Privacy Policy

Worklay (“we”, “our”, or “us”) operates a multi-tenant project and team management platform for Indian SMBs at worklay.app (the “Platform”). This Privacy Policy explains what data we collect, why we collect it, how it is protected, and what rights you have. By using the Platform you agree to this policy. If you register on behalf of an organisation, you represent that you have authority to bind that organisation.

Table of Contents

1. 1. Information We Collect
2. 2. How We Use Your Information
3. 3. Multi-Tenancy & Data Isolation
4. 4. Third-Party Sub-Processors
5. 5. Data Portability & Export
6. 6. Data Retention
7. 7. Security Measures
8. 8. Your Rights (DPDP Act 2023)
9. 9. Cookies & Session Management
10. 10. Real-Time Features
11. 11. Children's Privacy
12. 12. Changes to This Policy
13. 13. Grievance Officer & Contact

1. Information We Collect

1.1 Account & Organisation Data

• Organisation name, registered address, GST/company details, contact email, mobile, and logo.
• Org-admin name, work email, and mobile provided during onboarding.

1.2 Employee Profiles

• First and last name, work email, mobile number, designation, employee code.
• Date of birth, gender, reporting manager (entered by the org admin for HR records).
• Profile avatar, if uploaded.

1.3 Work & Collaboration Content

When you use the Platform to manage work, we store the content you create:

• Tasks & Projects — titles, descriptions, priorities, due dates, status changes, and custom fields.
• Comments & Mentions — text content, @-mentioned user IDs, and timestamps.
• Time Logs — logged hours, notes, and the task or project they are associated with.
• Documents — file names, folder structure, and upload metadata.
• Activity Feed — an audit trail of create, update, and delete actions (actor, entity, diff, timestamp).

1.4 Attendance & Leave Records

• Leave requests — type, dates, reason, and approval status.
• Leave balances per type per employee.
• Attendance check-in/check-out events, if enabled by your org admin.

1.5 Authentication & Security Data

• Email address and bcrypt-hashed password (never stored in plain text).
• Optional TOTP 2FA secrets (Enterprise plan), stored encrypted at rest.
• JWT refresh token hashes and session metadata.

1.6 Files & Attachments

Files you upload are stored in a private Cloudflare R2 bucket. Files are never publicly accessible; access is granted only via time-limited (15-minute) presigned URLs. We validate MIME type and enforce a 10 MB per-file limit.

1.7 Automatically Collected Data

• IP address, browser type, OS, referring URL, and page-visit timestamps (stored in audit logs).
• WebSocket connection events (connect, disconnect, room membership) for real-time features.
• API request logs used for rate limiting and security monitoring.

1.8 Payment Information

Processed exclusively by Razorpay. We store only the Razorpay customer ID, subscription ID, and plan identifier — never raw card numbers, CVVs, or bank details.

2. How We Use Your Information

• Provide, operate, and improve Platform features — task management, time tracking, leave management, reporting, real-time collaboration, etc.
• Send transactional emails — welcome, password reset, task assignment, leave approval, subscription alerts — via AWS SES.
• Push real-time in-app notifications over WebSocket when relevant events occur (task assigned, comment added, leave approved, etc.).
• Process payments and manage subscription lifecycle via Razorpay.
• Maintain audit logs for compliance, security, and dispute resolution purposes.
• Enforce subscription plan limits (employee count, project count, storage quota).
• Detect, investigate, and prevent fraud, abuse, or security incidents.
• Meet applicable legal obligations under Indian law (IT Act 2000, DPDP Act 2023).

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.

3. Multi-Tenancy & Data Isolation

Worklay uses a shared-database, tenant-isolated architecture. Every data record is tagged with an organizationId and all database queries are automatically scoped to your organisation. Employees of Organisation A cannot access data belonging to Organisation B. Isolation is enforced at both the application layer (TenantGuard) and the database query layer (Mongoose tenant plugin).

Platform administrators (Worklay staff) may access organisation data only when required to resolve a support ticket or investigate a security incident, and only after internal authorisation. Such access is logged.

4. Third-Party Sub-Processors

All sub-processors are bound by data processing agreements consistent with the DPDP Act 2023.

5. Data Portability & Export

You own your data. You can export your organisation's content at any time:

• Self-service exports — Report pages offer CSV/Excel export for tasks, time logs, leave records, and attendance.
• Full data export — Email privacy@worklay.app to request a full JSON export of your organisation's data. We will deliver it within 14 business days.
• Before cancellation — You may request an export before your account is closed. See the Termination section in our Terms of Service.

6. Data Retention

• Active organisation data is retained for as long as the account is active.
• Soft-deleted records (tasks, projects, employees, etc.) are marked with a deletedAt timestamp and excluded from normal queries; they are permanently purged 90 days after deletion.
• Audit logs (activity feed, access logs) are retained for 2 years.
• After subscription cancellation with no renewal, account data is retained for 60 days to allow export, then permanently deleted.
• You may request immediate deletion by contacting privacy@worklay.app.

7. Security Measures

• Passwords hashed with bcrypt (cost factor 12); never stored in plain text.
• All data in transit protected by TLS 1.2+ (HTTPS and WSS).
• JWT access tokens expire in 15 minutes; refresh tokens (7-day) are rotated on every use and stored as bcrypt hashes.
• HTTP security headers enforced via Helmet.js — HSTS, X-Frame-Options, X-Content-Type-Options, and XSS-Protection.
• API rate limiting: 100 requests / minute globally; 5 requests / 15 minutes on authentication endpoints.
• File uploads validated for MIME type and size (10 MB per file). Files stored in a private bucket; never served without a time-limited presigned URL.
• Optional TOTP 2FA available for Enterprise plan users.
• Razorpay webhook payloads verified with HMAC-SHA256 signatures.

8. Your Rights (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023 and applicable Indian law, you have the following rights:

• Access — Request a copy of personal data we hold about you.
• Correction — Request correction of inaccurate or incomplete data.
• Erasure — Request deletion of your personal data (subject to legal retention requirements).
• Portability — Receive your data in a structured, machine-readable format.
• Grievance Redressal — Lodge a complaint with our Grievance Officer (see Section 13).
• Nomination — Nominate a person to exercise rights on your behalf in the event of your death or incapacity.

To exercise any right, email privacy@worklay.app with the subject line “Data Rights Request”. We will respond within 30 days.

9. Cookies & Session Management

We use first-party cookies solely for authentication:

• access_token — HttpOnly, Secure, SameSite=Lax; expires in 15 minutes.
• refresh_token — HttpOnly, Secure, SameSite=Lax; expires in 7 days; rotated on every use.
• _auth /_role — readable indicator cookies for middleware routing; contain no sensitive data.

We do not use third-party tracking cookies, advertising pixels, or analytics SDKs that share data with external parties. Disabling cookies will prevent login.

10. Real-Time Features

Worklay uses WebSocket connections (Socket.io) to deliver real-time notifications — task updates, comments, leave approvals, and system alerts. When you use the Platform:

• Your browser establishes a persistent WebSocket connection, authenticated by your JWT token.
• You are placed in organisation-scoped and user-scoped rooms; events are pushed only to the relevant rooms.
• Connection events (connect, disconnect) are logged for security purposes.
• WebSocket traffic is encrypted with TLS (WSS).

11. Children's Privacy

The Platform is intended for business use by individuals 18 years of age or older. We do not knowingly collect personal data from minors. If we become aware that a minor has registered, we will delete the account promptly.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email and an in-app notification at least 14 days before taking effect. Continued use of the Platform after the effective date constitutes acceptance of the revised policy. The current version is always available at worklay.app/privacy-policy.