Workee Privacy Policy — Platform
Effective Date: September 8, 2026
Last Updated: September 8, 2026
This Privacy Policy explains how Workee Inc. collects, uses, shares and protects personal data in connection with the Workee platform at workee.ai and workee.net (the “Platform”). It applies to the Platform. A separate policy at workee.ai/privacy-policy-website covers the marketing website, and cookie use is described at workee.ai/cookies (Platform) and workee.ai/cookies-website.
Capitalised terms not defined here have the meaning given in the Terms of Use at workee.ai/terms-of-use.
- 1. Who We Are
- 2. Our Two Roles — Please Read This First
- 3. Personal Data We Collect as Controller
- 4. Personal Data We Process as Processor, on Behalf of Users
- 5. Where Data Comes From
- 6. Legal Bases for Processing
- 7. How We Use Personal Data
- 8. AI Features and What They Process
- 9. Messaging, Consent and Opt-Out
- 10. Sharing and Disclosure
- 11. Cookies and Tracking
- 12. Data Retention
- 13. Your Rights
- 14. International Transfers
- 15. Security
- 16. Children
- 17. Changes to This Policy
1. Who We Are
Workee Inc.
Registration / EIN 36-4999250
360 NW 27th Street, Miami, FL 33127, USA
For information about any appointed EU/UK representative or Data Protection Officer, contact privacy@workee.ai. This Policy does not identify an unavailable webpage as the source of those details.
2. Our Two Roles — Please Read This First
Workee handles two different kinds of personal data, under two different roles.
We are the controller of data about our own customers: the Users, Account Owners, Administrators and Staff Users who register for and use the Platform. This Policy describes that processing in full.
We are a processor — and a “service provider” under the CCPA/CPRA — of Client Data and Lead Data: personal data about your clients, patients, guests and prospective clients entered into or generated within the Platform. We process it on your documented instructions to provide the Services. For that processing, the User is the controller and must provide its own privacy notice. We assist Users with data subject requests as required by applicable law and any separately executed Data Processing Addendum. Where such terms are legally required, Workee and the User must execute them before the relevant processing begins; an unavailable webpage does not put a DPA into effect.
If you are a client of a business that uses Workee and you want your data corrected or deleted, contact that business. You may also write to privacy@workee.ai and we will route the request to them.
3. Personal Data We Collect as Controller
3.1 Account and identity data
Email address, first and last name, password (hashed), Google account identifier where you sign in with Google, profile photo, profession or specialty, phone number, business name, business address, and Locations configured on the Account.
3.2 Role and permission data
Seat assignment, role (Account Owner, Administrator, Staff User), permission set, and the Account and Locations to which a Staff User has access.
3.3 Subscription and billing data
Plan type, Seat and Location counts, subscription start and renewal dates, term length, price, currency, coupons and discounts, payment status, invoice and receipt records, tax identifiers where supplied, and purchase history. We do not store full payment card numbers; card data is captured and stored in tokenized form by our payment processor.
3.4 Integration credentials
Account identifiers and access tokens for services you connect, including Google, Zoom, Stripe and PayPal. We store tokens, not passwords, for connected services.
3.5 Usage, device and technical data
User ID, session ID, IP address, approximate location derived from IP, device and browser type, operating system, time zone, pages and features used, feature adoption events, and error and diagnostic logs.
3.6 Support data
The content of support requests, attachments you upload, and correspondence with our support team.
3.7 Communications with you
Records of service, security, billing and legal notices we send you, and your marketing preferences.
3.8 Cookies and similar technologies
Described in the Cookie Policy at workee.ai/cookies and in Section 11 below.
4. Personal Data We Process as Processor, on Behalf of Users
We process the following on your instructions when you use the Platform. We do not use it for our own purposes, do not sell or share it, and do not combine it across Users except as described in Section 7.3.
4.1 Client and Lead records
Name, email address, phone number, date of birth where collected, address, notes, booking history, membership and package status, tags and segments, and communication preferences and opt-out status.
4.2 Lead Form submissions
Contact details, stated service interests, free-text enquiries, the form version and page it was submitted from, timestamp, IP address, and the consent selections made on the form. Consent records are retained as evidence of consent, as described in Section 9.
4.3 Booking and scheduling data
Appointment date and time, service booked, assigned staff member, Location, time zone, availability and slot data, appointment status, and cancellation, no-show and reschedule history.
4.4 Payment and transaction data
Original charge, deposit and remaining balance, Tips, refunds, no-show and late cancellation fees, payment dates, amounts, statuses, payment method type and last four digits, tokenized Stored Payment Method references, receipt records, and dispute and chargeback records. Full card numbers are held by our PCI DSS compliant payment processor, not by Workee.
