PRIVACY
POLICY

Information We Collect

Personal Information You Provide

We collect personal information that you provide to us when registering or using Onwork. This includes identifiers and contact details such as your name, email address, phone number, and business address, as well as account credentials (including your password). If you sign up via third-party single sign-on (SSO) options like Google, Apple, or Microsoft, we receive basic profile information (such as your name and email) from those providers with your consent. We also collect business-related information you may provide (for example, your company or trading name, or information indicating you are a sole trader). All such data that identifies or relates to you is considered "personal information" or "personal data" under privacy laws.

Payment and Financial Information

If you make payments through Onwork, this is handled via our third-party payment processor, Stripe. You may need to provide billing information such as your card details and billing address, but Onwork does not store full payment card numbers. Stripe, a PCI-DSS Level 1 certified service provider, processes your payment information securely on our behalf. We retain transaction records (e.g. payment amount, date, and the last four digits of your card for identification) for bookkeeping and to handle billing inquiries, but sensitive payment data is tokenized or stored by Stripe in compliance with industry security standards.

Free Tools and Downloads

Onwork may offer free tools or toolkits that you can download and use for business purposes (for example, templates, calculators, or other software). Generally, these tools run locally on your device, and Onwork does not collect personal information through your use of those offline tools unless you explicitly upload or submit data to us. We provide these free tools "as is" for your convenience, and their use is at your own risk. (See "No Liability for Free Tools" below.)

Information Collected Automatically

Like most online services, we and our third-party partners (described below) use cookies and similar tracking technologies to automatically collect certain technical data when you use our website or app. This may include your device's IP address, browser type, device identifiers, pages or screens viewed, how you interact with our site, and other internet network activity information (such as browsing history on our site). We also log usage metadata like timestamps of logins, features used, and errors or crash reports for troubleshooting.

Cookies and Tracking

Onwork uses cookies and pixels to remember your preferences and analyze how our services are used. For example, we use Google Analytics to gather statistical information about user interactions with our site (e.g. which pages are visited, traffic sources). Google Analytics may set cookies in your browser; however, we have configured it not to collect any personally identifiable information (and Google provides IP address anonymization in regions where required). We also integrate AdRoll (NextRoll) on our site for advertising and retargeting purposes. AdRoll places cookies or similar trackers on your device to collect information about your browsing activities on our site (and potentially on third-party sites) in order to show you tailored ads and measure the effectiveness of our ad campaigns. These advertising cookies may collect identifiers like cookie IDs or hashed email identifiers and information about your visits. (For more details, see "Your Choices" below for how you can control cookies and advertising preferences.)

Information from Third Parties

In addition to data you provide directly, we may receive personal information from third-party sources in connection with providing our service. For example, if your employer or another business entity invites you to use Onwork, they might give us your contact information. If you link or integrate Onwork with another platform or service, we may receive certain information from that platform (consistent with their privacy policies and your settings). We may also receive social media profile information when you engage with our pages on Facebook, LinkedIn, or other networks, and similar data from partners if we run promotions or campaigns together.

We do not collect any sensitive categories of personal data unless necessary (and in accordance with applicable law). For instance, we do not seek to collect data about race, ethnicity, religious or philosophical beliefs, health, biometric identifiers, or similarly sensitive information, and we ask that you do not provide such data to us when not required. Onwork is primarily a business productivity platform, and we focus on collecting only what is needed to serve our business users.

How We Use Personal Information

We use the personal information we collect for the following purposes (and in accordance with the lawful bases allowed under relevant data protection laws):

Providing and Improving Our Services

We use your information to create and manage your account, authenticate you when you log in, and to operate the Onwork platform's core functionalities. This includes enabling you to create and collaborate on projects, use our business tools, and download resources. We process personal data as necessary to perform our contract with you (the Terms of Service), such as by maintaining your profile and settings, and delivering any products or services you request. We also use data to understand how our services are used and to make improvements, fix bugs, and develop new features. (For example, we might analyze usage trends to optimize our user interface or to scale our infrastructure.)

Communicating with You

We will use your contact information (email address, phone number) to send you important administrative or transactional communications. These include messages to confirm your sign-up, notifications about critical service updates or security alerts, information about billing (like invoices, receipts, payment issues), and responses to any inquiries or support requests you submit. We may also send you promotional communications about new features, newsletters, or events that we believe are relevant to business users. Where required by law, we will obtain your consent before sending you marketing emails. You can opt out of marketing emails at any time by clicking the "unsubscribe" link in the email or contacting us (opting out of marketing will not affect our service emails related to your account or transactions). We may also use services like Resend (an email delivery platform) to send these emails on our behalf, and Twilio to send text messages or facilitate phone communications when necessary (for example, to send verification codes via SMS or to power any voice/SMS features in our service).

