WorkHoist — Privacy Policy
Last updated: 22 September 2026
Who we are
WorkHoist is operated by TekConnected LLC, a Wyoming limited liability company, of 30 N Gould St, Sheridan, WY 82801. We are the controller of the personal data described here.
Questions, or to exercise any right below: mike@workhoist.app
What this covers
Two different kinds of data, and it matters which is which.
Our customer data — information about you, the business that subscribes: your name, email, phone, company details, billing information, and how you use the platform. We are the controller of this.
Your business data — everything you put into WorkHoist about your own jobs: clients, subcontractors, contacts, estimates, invoices, photographs, daily logs. This often contains other people's personal data. You are the controller of it. We are your processor. We only handle it to run the service for you, on your instructions.
What we collect
You give us: account and contact details, company information, billing details (processed by Stripe — we never see full card numbers), anything you enter into the platform, and anything you send us in support.
We collect automatically: log data (IP address, browser, pages visited, timestamps), usage data, and cookies necessary to keep you signed in.
From others: payment confirmation from Stripe.
We run cookieless analytics on our public marketing pages, provided by Vercel. It records page views and referrers in aggregate — which pages are read and where visitors arrived from — and a small number of aggregate interaction events: which call-to-action was clicked and which page it was clicked from, and whether a demo booking was completed. It sets no cookies, does not identify individual visitors, records nothing you type, and does not follow anyone across other websites. We run no advertising or session-recording software anywhere.
Why we use it
- To provide WorkHoist and keep your account working
- To take payment and manage your subscription
- To provide support
- To keep the service secure and investigate misuse
- To send service messages about your account
- To send product and marketing email, where you have consented or where we have a legitimate interest — you can unsubscribe from any of it
- To meet legal obligations
Legal bases where GDPR or UK GDPR applies: performance of a contract, legitimate interests, consent, and legal obligation.
Artificial intelligence
This section is deliberately specific, because AI features move your data to third parties.
Bob, the in-app assistant. When you ask Bob a question, the relevant parts of your business data are sent to our AI provider, OpenAI, to generate an answer. Bob is read-only and role-aware — it cannot change anything, and it only sees what the asking user could already see.
OpenAI does not use data sent through their API to train their models. That is their published policy for API traffic and it is the traffic WorkHoist sends: “data sent to the OpenAI API is not used to train or improve OpenAI models (unless you explicitly opt in to share data with us)” (OpenAI, how we use your data). It is different from ChatGPT, the consumer product, where conversations may be used for training. The same documentation states that OpenAI retains abuse-monitoring logs for up to 30 days unless longer retention is required by law, so API traffic is not used for training and is not discarded instantly either.
MCP connections. You may connect WorkHoist to an outside AI client such as Claude or ChatGPT. This is off by default and only an administrator can enable it. Once connected, that client can read the data its credential allows, and — if you grant write access — create and change records.
When you connect an external AI client, your data goes to that provider under their privacy policy, not ours. We cannot control what they do with it. You can revoke any connection at any time in Settings, and revocation takes effect immediately.
Who else processes your data
| Processor | What for | Where |
|---|---|---|
| Vercel | Hosting, delivery and cookieless analytics | United States |
| Supabase | Database and file storage | United States (us-east-1) |
| Stripe | Payments and subscriptions | United States |
| Resend | Transactional and marketing email | United States |
| OpenAI | Powers the Bob assistant | United States |
| Calendar and email integration, where you connect it | United States | |
| Microsoft | Outlook inbox connection, where you connect one | United States |
| Cal.com | Demo booking | United States |
| monday.com | Signup notifications | United States |
We do not sell your data and we do not share it for anyone else's advertising.
International transfers
Our infrastructure is in the United States. If you are in the UK or EEA, your data is transferred there under Standard Contractual Clauses, or the UK International Data Transfer Addendum where the UK GDPR applies.
How long we keep it
Account and business data: kept for 90 days after you cancel so you can reactivate or export it, then deleted from our live systems. Any internal backup copy is removed within a further 30 days. You can ask us to delete it sooner at any time: email mike@workhoist.app.
Billing records: 7 years, as tax law requires.
Security and audit logs, including IP addresses: 90 days, then deleted.
Security
Data is encrypted in transit and at rest. Access is restricted by role. Every request is scoped to your account, and every database query the application makes is filtered by your account identifier, so one customer's data is never returned to another. API keys and AI connections can be revoked instantly and take effect on the next request.
No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant regulator as the law requires.
Your rights
Depending where you live you may have the right to access your data, correct it, delete it, object to or restrict processing, take it elsewhere in a portable format, and withdraw consent.
If you are in California you may also have the right to know what we collect and to opt out of "sale" or "sharing" — we do neither.
Email mike@workhoist.app and we will respond within 30 days. You may also complain to your data protection authority — in the UK, the Information Commissioner's Office.
If your request concerns data one of our customers holds about you, ask that customer directly. They control it; we only process it for them.
Cookies
We use only the cookies necessary to keep you signed in and to keep the service secure. We set no advertising or tracking cookies, and our analytics are cookieless, so a logged-out visitor to our website is given no cookies at all. Because we use no non-essential cookies, there is no consent banner to click through.
Children
WorkHoist is a business tool and is not intended for anyone under 18. We do not knowingly collect children's data.
Changes
We will post any update here and change the date at the top. If a change materially affects your rights we will tell you by email or in the app.