Version 2.0. Effective November 16, 2026. The previous version (September 15, 2026) stays available here and applies until then.
Workspace369 LLC, a Florida limited liability company at 8225 Emerald Winds Circle, Boynton Beach, FL 33473, USA ("Workspace369", "we", "us") provides a client-work operating system: customer relationship management, projects, proposals, invoicing, payments, scheduling, a shared inbox for email, text, calls and voicemail, e-signatures, AI features, client portals, files, expenses and accounting (the "Service"). This policy covers the Service, our apps, workspace369.com and 369.dev.
Privacy questions and requests: support@workspace369.com (use the subject "Privacy request").
We play a different role depending on whose data it is.
| Data | Our role | What that means |
|---|---|---|
| Your account, billing, sign-in, device and usage data; visitors to our websites; people who contact us or our sales | Controller (in the UK, "controller"; in California, "business") | We decide why and how we use it. This policy is our notice |
| Workspace Content you or your team put into the Service, including data about your own clients and contacts ("End-Client Data"): client records, notes, files, messages, call recordings, invoices, signed documents | Processor (in California, "service provider") | The business that owns the workspace (our "customer") is the controller. We process the data only on its instructions and our Data Processing Addendum. If you are one of a business's clients, that business is responsible for how your data is used and for answering your privacy requests (see section 12) |
| Data from visitors to a public page, booking page, form, e-signature page or client portal that a business built with the Service | Processor for the business that owns the page. We are controller only for security and abuse prevention on our own systems |
The Service is operated from the United States and not offered with EU or UK data hosting. See section 8.
Workspace Content includes client and company records; contacts; notes; files and images; projects and tasks; proposals, contracts, invoices and expenses; schedules and booking requests; e-signature documents and the signing audit trail (signer name, email, IP address, user agent, time); and communications the business handles through the Service: emails it connects or forwards, text messages, voice calls, voicemail, call recordings and their transcripts, and AI summaries of these. These can include personal data of people who are not our users, such as the business's clients, leads, callers and signers.
We ask for a permission only when you use the feature that needs it. You can change each in your phone settings.
| Permission | Why | When it is used |
|---|---|---|
| Notifications | Push alerts for messages, calls, reminders, tasks | After you allow them |
| Microphone | Voice notes and speech-to-text for notes; in-app calling (VoIP) | Only while you record or call |
| Camera and photo library | Take or pick photos for contacts, receipts, expenses and files | Only when you pick or capture an image |
| Motion sensor | "Shake to report an issue" | While the app is open |
We do not intentionally collect precise geolocation or biometric identifiers in the apps, and we do not use advertising identifiers to track you across other companies' apps and sites. We do not sell personal information.
For people in the EEA, UK and Switzerland, this table gives the legal basis under GDPR Art 6. For Workspace Content we act as a processor and the business supplies the legal basis.
| Purpose | Data | Legal basis (controller activities) |
|---|---|---|
| Create and run your account; provide the Service; sign-in and multi-factor authentication | Account, device, log | Contract (Art 6(1)(b)) |
| Billing, taxes, fraud checks, chargebacks | Billing, transaction | Contract; legal obligation (6(1)(c)); legitimate interest in preventing fraud (6(1)(f)) |
| Security, abuse and spam prevention (including scanning inbound email for malware and phishing, bot checks, rate limits, account-abuse screening) | Device, log, message metadata, links | Legitimate interest (6(1)(f)) in protecting the Service and customers |
| Support | Account, content you share with support | Contract; legitimate interest |
| Product analytics in the app, crash and performance monitoring | App events, device, crash logs | Legitimate interest (6(1)(f)); you can object (see section 11) |
| Our website analytics and advertising measurement | Cookie IDs, page views, conversions, hashed identifiers | Consent in the EEA/UK/CH; elsewhere we offer opt-out (section 10) |
| Service emails (receipts, security alerts, product notices) | Account | Contract; legitimate interest |
| Marketing emails | Email, name | Consent or legitimate interest where the law allows; you can opt out any time |
| AI features you turn on | Workspace Content you send to AI | Contract (customer's instruction); the business as controller decides its basis |
| Legal claims, compliance, enforcing our Terms | Any | Legal obligation; legitimate interest |
| Retaining signed-document evidence | E-signature records | Legitimate interest and defence of legal claims (6(1)(f)); the business may also rely on contract or legal obligation |
If we rely on consent you can withdraw it at any time; withdrawal does not affect earlier use.