Processing Payments

When you make a purchase or subscription payment, we use the personal and payment information provided to process the transaction and provide you with the paid services. This includes sending your payment details to Stripe for authorization and charge, and recording your purchase in our systems. We may also use your contact information to send payment receipts or notify you of subscription renewals. Payment processing is done under the necessity of performing our contract with you and our legitimate interest in getting paid for our services. All payment transactions are encrypted and handled securely; we rely on Stripe's secure infrastructure (PCI Level 1 certified) for processing.

Personalization and Advertising

We may use data about your use of Onwork and your interactions (such as pages visited or tools used) to personalize your experience. For example, we might recommend certain free toolkits or content that could be useful for your business based on your usage. With your consent where required, we also use retargeting advertising to reach users who have visited our site. Through AdRoll and similar ad networks, we may serve ads on other websites or social media platforms to remind you of our services or to offer promotions. This involves using cookies or pixel tags that track that you visited Onwork so that AdRoll can display our ads to you on partner sites. Such processing for targeted advertising may be considered a "share" of personal information under some laws (like CPRA in California), but we only use it to promote our own services and do not allow third-party advertisers to use your data for their own independent purposes. You have the right to opt out of this type of advertising – see "Your Choices" below.

Analytics and Service Improvement

We use Google Analytics and similar tools to analyze overall trends and metrics about our users. This helps us understand how users find and use our website, which pages or features are most popular, and other statistical insights. For instance, Google Analytics may tell us that a certain percentage of users are from a particular region or that a marketing campaign resulted in increased sign-ups. We use this information in aggregate form (not to profile individual users) to make business decisions, such as where to focus our development roadmap or how to improve user onboarding. Our legal basis for analytics may be our legitimate interest in understanding and improving our service, but where required by law (e.g., in the EU), we will obtain your consent for placing analytics cookies.

Customer Support and Service Delivery

If you contact us for support, we will use your information to troubleshoot and resolve issues. This may include reviewing your account info, error logs, or any information you provided about a problem. We might ask for additional information as needed to resolve your issue. We also use personal data to enforce our Terms of Service and usage policies, to prevent misuse of our platform, and to keep our community safe. This can involve monitoring for fraudulent or malicious activity and, if needed, using information to investigate and mitigate such issues.

Legal Compliance and Protection

We may process personal information as necessary to comply with our legal obligations, such as maintaining proper business records, handling requests from government or law enforcement as required by law, or responding to legal processes (e.g., court orders). We also may use or disclose personal information if we believe it is necessary to protect our rights, privacy, safety, or property, or that of our users or others; for example, to enforce our contracts and policies, or to detect and prevent fraud or security issues.

We will not use your personal information for purposes that are incompatible with the ones listed above without notifying you (and obtaining your consent if required). We strive to adhere to the principle of purpose limitation – meaning we collect and process data for specific, stated purposes and not in ways you wouldn't expect. If we ever need to process your data for a new purpose, we will update this Privacy Policy and notify you as required.

Disclosure of Personal Information

We value your privacy and do not sell your personal information to third parties for their own marketing or profit. However, we do share your information with certain trusted third parties under strict conditions, as outlined below, in order to run our business effectively. All third parties that process personal data on our behalf are contractually obligated to safeguard it and use it only for the services they provide to us.

Service Providers

We use a variety of third-party companies to support our operations and deliver our services to you. These service providers (processors) handle data on our instruction and include:

• Payment Processors: As noted, Stripe processes all payment transactions and will have access to payment-related personal information as needed to charge your credit/debit card or other payment method. Stripe is restricted from using this data for anything other than payment processing and regulatory compliance. We do not share your personal information with Stripe for any purpose other than to complete payments you authorize.
• Cloud Hosting and IT Infrastructure: Onwork is hosted on cloud servers which store and process your data (including account info and content you input into our platform) on our behalf. These hosting providers provide necessary data storage, backup, and software infrastructure. We take steps to encrypt sensitive data at rest and in transit on these systems to protect your information.
• Email and Communications Providers: We use Resend to send transactional and notification emails. Resend will process your email address and the content of emails we send to you. Likewise, Twilio provides telephony services that enable us to send SMS messages or potentially facilitate voice calls. These providers are only allowed to use your data to deliver communications and are not permitted to contact you for their own purposes.
• Analytics and Advertising Partners: We share certain online identifiers and usage data with analytics and advertising partners as described in the "Cookies and Tracking" section. Specifically, Google Analytics will receive information about your device and browsing actions on our site, but this information is generally aggregated and does not include your name or contact information. Our advertising partner, AdRoll/NextRoll, will receive cookie identifiers and data about your visit in order to serve you tailored advertisements on our behalf. This data sharing for advertising is done under a "service provider" or "processor" model where NextRoll is contractually bound to use the data only to provide services to Onwork and not to build independent user profiles for their own use. Nevertheless, because targeted advertising may be deemed a "sale" or "share" under certain laws, we treat it with care and honor opt-out requests.
• OpenAI Integration: Onwork may integrate OpenAI technology to power certain AI-driven features in our platform (for example, an AI assistant or content generation tool to help with business tasks). If you choose to use such features, the content you provide (prompts, queries, or data to be analyzed) will be sent to OpenAI's API in order to generate a response. OpenAI does not use API-submitted data to train or improve its general models by default, and they will process the data only for the purpose of returning the requested AI output. We do not give OpenAI any more of your personal information than is necessary for the feature to function. We have an agreement in place with OpenAI to ensure they handle any data from our users in compliance with privacy and security requirements.

