Privacy Policy

Effective date: November 11, 2025

At WorkTiles, your privacy is our priority. This Privacy Policy explains how we handle your personal data. By using or accessing our Services, you acknowledge acceptance of the practices and policies described herein and consent to the collection, use, and sharing of your information as outlined. Your use of WorkTiles' Services is always subject to our Terms of Service.

What this Privacy Policy Covers

This Privacy Policy describes how we handle "Personal Data" gathered when you access or use our Services. "Personal Data" means any information that identifies or relates to an identifiable individual, as defined under applicable data privacy laws (including the GDPR). This policy does not cover the practices of companies we do not own or control, nor people we do not manage.

Depending on context:

  • For our public website and our own account management, WorkTiles acts as the data controller.
  • For organizational customers using the WorkTiles platform, your organization is typically the data controller and WorkTiles acts as a data processor.

Personal Data We Collect

The categories of Personal Data we collect (and have collected in the past 12 months) may include:

  • Profile or contact data (e.g., name, email address)
  • Account and organization data (e.g., organization name, team memberships, role)
  • Device/IP and technical data (e.g., IP address, browser, device identifiers)
  • Usage and log data (e.g., actions in the app, timestamps)
  • Support communications (e.g., emails, chat, tickets)
  • File uploads and content you choose to store in the Service
  • Payment/billing data where applicable (processed by our payment providers)

We share this data only as needed with service providers and authorized parties to deliver and improve the Services, meet legal requirements, and protect our rights and users.

Categories of Sources

We collect Personal Data:

  • Directly from you (e.g., when creating an account, using features, contacting support)
  • From your organization (e.g., provisioned accounts, assigned roles)
  • Automatically through your use of the Services (e.g., logs, device data)
  • From third parties that help us operate the Services (e.g., authentication)

Purposes and Legal Bases (GDPR)

We process Personal Data for:

  • Providing and securing the Services (performance of contract; legitimate interests; legal obligations)
  • Customizing and improving the Services (legitimate interests; consent where required)
  • Communicating with you (performance of contract; legitimate interests; consent where required)
  • Billing and account administration (performance of contract; legal obligations)
  • Compliance, fraud prevention, and safety (legal obligations; legitimate interests)

Where required, we will obtain your consent (e.g., for certain cookies or communications). You may withdraw consent at any time.

Data Location and Hosting

WorkTiles is hosted and operated in the European Union on Google Cloud Platform:

  • Primary region: europe-north1 (Finland)
  • Redundancy: europe-west1 (Belgium)
  • Cloud SQL backups: stored within the EU ("eu" backup location)
  • File uploads: stored in EU-located Google Cloud Storage

Data is encrypted in transit and at rest. Deleted files may be retained for up to 90 days to enable recovery, in line with our storage soft-delete policy.

International Data Transfers

WorkTiles stores and processes all customer data exclusively within the European Union. All infrastructure, backups, and subprocessors operate in EU regions only. No customer data is transferred or processed outside the EU/EEA.

Subprocessors

We use a small number of trusted subprocessors to operate specific parts of the WorkTiles Service. All subprocessors listed below store and process data exclusively within the European Union.

  • Google Cloud Platform (GCP) - primary hosting and storage for all application data. All infrastructure and backups are located in EU regions (europe-north1 in Finland and europe-west1 in Belgium).
  • Clerk Europe - user authentication and account management. All identity data is processed and stored in Clerk's EU data region under GDPR-compliant terms.
  • Cloudflare - DNS, CDN, and Web Application Firewall services. Cloudflare Regional Services are configured to process traffic within the EU.
  • Svix (EU region) - secure webhook delivery for authentication and related events.
  • Microsoft (Graph / 365) - optional calendar and file integration, used only when an organization chooses to connect its Microsoft 365 account. Access is customer-authorized via OAuth and can be revoked at any time; this integration is voluntary and not required to use WorkTiles.

All subprocessors have executed Data Processing Agreements (DPAs) with WorkTiles and operate under GDPR-compliant terms. No customer data is transferred or stored outside the EU/EEA.

Cookies and Similar Technologies

We use necessary cookies to operate the Service and may use functional cookies to improve user experience. Where required by law, we request consent for non-essential cookies and provide controls to manage preferences via your browser or in-product settings.

Data Security

We implement technical and organizational measures to protect Personal Data, including encryption in transit and at rest, least-privilege access controls, logging/monitoring, and regular backups. No method of transmission or storage is entirely secure; however, we continuously improve our safeguards to mitigate risk.

Data Retention

We retain Personal Data for as long as necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. Where feasible, we apply shorter retention for logs and implement soft-delete windows (e.g., up to 90 days for file recovery) to balance reliability and privacy.

Children's Privacy

We do not knowingly collect Personal Data from children under 16. If we learn that we have collected such data, we will delete it promptly. For inquiries, please contact [email protected].

Your Rights (GDPR and Applicable Laws)

Depending on your location and role, you may have the right to:

  • Access, rectification, and erasure
  • Restriction or objection to processing
  • Data portability
  • Withdrawal of consent (where processing is based on consent)
  • Complaint to a supervisory authority

If your account is managed by your organization, please contact your administrator to exercise rights where WorkTiles acts as processor; otherwise contact us at [email protected].

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the Service or by email, and the "Effective date" will be updated.

Contact Information

Questions or requests regarding this Privacy Policy or your Personal Data:

Email: [email protected]
Address: Sturegatan 6, 114 35 Stockholm, Sweden