(Kept from the current policy. It meets Google's required wording and must stay.)
Workspace369's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular:
Workspace369 uses Stripe to process subscription payments and to provide payment infrastructure. Your payment card details are provided directly to Stripe and are governed by the Stripe Privacy Policy; we never see or store your full card number.
If you accept payments from your own clients through the Service, you do so using a Stripe connected account subject to the Stripe Connected Account Agreement and the Stripe Services Agreement. When your clients pay you through the Service, we charge an application fee of one percent (1%) of each transaction amount, which is deducted from the transaction before settlement, in addition to Stripe's processing fees. Transaction records, including the application fee, are visible in the Service and in your Stripe dashboard. Stripe, not Workspace369, is responsible for the transmission and settlement of funds to your bank account; Workspace369 is not a money transmitter, bank or payment institution, and we do not hold your funds. Stripe acts as an independent controller of its own account and fraud data under the Stripe Privacy Policy.
We share personal data only as follows. Names, purposes, data and locations of each company are on our Sub-processors page.
Mobile and SMS data. We do not sell or share mobile information or SMS opt-in data with third parties for their marketing or promotional purposes. Text-message originator opt-in data and consent is not shared with any third party except the aggregators and carriers that deliver the messages. See the SMS Terms.
We do not sell personal information, and we do not use Workspace Content for advertising.
We are in the United States, and the Service stores and processes data in the United States (database in South Carolina, servers mostly in Iowa, AI mostly in the US, some AI processing on Google's global endpoint). If you are in the EEA, UK or Switzerland, your data is transferred to the US.
How we protect it:
We keep personal data only as long as needed for the purposes in this policy. The table shows what our systems do today.
| Data | How long |
|---|---|
| Account data (profile, sign-in identity) | Until you delete your account. Deleting it removes your account record and sign-in. We keep only what the law requires. |
| Workspace Content of an active workspace | While the workspace is active. The workspace owner can edit and export it at any time. |
| Workspace deletion | When the owner deletes a workspace there is a 24-hour window to cancel. After that we delete the workspace's database records, files, email routes and messaging subaccount. Cancel any subscription yourself first, because deleting a workspace does not by itself end billing. |
| After a subscription ends | Workspace data stays available for export for 90 days. After that we may delete or de-identify it, and we do so within 30 days of your written request. |
| Data export download link | 24 hours |
| Deleted emails, texts, calls and voicemails (shared Trash) | They stay in the shared Trash until they are permanently deleted. Automatic purging after a retention period is being introduced. |
| Unrouted inbound messages | 30 days |
| Audit logs of account actions | 90 days |
| Workspace activity log | 90 days by default; each workspace can change it |
| Call recordings and voicemail audio | Until the business deletes them or the workspace is deleted |
| AI chat history and AI-generated summaries | Kept with the workspace until deleted |
| Signed-document evidence (sealed PDF, audit trail) | 1 to 10 years as the business configures; 7 years by default. The evidence copy is locked and cannot be deleted sooner, even if the workspace is deleted. It is retained as evidence for legal claims. |
| Booking page analytics events | 365 days |
| Ad-measurement snapshots | 90 days |
| Short-lived security data (one-time codes, sign-in sessions, rate-limit counters, approval requests) | Minutes to 30 days |
| Billing and tax records | As the law requires, normally 7 years |
| Backups | Deleted data may remain in Google Cloud backups and logs until they expire |
| Support emails | As long as needed to help you and for our records |
| Website analytics cookies | As listed in the Cookie Policy |
Deleted data may stay in encrypted backups until they expire, and in some provider logs for a short period. Data may also be kept longer where the law requires it or to handle a legal claim.
We protect personal data with measures that include: encryption in transit (TLS) and encryption at rest provided by Google Cloud; password-protected notes encrypted with AES-256 using a key derived from the note password; per-workspace access control and role permissions enforced on our servers and in database rules; multi-factor authentication (phone-based, on by default and which the account holder can turn off); Firebase App Check on selected functions; secrets in Google Secret Manager; rate limits and abuse screening; checking of links in inbound email against known threats, and malware scanning of inbound email attachments on Specialist, Commander and Enterprise plans; a hash-chained audit trail and HSM-backed seal for e-signed documents; and audit logs. No system is perfectly secure.
Breach notice. If we become aware of a personal data breach, we will notify affected customers (the controllers of Workspace Content) without undue delay and within 72 hours of confirming the breach, and give them the facts they need for their own notices. For data we control as controller, we will notify regulators and individuals as the law requires, for example within 72 hours to an EEA or UK supervisory authority where required (GDPR Art 33) and within the time set by US state laws (for Florida, individuals within 30 days under the Florida Information Protection Act).
