Privacy Notice

Legal

Privacy Notice in plain language.

Most of your data never reaches us at all. This page says exactly what does, why we have it, and what you can make us do about it. Ensure data privacy in AI by keeping your operations local

Last updated 28 August 2026. Version 2026-08-28.1.

• Account details — your name, email address and password hash. We need these to have an account at all. Kept until you delete the account.
• API keys you choose to store — held so your workers can run. Kept until you remove them.
• Organisation membership — which org you belong to, if you joined one, so that shared workflows and settings reach the right people.
• Billing records — what you paid and when. Tax law requires us to keep these after you leave, so deleting your account does not delete them.
• Operational logs — errors and usage counts, used to keep the product running and to bill correctly.
• Consent record — the version of these terms you accepted, and when. We are required to be able to show this.

We do not sell personal data, and we do not share it for cross-context behavioural advertising. Your content is not used to train third-party models.

For your own account details, we are the controller. But for personal data you bring into Workforce 2.0 — a customer list, a lead's phone number, a CV, an inbox — you are the controller and we act as your processor. We handle that data on your instructions and for no purpose of our own.

That split has consequences for you. You are the one who needs a lawful basis for holding those records. You are the one who must answer if that person asks for a copy, or asks to be deleted. We will help you do it, and we will not use the data for anything else, but we cannot supply a lawful basis you do not have.

Do not upload special-category data — health records, biometrics, government identifiers — unless a signed agreement covering it is in place. Workforce 2.0 is not a HIPAA-covered entity by default, and no Business Associate Agreement exists unless we have executed one with you in writing. Without that, Protected Health Information does not belong in the product.

• Get a copy of the personal data we hold about you, in a portable format.
• Correct anything wrong.
• Delete your account and the data attached to it, except records we are legally required to keep, such as invoices.
• Withdraw consent at any time. This does not undo processing that already happened lawfully before you withdrew.
• Object to or restrict processing.
• Opt out of sale or sharing — there is nothing to opt out of, because we do neither, but the right stands, and asking will never cost you service or a worse price.
• Complain to your data protection authority. In the EU or UK that is your national regulator; in Hong Kong, the Privacy Commissioner for Personal Data.

Email support@trackmystartup.com to use any of these. We answer within 30 days, and a first request is free.

These rights come from the GDPR and UK GDPR, the California Consumer Privacy Act as amended by the CPRA, and Hong Kong's Personal Data (Privacy) Ordinance. Similar laws elsewhere are handled the same way.

Account details and stored keys last as long as the account does, and go when you delete it. Billing records are kept for as long as tax and company law requires, which is longer than the account and is not something we can waive. Operational logs are kept only as long as they are useful for running and billing the product, then dropped. Data you uploaded is deleted when you delete it, or when your account goes.

Data is encrypted in transit and at rest. Access is limited to the people who need it to do their job. Sending, publishing and spending all stop and wait for your approval, and no answer counts as a refusal rather than a silent send — the data page covers that machinery in detail.

No system is immune, so here is the commitment that matters. If a breach affects your personal data, we will tell you and notify the relevant regulator within the deadline the law sets — 72 hours of becoming aware, where the GDPR applies. We will tell you what was taken and what to do about it. We will not sit on it, and we will not describe it as a routine incident to avoid the word.

Running the product means a small number of other companies touch data: our hosting and authentication provider, our payment processor, and the AI providers used to complete your task. AI providers receive the content of the request you send them and are governed by their own terms, which is worth reading if the content is confidential.

Where data leaves the UK or EEA, transfers rely on the UK and EU Standard Contractual Clauses. Ask us for the current sub-processor list and we will send it.

If we change anything material, we bump the version and ask you to accept it again rather than quietly editing this page. The version you accepted is recorded against your account. The Terms of Service sit alongside this notice.