4.5 Verification data
Phone numbers used for one-time security codes at checkout, and the issuance, delivery and use records for those codes. Codes are single-use, time-limited and stored only in hashed form.
4.6 Messaging data
Message content, channel (SMS or email), sender identity, recipient, send and delivery status, carrier response codes, engagement events such as opens and clicks where applicable, complaint and spam reports, and opt-out records.
4.7 Campaign data
Campaign configuration, audience criteria and membership, message variants, send schedule, and aggregate performance metrics.
4.8 Content you upload
Documents, images and files uploaded to Client records, including client photographs where the User has obtained consent. See Section 4.10.
4.9 Consumer health data
Where a User’s business offers medical, aesthetic, dental or wellness services, information such as stated service interests, treatment enquiries, appointment history and free-text notes may constitute consumer health data under the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, the Connecticut Data Privacy Act and comparable laws, and sensitive personal information under the CCPA/CPRA and other state privacy statutes. Workee processes such data only as a processor, on the User’s instructions, for the purpose of providing the Services. We do not sell consumer health data and we do not share it for cross-context behavioral advertising. The User is responsible for obtaining the consents and providing the notices those laws require. See Section 10.4.
4.10 Images and biometric identifiers
The Platform is not configured to derive biometric identifiers, and we do not perform facial recognition or facial geometry analysis on uploaded images. Users are prohibited from using the Platform to collect biometric identifiers without the consent required by the Illinois Biometric Information Privacy Act, the Texas Capture or Use of Biometric Identifier Act or comparable law.
4.11 Protected Health Information
You must not submit PHI unless a Business Associate Agreement with Workee is executed and in effect and Workee has confirmed in writing the specific Services and configurations approved to process PHI. Contact legal@workee.ai before any proposed PHI use. A request, BAA template, subscription or marketing statement does not authorize PHI processing or establish HIPAA compliance. Eligibility requires assessment of safeguards and downstream providers and is not guaranteed. An executed BAA governs PHI within its approved scope and overrides conflicting terms of this Policy. PHI is excluded from Section 7.3 in all circumstances. Neither these conditions nor the BAA waive statutory obligations.
5. Where Data Comes From
- From you, when you register, configure your Account, buy a subscription, contact support or use the Platform.
- From your Staff Users, when they use the Account.
- From your clients and website visitors, when they book, pay, submit a Lead Form or reply to a message.
- From connected services you authorize, such as your practice management, calendar, video or payment provider.
- From analytics and product tools used on the Platform, described in Section 10.2.
- From payment processors, in the form of transaction outcomes, dispute notices and tokenized payment references.
6. Legal Bases for Processing
Where the GDPR or UK GDPR applies to our processing as controller:
Where we act as processor (Section 4), the User determines the legal basis and is responsible for establishing it.
7. How We Use Personal Data
7.1 To provide the Services
Authenticate you, operate bookings, payments, messaging, campaigns, reporting and integrations, deliver support, and send service, security, billing and legal notices.
7.2 To secure and improve the Services
Detect and prevent fraud, abuse and unauthorized access; monitor complaint, opt-out and delivery rates to protect messaging deliverability and comply with carrier requirements; diagnose faults; measure feature adoption; and develop new features.
7.3 To improve our AI models — de-identified and aggregated only
We may use data derived from use of the Platform to develop, train, evaluate and improve our models and features only in de-identified and aggregated form. This use excludes PHI, excludes identifiable Client Data and Lead Data, and excludes any Account covered by a Business Associate Agreement. A Business Account may opt out entirely by writing to privacy@workee.ai; we will action the opt-out within thirty (30) days.
7.4 To market to you
We may send marketing about Workee to Users and prospects, subject to the consent required in your jurisdiction. You can opt out at any time using the link in the message or by writing to privacy@workee.ai. We do not use Client Data or Lead Data to market to your clients on our own behalf.
8. AI Features and What They Process
8.1 Workee Co-Pilot
Co-Pilot processes business data in your Account — sales and transactions, clients, services and products, and performance indicators — to generate insights, summaries and recommendations for you. Its output is advisory. It does not constitute automated decision-making producing legal or similarly significant effects concerning any individual.
8.2 AI Agents
Where enabled, an AI Agent composes, schedules and sends messages on the User’s behalf using Client and Lead records, booking and communication history, and recorded communication preferences. The User directs the messaging and acts as controller; Workee processes the data on its behalf. Messaging is subject to the consent, opt-out and control prerequisites in Section 9. This description does not represent that automatic suppression is implemented across every sending path.
