Privacy Policy
This policy explains what Consecrated Tech LLC, doing business as Workpane ("Workpane", "we", "us"), collects when you use the Workpane service and websites (the "Service"), why, who sees it, and the choices you have. It is part of our Terms of Service.
In one paragraph: we collect what you type into Workpane and what is needed to run it securely. We do not sell personal information, we do not show ads, and we do not use your data to train anything. Your workspace's administrator controls your workspace's data; we process it on their behalf.
1. Two roles: us and your workspace
Workpane is used by companies ("workspaces"). For the data a workspace puts in (tasks, notes, photos, messages, the names and emails of its people), the workspace's administrator decides what is collected and who may see it, and we process that data on the workspace's instructions. If you are a worker, contractor or viewer in someone's workspace, questions about that data go to that workspace's administrator first. For the data we collect to run the Service itself (accounts, sign-in security, billing, support), we decide how it is used, and this policy describes that.
2. What we collect
Account information. Name, email address, password (stored only as a one-way hash), workspace name, role, and preferences such as theme and notification settings. If you turn on two-factor sign-in, a secret for your authenticator app and hashed recovery codes.
Workspace content. What you and your workspace put in: sites, Work, tasks, steps, notes, photos and files, messages, time entries, custom fields, and reports built from them. Photos have location and camera metadata removed when uploaded.
Usage and security data. Sign-in times, the IP address and browser used, pages and actions used in the Service, device type, and error reports. We keep logs of security-relevant events such as failed sign-ins, password changes and administrative actions.
Billing information. Plan, seat counts, invoices, and the last four digits and expiry of a payment card. Full card numbers are handled by Stripe and never reach our servers.
Communications. Email you send us, beta requests from our website, and your responses to our emails.
We do not knowingly collect government identifiers, financial account numbers, or health information, and the Service is not designed for them. Do not put them in Workpane.
3. How we use it
To provide and operate the Service; to sign you in and keep your account secure, including checking a new password against a public list of leaked passwords by sending only a partial hash; to send the notifications you choose and the service emails the account needs (sign-in links, password resets, billing receipts, security notices); to bill you; to answer support requests; to understand how the Service is used so we can improve it; to detect and prevent abuse, fraud and attacks; and to comply with law. We do not sell personal information and do not use workspace content for advertising or to train machine-learning models.
4. Who sees it
Your workspace. People in your workspace see what their role allows, as set by the workspace's administrator.
Our providers. We use a small number of providers to run the Service, each bound to use data only to provide their service to us: Cloudflare (network delivery, security filtering and the sign-in gate), Postmark (sending email), Stripe (payments), and Have I Been Pwned (leaked-password checks, which receive only a partial hash, never the password). Our servers are our own; we do not use a public cloud provider for storage of workspace content.
Legal and safety. We may disclose information if required by law, subpoena or court order, to protect the rights, property or safety of Workpane, our users or the public, or to investigate fraud or abuse.
Business transfers. If Workpane is sold, merged or reorganized, information may transfer to the successor, who will be bound by this policy.
We never sell or rent personal information, and we do not share it with advertisers.
5. Cookies and tracking
The Service uses only the cookies it needs to work: a session cookie that keeps you signed in and a token that protects forms from forgery. Your theme and display choices are kept in your browser's local storage. Our websites use no advertising cookies, no social-media trackers and no third-party analytics. We do not respond to "Do Not Track" signals because we do not track you across other sites.
6. How long we keep it
Account and workspace data is kept while the workspace is active. When a workspace is closed, or has been inactive on the Free plan for a long time after notice, we delete its content within 90 days, except for backups, which expire on their own schedule, and records we must keep for tax, billing, legal or security reasons. Security logs are kept for up to 12 months. Beta-request submissions from the website are kept until the beta ends or you ask us to delete them. Deleted data may persist in backups for a limited period before it is overwritten.
7. Security
We protect data with encryption in transit, hashed passwords, optional two-factor sign-in, role-based access control inside each workspace, network filtering in front of the Service, rate limits, security monitoring, nightly security updates, and regular backups. No service can promise perfect security. If we learn of a breach that affects your personal information, we will notify the affected workspace administrators and, where the law requires, you, without unreasonable delay.
8. Your choices and rights
You can see and change your account information and notification settings in the Service, and export your workspace's data. You can unsubscribe from notification emails with the link in each one; service emails about security and billing continue while you have an account. You can ask us to access, correct, export or delete personal information we hold about you by emailing the address below; for data inside a workspace we will refer the request to that workspace's administrator where appropriate. We will respond within 30 days and may ask you to verify your identity. Residents of states with privacy laws (such as California) have the rights those laws provide; we do not sell or share personal information for cross-context advertising, so there is nothing to opt out of.
9. Where data lives
The Service is operated from the United States, and data is stored on servers we control in the United States. If you use the Service from elsewhere, you are sending your information to the United States, where laws may differ from those where you live.
10. Children
The Service is for businesses and adults. We do not knowingly collect information from anyone under 18, and workspaces may not add anyone under 18. If you believe a child's information has been collected, contact us and we will delete it.
11. Changes
We may update this policy. Material changes will be announced in the Service or by email at least 14 days before they take effect. The version and effective date are shown at the top.
12. Contact
Consecrated Tech LLC, doing business as Workpane
80 Seven Hills Blvd, Ste 101, PMB 286
Dallas, Georgia 30132
[email protected]