable law.

8. How long data is kept

• Screenshots are deleted automatically after the retention period the Customer sets in its screenshot policy (30 days by default), and never later than the organisation's retention period.
• Activity, application, website, search, document, download, upload, removable-storage and call records, Microsoft 365 email metadata, and the daily summaries built from them are deleted automatically once older than the organisation's retention period (90 days by default; the Customer can choose 1 to 3,650 days).
• Attendance and leave records are kept for as long as the Customer's account is active, because Customers rely on them for payroll and labour-law obligations. Audit logs are kept to protect the security of the service.
• Archived employee records are purged 30 days after archiving.
• When a Customer leaves, we delete or return its data within the period set out in the Customer's agreement.

9. Security

Data is encrypted in transit over HTTPS. Credentials for connected systems are encrypted with AES-256-GCM. Access is role-based and scoped to each Customer, administrative actions are logged, and screenshots are served only through short-lived signed links.

If a personal data breach affects you, we will notify the Customer without undue delay so it can meet its own obligations, and we will notify regulators where the law requires us to.

10. Your rights

Depending on where you are, you may have the right to access, correct, update or erase your personal data, to object to or restrict processing, to data portability, to withdraw consent where processing relies on consent, to nominate another person to exercise your rights, and to complain to a supervisory authority (in India, the Data Protection Board of India).

If you are monitored by your employer, please send your request to your employer first; we will help them respond. For any other request, contact us at [to be confirmed: privacy contact email]. We respond within the time limits set by applicable law.

11. Cookies and local storage

The portal keeps your sign-in session and display preferences in your browser's local storage. These are strictly necessary for the portal to work. Our website does not use advertising or analytics cookies; if that changes, we will update this policy and ask for consent where required.

12. Children

The service is intended for use by organisations on their workforce and is not directed at children. We do not knowingly process data of anyone under 18.

13. Grievance Officer and contact

Grievance Officer: [to be confirmed: Grievance Officer name], [to be confirmed: company legal name], [to be confirmed: registered address]. Email: [to be confirmed: privacy contact email].

We may update this policy. Material changes will be announced in the portal and on this page before they take effect.