8.3 Campaign autogeneration
The Services can generate campaign headlines, SMS and email copy, calls to action, alternative message versions and suggested audiences. Suggested audiences are produced by analysing Client and Lead records in the User’s own Account — including booking history, spend and stated service interests — and are not built from data belonging to other Users. Generated content is a draft that the User must review and approve before sending.
8.4 Model providers
Where third-party model providers support AI features, Workee must identify the applicable providers through the process in Section 10.2. Before customer data is supplied to a model provider, Workee must verify the applicable processing terms, including restrictions on that provider’s use of the data to train its own general-purpose models. This Policy does not represent that every provider contract already contains a verified no-training restriction. Data must not be supplied for the affected feature until required contractual protections are in place.
8.5 Automated decision-making and profiling
We do not make decisions producing legal or similarly significant effects about any individual solely by automated means. Audience suggestions and message personalisation constitute profiling for marketing purposes and are carried out by the User as controller; recipients may opt out at any time as described in Section 9.
9. Messaging, Consent and Opt-Out
Recipients may request that messages stop by contacting the sending business or using the opt-out method included in a message. Requests received by Workee at support@workee.ai will be routed to the business and addressed within the period required by applicable law. Before SMS sending is enabled, Workee must verify required keyword handling, including STOP and HELP, and suppression across the sending paths used by the program, including AI Agents and automations. Before email sending is enabled, an effective unsubscribe mechanism must be verified. If required controls are unavailable or fail, affected sending must remain disabled or be paused. This Policy does not promise automatic or immediate processing, universal keyword support or cross-channel suppression. The User and Workee must honor valid opt-outs and must not bypass applicable suppression; the User must monitor recipient requests and stop affected communications. This does not reduce Workee’s own legal obligations.
Message and data rates may apply, and message frequency varies.
One-time security codes sent to verify a saved card at checkout are transactional messages, sent only as part of a transaction the recipient has initiated. They are not marketing and may continue to be delivered after a marketing opt-out, to the extent permitted by law.
Opt-out records are retained for as long as necessary to keep the suppression effective and to evidence compliance, and are retained after account or record deletion for that purpose. This is required: deleting an opt-out record would allow messaging to resume.
Consent records captured on Lead Forms — form version, timestamp, IP address and the selections made — are retained as evidence of consent for the period described in Section 12.
The User is responsible for the consent required for its messages. Workee is responsible for its processing obligations and for verifying the required controls before enabling the affected sending paths, as described above. Contract wording does not substitute for working opt-out controls.
10. Sharing and Disclosure
10.1 We do not sell personal data
Workee does not sell personal data and does not share it for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA and comparable state laws. We have not done so in the preceding twelve months. We do not sell or share consumer health data or sensitive personal information under any circumstances.
10.2 Sub-processors and service providers
We share personal data with service providers for the functions summarized below, subject to applicable written processing terms. Before processing governed by a DPA begins, Workee must provide the applicable provider list, including identities, functions and processing locations, and obtain any required authorization. Contact privacy@workee.ai for the list applicable to your Services. Change notices and any opportunity to object are governed by the executed DPA and applicable law. This Policy does not represent that a public register or notification subscription is available.
10.3 Other disclosures
We may disclose personal data: to comply with law or a valid legal request; to enforce our Terms of Use; to protect the rights, property or safety of Workee, our Users or the public; to a carrier or regulator investigating a messaging complaint; to professional advisers under confidentiality; and in connection with a merger, acquisition or sale of assets, subject to notice and to this Policy continuing to apply.
10.4 Consumer health data — additional commitments
We will not sell consumer health data. We will not disclose consumer health data to a third party except to a service provider listed in Section 10.2 acting on documented instructions, or where required by law. Where a User instructs us to process consumer health data, the User warrants it has obtained the consent and provided the notice required by applicable law. Requests concerning consumer health data may be sent to privacy@workee.ai marked “Health Data” and will be handled on the timeline in Section 13.
11. Cookies and Tracking
The cookies and similar technologies used on the Platform, their purposes and their storage periods are described in the Cookie Policy at workee.ai/cookies. Non-essential cookies are set only where you consent through the cookie banner, and you can change your choices at any time through the banner control or your browser settings.
Global Privacy Control. We treat a Global Privacy Control or other recognised universal opt-out signal received from your browser as a valid request to opt out of the sale or sharing of personal data and of targeted advertising, in the jurisdictions where that is required. Because we do not sell or share personal data, the practical effect is to disable non-essential advertising cookies.
