WorkSeat Privacy Policy

This policy describes how WorkSeat handles information in connection with the WorkSeat platform and its public pages. WorkSeat is a business tool: most information in the platform is entered by a customer organization (a “workspace”) about its own operations, clients, locations and personnel.

For that information, the workspace decides what is collected and why, and WorkSeat processes it on the workspace’s behalf in order to run the Service. If you are a client, contact or employee of a company that uses WorkSeat, please direct questions about that company’s records to that company.

WorkSeat collects information needed to create and secure accounts:

• name and email address;
• authentication data handled by the platform’s managed authentication service, including a password hash or a federated sign-in identity where a workspace uses one — WorkSeat does not receive or store plaintext passwords;
• workspace membership, assigned role, and the organizations or sites a member is permitted to see;
• optional profile details such as a job title, phone number or profile photo;
• invitation and access-request records, and permission-change audit records.

Email confirmation is required at sign-up, so a confirmation message is sent to the address provided.

Workspaces use WorkSeat to store and work with:

• Client and company records — company names, statuses, billing details, branding, notes and relationship history;
• Contacts — names, job titles, business email addresses and phone numbers, relationship roles, responsibilities and communication history;
• Sites and locations — addresses, levels, zones, buildings, access details, site-specific scope and site contacts;
• Operational records — jobs, operations, programs, schedules, crew assignments, timing, completion and progress records;
• Estimates, proposals and invoices — services, quantities, pricing, totals, revisions, recipients, approvals, questions and replies, and payment records;
• Documents and photos — field documentation, checklists, proof of work photos and attachments, stored in private file storage and served through time-limited signed links;
• Messages and activity — internal messages, notifications and activity history connected to that work.

Where a workspace enables business-contact enrichment, WorkSeat can request publicly-available professional details about a business contact from a licensed third-party business data provider. Enrichment runs server-side, records the source and confidence of each field, and never overwrites a value a person entered manually.

When the Service is used, WorkSeat’s infrastructure and its providers process standard technical information such as IP address, browser and device characteristics, request paths and timestamps, and error and diagnostic details. This is used to operate the Service, investigate errors, and protect against abuse.

Some features record their own operational logs — for example email delivery results, integration sync results and errors, and audit records of sensitive actions such as permission changes.

WorkSeat uses information to:

• authenticate users and enforce role- and assignment-based access;
• provide the platform’s features to the workspace that owns the data;
• send operational email such as invitations, confirmations, password resets, notifications, and customer-facing proposal, gallery and invoice links a workspace chooses to send;
• synchronize records with integrations a workspace has connected;
• generate or revise text through AI-assisted features, where a user explicitly invokes them;
• monitor reliability and security, investigate incidents, and prevent abuse; and
• provide support requested by a workspace.

Sign-in, session tokens, email confirmation and password resets are handled by the platform’s managed authentication service. Sessions are held by the browser so a signed-in user stays signed in; server functions that touch protected data verify the caller’s session on every request, and database access rules restrict rows to the workspace and access scope of the caller.

Application data is stored in a managed cloud database, and files, documents and photos are stored in private cloud file storage. Traffic to WorkSeat and to the services it calls travels over HTTPS/TLS.

Security measures actually implemented in WorkSeat include:

• row-level access rules on data tables, so records are scoped to the workspace and role;
• server-side verification of the caller for privileged operations, with audit records for permission changes;
• private (non-public) file storage, with time-limited signed links for customer-facing media;
• unguessable tokens for customer-facing proposal, gallery and share links, revocable by the workspace;
• integration credentials such as accounting access and refresh tokens stored server-side in encrypted form and never returned to the browser.

No system can be guaranteed secure. WorkSeat does not claim any specific security certification or audit at this time.