Report a vulnerability through our Security page.
You can ask for access, correction, deletion, restriction, a portable copy, and to object to processing based on legitimate interest or direct marketing, and you can withdraw consent. You can complain to your supervisory authority (in the UK, the ICO). We reply within one month, which can extend by two months for complex requests (GDPR Art 12(3)). We do not make decisions that have legal effects on you based solely on automated processing.
Residents of California and other US states with privacy laws can ask to know, access, correct, delete and receive a copy of personal information, and to opt out of "sale" or "sharing" for cross-context behavioural advertising. We reply within 45 days (extendable once by 45 days). You will not be treated differently for using these rights. An authorized agent may act for you with your written permission.
California categories (notice at collection), covering the 12 months before the effective date:
| Category (Cal. Civ. Code 1798.140) | Examples we collect | Source | Purpose | Disclosed to (service providers) | "Sold" or "shared" |
|---|---|---|---|---|---|
| Identifiers | Name, email, phone, IP address, device and cookie IDs, account ID | You; your device; Google/Apple sign-in | Account, security, analytics, advertising measurement | Cloud, messaging, payment, analytics providers | Cookie IDs and hashed identifiers shared with Google and Meta (opt-out available) |
| Customer records (1798.80) | Name, billing address, phone | You | Billing and support | Stripe, RevenueCat | No |
| Commercial information | Plan, purchases, invoices | You; Stripe | Billing | Stripe | No |
| Internet or network activity | Pages and features used, events, referrer, crash and performance logs | Your device | Operate and improve the Service, advertising measurement | Google, Microsoft, Ahrefs, Meta | Website events shared for advertising (opt-out available) |
| Geolocation | Approximate location from IP | Your device | Security, locale, analytics | No | |
| Audio, electronic or similar information | Call recordings, voicemail, voice notes (Workspace Content, as service provider) | The business and its callers | Deliver the feature; AI transcription if enabled | Twilio, Google Vertex AI | No |
| Professional information | Company, role | You | Account | No | |
| Inferences | AI summaries of messages and calls, scam scores (Workspace Content) | Generated by AI | Deliver the feature | Google Vertex AI | No |
| Sensitive personal information | Account log-in credentials; voice recordings and message content held for customers | You; the business | Provide the Service | Providers above | No; not used to infer characteristics |
We keep each category for the periods in section 9. We do not knowingly sell or share the personal information of anyone under 18.
If your personal data is in a business's Workspace369 workspace (for example you are a client, lead, signer, caller, or someone who got a text from a business), that business is the controller. Ask it directly to access, correct or delete your data. If you contact us, we will not act on it ourselves unless the law requires; we will forward your request to the business within 5 business days and tell you we did, unless the law forbids it or you ask us not to. We will help the business respond.
Businesses' duties. A business using the Service must give its clients and contacts the notices and obtain the consents the law requires, including for call recording (many US states and countries require every party's consent), text and email marketing (for example the US TCPA and CAN-SPAM, GDPR/ePrivacy), and AI processing of their content.
We use strictly necessary cookies (sign-in, security, your consent choice, language), and, with consent in the EEA, UK and Switzerland, analytics and marketing cookies (Google Analytics, Microsoft Clarity, Ahrefs, Google Ads, Meta Pixel, Rewardful, and our own campaign-attribution cookie). Elsewhere these load by default and you can switch them off in "Your privacy choices"; a Global Privacy Control signal switches marketing cookies off. See the Cookie Policy.
The Service is for businesses and users aged 18 and over. We do not knowingly collect personal data from anyone under 18 for our own purposes, and we delete it if we learn we have. Businesses that store information about minors (for example a tutoring business) are responsible for the legal basis, parental consent and notices that apply to that data. Do not use the Service to store children's data for advertising.
No industry standard exists for Do Not Track, so we do not respond to it. We do honour Global Privacy Control as described above.
We will post changes here with a new version number and date. For material changes we will notify account holders by email or in the Service at least 30 days before they take effect where the law requires it. Past versions are on our Legal page.
Workspace369 LLC, 8225 Emerald Winds Circle, Boynton Beach, FL 33473, USA. Privacy requests, security reports and support: support@workspace369.com (subject lines "Privacy request", "Security report"). EEA, UK and Swiss residents can complain to their local supervisory authority.