Business Transfers

If Onwork is involved in a merger, acquisition, sale of assets, or reorganization (for example, if another company intends to acquire us or we are seeking investment), it may be necessary to disclose or transfer user information as part of that transaction. We will ensure that any such transfer is subject to appropriate confidentiality and that your personal information remains protected. If a change of ownership occurs, we will provide notice to users and outline any choices you may have regarding your data.

Legal Compliance and Safety

We may disclose personal information to third parties (such as attorneys, auditors, law enforcement or governmental authorities) if we believe in good faith that such disclosure is required to: (a) comply with any applicable law, regulation, legal process, or enforceable governmental request (for example, responding to a subpoena or court order); (b) enforce our Terms of Service or other agreements, and investigate potential violations; (c) detect, prevent, or otherwise address fraud, security, or technical issues; or (d) protect the rights, property, or safety of Onwork, our users, or the public as required or permitted by law.

No Unauthorised Third-Party Marketing

We will not share or rent your personal details to unrelated third parties for their own marketing or advertising purposes without your explicit consent. For example, we do not sell email lists to other companies. Any third-party content or ads you see while using Onwork is there for your convenience, and if any data is transferred to those third parties, it will be as described in this Policy or with your consent.

International Data Transfers

Onwork is headquartered in Australia, but we serve users around the world. Your personal information may be transferred to and stored on servers in countries other than your own. In particular, many of our external service providers are based in the United States (for example, Stripe, OpenAI, AdRoll, and others), so personal data will be routinely transmitted to and processed in the U.S. Additionally, if you are located in the EU/EEA or United Kingdom, note that your personal data may be transferred to Australia (where we are based) or other jurisdictions that may not have the same level of data protection laws as in your home country.

Whenever we transfer personal data internationally, we take steps to ensure that appropriate safeguards are in place to protect it in accordance with applicable privacy laws. For example, for transfers from the European Union (or UK, Switzerland, etc.) to countries not deemed "adequate" by the European Commission, we rely on mechanisms such as the European Commission's Standard Contractual Clauses (SCCs). These are contractual commitments that require the recipient of the data to provide equivalent protection as in the EU.

By using Onwork or submitting your information to us, you understand that your personal information may be transferred and stored in countries outside your country of residence. These countries may have data protection rules that are different from your country. However, where this is the case, we will ensure that your privacy rights are respected and that an adequate level of protection is provided to the information in accordance with this Privacy Policy.

Data Security

Onwork takes data security seriously and has implemented measures designed to protect your personal information from unauthorised access, loss, misuse, or disclosure. We follow industry best practices to secure data, including:

• Encryption: All data exchanged with our site is protected in transit using Transport Layer Security (TLS/SSL) encryption. For sensitive personal data and certain stored content, we also employ encryption at rest. Passwords are hashed and salted (not stored in plain text). Payment information is handled by Stripe using their secure encryption and tokenization; we never see your full credit card number.
• Access Controls: We restrict access to personal information to only those employees, contractors, and service providers who need it to operate or improve our services. Our staff are trained on the importance of privacy and security. We also require our service providers to uphold strong security standards.
• Network & System Security: Our servers are protected by firewalls and security monitoring tools. We keep our software and infrastructure up to date with security patches. Regular backups are performed to prevent data loss.
• Testing and Compliance: We periodically review our security measures and may conduct vulnerability assessments or penetration testing. In the event of a security incident or data breach affecting personal information, we have a response plan, and we will notify affected individuals and authorities as required by law.

Despite all measures, please note that no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of information. If you have reason to believe that your interaction with us is no longer secure, please contact us immediately.

Data Retention

We retain personal information for only as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. The retention period for different data types can vary. We keep your account profile information for as long as your account is active. If you delete your account or request deletion, we will remove or anonymize your personal data within a reasonable period, except to the extent we need to retain it for legal obligations or legitimate business purposes.