Do Not Track. There is no consistent industry standard for browser Do Not Track headers, and we do not respond to them separately from the Global Privacy Control signal described above.
12. Data Retention
A request for erasure is honoured on the timeline required by law and is not subject to the 30-day restoration period. Records we are required to keep by law, or that are needed to keep an opt-out effective, to resolve a dispute or to enforce our agreements, are retained for that purpose only.
13. Your Rights
13.1 United States
Depending on your state of residence, you may have the right to: know what personal data we hold and how we use it; access a copy; correct inaccurate data; delete data; obtain a portable copy; opt out of the sale or sharing of personal data and of targeted advertising; opt out of profiling in furtherance of decisions producing legal or similarly significant effects; limit the use of sensitive personal information; and appeal a decision on your request. These rights are available under the laws of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, among others, and vary by state.
We respond within 45 days, extendable by a further 45 days where reasonably necessary, and will tell you if we need the extension. If we decline a request, you may appeal by replying to our response; we will decide the appeal within 45 days and, if we deny it, tell you how to complain to your state Attorney General.
Washington, Nevada and Connecticut consumer health data. Residents of these states have specific rights concerning consumer health data, including the right to confirm whether we process it, to access it, to withdraw consent, and to have it deleted. Because Workee processes consumer health data as a processor on behalf of Users, we will route your request to the relevant business and assist them in responding, and will action it directly where we are able.
We do not discriminate against you for exercising any of these rights.
13.2 Canada
Under PIPEDA and applicable provincial legislation, including Quebec’s Law 25, you have the right to access, rectify, delete and port your personal data, to withdraw consent, to object to processing, to request that we cease disclosing or de-index information about you, and not to be subject to a decision based exclusively on automated processing. We respond within 30 days. You may complain to the Office of the Privacy Commissioner of Canada or your provincial regulator.
13.3 Europe and the United Kingdom
Where the GDPR or UK GDPR applies, you have the right of access, rectification, erasure, restriction, portability, objection (including to processing based on legitimate interests and to direct marketing), and the right to withdraw consent at any time without affecting prior processing. We respond within one month, extendable by two further months for complex requests. You may complain to your supervisory authority.
13.4 How to exercise your rights
Write to privacy@workee.ai. We will verify your identity before actioning a request, and may ask for information to do so. An authorized agent may submit a request on your behalf with proof of authority. If your request concerns data we hold as a processor for a Workee User — that is, if you are a client of a business that uses Workee — we will forward it to that business and tell you we have done so.
14. International Transfers
Personal data is stored and processed in the United States on Amazon Web Services infrastructure. Where a transfer from the European Economic Area, the United Kingdom or Switzerland requires a transfer safeguard, Workee must put a valid applicable mechanism in place before the transfer. Where Standard Contractual Clauses, a UK Addendum or other contractual safeguards are used, the relevant documents must be completed and executed, with required assessments and supplementary measures. This Policy does not itself execute a transfer instrument or confirm that one is in place for a particular transfer. Information about the mechanism applicable to your data may be requested at privacy@workee.ai.
15. Security
Workee must maintain administrative, technical and physical safeguards appropriate to the processing and required by applicable law and any executed DPA or BAA. Information about applicable safeguards may be requested at security@workee.ai. This Policy does not incorporate a security webpage or assert a platform-wide HIPAA, PCI or other certification. Payment card processing is handled by third-party payment processors; Workee does not store full card numbers.
No system is perfectly secure. If you believe your Account has been compromised, or you have found a vulnerability, write to security@workee.ai.
Breach notification. We will notify affected Users without undue delay, and within seventy-two (72) hours of becoming aware, of a personal data breach affecting their data, and will provide the information they need to meet their own notification obligations. Where a Business Associate Agreement is in effect, its notification terms govern for PHI.
16. Children
The Platform is not directed to children and Users must be 18 or older. A User’s clients may include minors — for example at a dental or dermatology practice. Where a client is under 18, or under 13 for online data collection subject to COPPA, the User is responsible for obtaining verifiable parental or guardian consent before collecting the minor’s personal data or sending any communication, including to a telephone number. We do not knowingly collect personal data from a child as controller. If you believe we have, write to privacy@workee.ai and we will delete it.
17. Changes to This Policy
We may update this Policy. Where a change is material, we will notify Account Owners by email and post the revised Policy with an updated “Last Updated” date at least thirty (30) days before it takes effect, and will seek fresh consent where the law requires it. The current version is always available at workee.ai/privacy-policy.