WorkSeat uses a limited set of providers to operate the Service. Each receives only the information needed for its function:

• Cloud application, database, authentication and file storage provider — hosts the application and stores workspace data, accounts and files;
• Transactional email provider — delivers invitations, confirmations, notifications and customer-facing links, and returns delivery results;
• AI model providers, reached through the platform’s AI gateway — process the text a user submits to an AI-assisted feature, plus the proposal or record context needed to answer it;
• Google Maps Platform — address lookup and geocoding for site addresses;
• Intuit (QuickBooks Online) — where a workspace connects the accounting integration;
• Business contact data provider — only where a workspace enables contact enrichment.

Integrations are connected by an authorized workspace administrator, not by WorkSeat. Connecting an integration authorizes the exchange of the information required for that integration to work. Information sent to or received from a third-party service is also subject to that provider’s own terms and privacy policy.

A workspace owner or administrator can connect QuickBooks Online by completing an Intuit-hosted authorization. WorkSeat receives access credentials scoped to the specific QuickBooks company that was authorized, stores them server-side in encrypted form, and uses them only for that workspace’s connection.

What may be accessed when authorized: customer records, vendor records, invoices and their line items, payments, balances and payment status, vendor bills, and the identifiers, timestamps and status metadata of those records in the connected company.

Why: so a workspace does not have to create the same client or invoice twice. WorkSeat resolves or creates the matching QuickBooks customer when the first accounting transaction for a client is posted, creates the corresponding QuickBooks invoice, stores permanent identifier mappings to prevent duplicates, and reads payments, balances and payment status back so operational screens reflect the accounting system of record.

How it is used: only to provide the integration to that workspace — to display accounting state, reconcile payments, and support accounts-payable workflows. Connected accounting information is not used for advertising and is not shared with other workspaces.

How to disconnect: an owner or administrator can disconnect at any time from Settings → Integrations in WorkSeat, or revoke WorkSeat’s access from within Intuit. On disconnection WorkSeat stops requesting data and discards the stored access credentials. Records already created in QuickBooks remain in QuickBooks; records already in WorkSeat remain in WorkSeat.

Access tokens, refresh tokens, client identifiers and secrets are never displayed in the application, included in exports, or shared with third parties.

Information is shared only:

• within the workspace that owns it, according to role and assignment;
• with recipients a workspace deliberately sends to — for example a client contact who receives a proposal, photo gallery or invoice link;
• with the service providers listed above, to perform their function;
• where required by law, or to protect the rights, safety and security of WorkSeat, its customers or the public; and
• in connection with a corporate transaction, where the recipient remains bound by this policy.

WorkSeat does not use Customer Data for advertising, and does not disclose one workspace’s data to another.

WorkSeat uses browser storage and cookies that are necessary for the application to work — primarily to keep a signed-in session and to remember interface preferences. These public legal pages do not require sign-in and do not set advertising cookies. WorkSeat does not run third-party advertising trackers on the platform.

Workspace records are retained for as long as the workspace keeps them and its account remains active, because operational, financial and documentation history is the purpose of the platform. Records deleted or archived by a workspace are removed or hidden according to that action, and may persist in encrypted backups for a limited period before those backups cycle. Operational logs and audit records are kept as long as needed for security, reliability and accountability. WorkSeat does not publish a fixed retention period for each record type; a workspace may agree specific retention requirements in writing.

A workspace administrator can remove members, revoke share links, disconnect integrations, and delete or archive records directly in the application. For a copy of workspace data, or deletion of a workspace and its data, an owner or administrator can contact admin@workseat.app.

Individuals whose information appears in a workspace’s records — for example a client contact — should contact that company first, since it controls those records. WorkSeat will assist its customer in responding to such a request.

Depending on where you live, you may have rights to request access to, correction of, or deletion of personal information about you, or to object to certain processing. Requests can be sent to admin@workseat.app. Where WorkSeat processes information on behalf of a customer workspace, WorkSeat will refer the request to that workspace and support its response. Identity may need to be verified before a request is actioned.

This policy may be updated as the platform changes. The “Last updated” date at the top of the page reflects the current version, and material changes will be communicated to workspace administrators where appropriate.

Privacy questions, data requests and security reports can be sent to admin@workseat.app.