When we have no ongoing legitimate need or legal requirement to process your personal information, we will either delete it or anonymize it. If deletion or anonymization is not immediately feasible, we will isolate it from further processing until deletion is possible.

Your Privacy Rights

You have rights regarding your personal information. These rights vary depending on your location and the applicable laws. Below, we outline key rights and how you can exercise them:

General Rights (Applicable to Most Users)

• Access and Correction: You have the right to request access to the personal information we hold about you and to obtain a copy of that information. You also have the right to request correction of any personal information that is inaccurate or incomplete.
• Deletion (Right to Erasure): You may have the right to request deletion of your personal information. Under GDPR (EU/UK), you can ask us to delete your data in certain circumstances. We will evaluate and comply with deletion requests as required by law.
• Objection and Restriction: You have the right in certain situations to object to or opt out of certain processing, or to request that we restrict processing of your data.
• Data Portability: Where provided by law (e.g., GDPR), you have the right to data portability. This allows you to obtain a copy of certain personal information in a structured, commonly used, machine-readable format.
• Withdraw Consent: If we rely on consent as the legal basis for processing your personal information, you have the right to withdraw your consent at any time.
• Non-Discrimination: We will never discriminate or retaliate against you for exercising any of these rights.
• Complaint to Regulator: If you have concerns about how we are handling your personal information, you have the right to complain to a data protection authority or privacy regulator.

Rights for California Residents

If you are a resident of California, you are protected by the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). This law provides California consumers with specific rights, including:

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You have the right to request that we delete personal information we have collected from you.
• Right to Correct: California residents have the right to request correction of inaccurate personal information maintained by us.
• Right to Opt-Out of Sale or Sharing: While Onwork does not sell personal information for money, the CCPA's definition of "sale" and "sharing" can include certain forms of targeted advertising. You can opt out of this "sharing."
• Right to Non-Discrimination: We will not deny you goods or services, charge you a different price, or provide a different level of quality simply because you exercised any of your CCPA rights.

How to Exercise Your Rights

To make any request regarding your personal information, please contact us at legal@onworkapp.com. Include your name and the email associated with your Onwork account, and clearly state which right you wish to exercise. We may need to verify your identity before processing certain requests. We will respond as soon as we can and within the timeframes set by applicable law.

Your Choices and Controls

In addition to formal legal rights, we strive to provide you with practical controls over your personal information:

• Account Settings: You can access and update certain profile information at any time through your Onwork account settings.
• Email Preferences: You can opt out of marketing emails by using the unsubscribe link provided in those emails.
• Cookie Preferences: You can control cookies through your browser settings or via our cookie consent banner.
• Opt-Out of Ad Tracking: You can opt out of targeted advertising through our site's cookie settings or by using industry opt-out tools.
• Downloading or Deleting Your Data: You can contact us at any time to request a data export or account deletion.

No Liability for Free Tools and Third-Party Links

As noted, Onwork provides some free tools and toolkits for users. These tools are provided as a courtesy and at your own risk. We do not collect personal data through your use of these free offline tools (unless you later choose to input that data into our platform). However, you are responsible for how you use and secure any data when using those tools. Onwork disclaims any liability arising from your use of free tools – they are provided "as-is" without any warranty.

Our website and app may also contain links to external websites or third-party integrations. If you follow a link to any external site, please note that those sites have their own privacy policies. We do not control and are not responsible for the content or privacy practices of those third-party sites.

Children's Privacy

Onwork is not directed to children or anyone under the age of 16. Our services are intended for businesses and professional users. We do not knowingly collect personal information from individuals under 13 years of age (or under the applicable age of consent in certain jurisdictions, which is 16 in the EU for example). If you are under 13, please do not use Onwork or submit any personal data to us.

In the event we learn that we have collected personal information from a child under 13 (or under 16, where applicable) without proper consent, we will take steps to delete that information as soon as possible. Parents or legal guardians: if you believe your child has provided personal information to us without your consent, please contact us immediately and we will work to remove that data and terminate any account that may have been created.

Changes to this Policy

We may update or modify this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. If we make material changes, we will notify you by means appropriate to the significance of the change – for example, by posting a prominent notice on our website or by emailing users to inform you of the updated policy.

The "Last Updated" date at the top of this Policy indicates when the latest changes were made. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Any changes will become effective when we post the revised Policy. If you continue to use Onwork after those changes become effective, you will be deemed to have accepted the updated Privacy Policy.

Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please feel free to contact us:

We will do our best to address and resolve any privacy issue you bring to our attention. If you contact us with a privacy-related request or complaint, please include sufficient detail for us to understand and respond, including any relevant account information and your specific concerns.

By using our services, you acknowledge that you have read this Privacy Policy and understand its contents. Thank you for trusting Onwork with your business needs and personal information. We are committed to protecting your privacy and delivering a secure experience.