Privacy Policy

1. Who we are

WorkBench is a business management app for UK trades businesses. The business that signs up (the "Owner") controls their own account; the Owner can invite team members ("Staff") and clients ("Client") who get narrower access to just what's relevant to them.

2. What we collect

Account details: name, email, phone, business details (company name, VAT/CIS/UTR numbers, address).

Business data you enter: jobs, quotes, invoices, costs, hours, team members, calendar events, check-ins, photos, documents, contracts.

Financial data: invoice/payment records, and — only if you choose to connect them — Xero or QuickBooks accounting data and TrueLayer open banking data (account balances and transactions, read-only, only for accounts you explicitly connect).

Google Account data, only if you explicitly connect a Google account: Gmail messages (reading, composing, sending, organising your inbox), Google Calendar events, and Google Tasks — see section 4 below for exactly how this is used.

Communications: emails, WhatsApp messages and SMS you send or receive through the app if you connect those accounts; phone call recordings and transcripts if you use the call-logging feature (see the in-app consent notice shown every time before a call is recorded).

Location: only while using the app, and only if you grant location permission, to log site check-in locations.

Device/usage data: standard technical data needed to run the app (device type, crash logs, push notification tokens).

3. How we use it

To provide the service you signed up for: running your jobs, invoicing, scheduling, and the AI assistant features (which send relevant business data to Anthropic’s Claude API to generate drafts, answer questions, and take actions you direct). We do not sell your data.

4. Google user data (Gmail, Calendar, Tasks)

If you choose to connect your Google account, WorkBench requests the following Google API scopes and uses them only as described:

• Gmail (read, compose, send, organise your inbox) — so you can view, reply to, and manage work emails from inside WorkBench instead of switching apps. • Google Calendar (create and edit events) — so jobs you schedule in WorkBench appear on your Google Calendar and vice versa. • Google Tasks (create and edit tasks) — so to-dos created in WorkBench can sync to your Google Tasks list.

If you use the AI Assistant to draft a reply, summarise, or otherwise act on a specific email, the content of that email is sent to Anthropic’s Claude API to generate the response — this only happens for the message you’re actively working with, when you actively use that feature, never as a background process over your whole inbox.

WorkBench’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Gmail, Calendar, or Tasks data for advertising, we do not sell it, and we do not allow anyone to read it except: (a) with your explicit consent, (b) where needed for security purposes (e.g. investigating abuse), (c) to comply with applicable law, or (d) where the data has been aggregated and anonymised. You can disconnect your Google account at any time from Settings, which revokes WorkBench’s access.

5. Who we share it with

Only the processors needed to run the features you use: Supabase (hosting/database), Anthropic (AI assistant), Twilio (SMS/calls), Meta/WhatsApp Business (WhatsApp messaging), Xero or Intuit QuickBooks (accounting sync, if connected — only one at a time), TrueLayer (open banking, if connected), Stripe (payment processing, if connected), Google/Microsoft (email/calendar/tasks sync, if connected), and push notification providers. Each only receives what’s needed for that specific feature.

6. How long we keep it

For as long as your account is active. If you request deletion (see the "Request Account Deletion" option in the app), we’ll action it as described there. Disconnecting a Google account (Settings) deletes the associated access tokens immediately, independent of any wider account deletion request.

7. Your rights (UK GDPR)

You can: access the data we hold about you, correct it, ask us to delete it, export it in a portable format, restrict or object to certain processing, and complain to the ICO (ico.org.uk) if you think we've got it wrong. Use the "Export My Data" and "Request Account Deletion" actions in the app, or email toolbeltsoftware@gmail.com.

8. Security

Data is protected using row-level access controls so accounts can only see their own business's data (and staff/client accounts only what's relevant to them). No system is perfectly secure; we take reasonable technical measures and keep improving them.

9. Children

WorkBench is a business tool, not intended for anyone under 18.

10. Changes

We'll update this policy as the app changes and note the date at the top.

11. Contact

toolbeltsoftware@gmail.com