Privacy notice.

1. Who we are

This website (workings.io) is operated by Human Workings Ltd, a company incorporated in England and Wales with company number 16688102.

Registered address:
Human Workings Ltd
c/o PSF Accounting Ltd
13 St Mary's Street
Stamford
England PE9 2DE

For any privacy-related queries, contact us at: privacy@workings.io

Human Workings Ltd is the data controller for the personal information collected through this website.

2. What this privacy notice covers

This Privacy Notice covers the personal information collected through the workings.io website. Specifically the waitlist sign-up form, the report verification feature, and any direct communications you send to us. It does not cover the Workings desktop application or related services, which are subject to a separate Privacy Notice.

3. What personal information we collect

3.1 Waitlist sign-up

When you join our waitlist, we collect:

• Your email address
• Which best describes you - role type (selected from a list of checkboxes, e.g. Student, Academic / educator, Founder / business owner, Developer / engineer, Creative professional, Freelancer / contractor, Influencer / content creator, IP developer / inventor, Consultant, Full-time employee, Other)
• Your intended use case for Workings (selected from a list of checkboxes, e.g. Protect my IP, Prove the work is mine (authorship), Provide evidence of my creative process, Generate a timelapse of my work, Show how much is human vs AI, Track contribution in group / team work, Academic integrity / coursework, Build a portfolio / showcase my craft, Just curious / exploring, Other)
• Which country you are in (selected from a dropdown list, used to notify you when Workings is available in your region)

You provide this personal information voluntarily when you complete the waitlist form and check the consent box. We do not collect your name.

3.2 Direct contact

If you contact us by email, we will receive and store the contents of that communication, including any personal information you choose to include.

3.3 Report verification

If you use the report verification feature on our website, you submit a Report ID to verify the authenticity of a Workings report. The Report ID is not personal information. We do not collect any personal information about you as part of the verification process itself. However our standard server logs will record your IP address when you submit a verification request. This is handled in the same way as all other IP addresses collected through website visits — see Section 3.4 (Website analytics) for further detail.

3.4 Website analytics

We use Google Analytics to collect information about how visitors use this website. This may include:

• Pages visited and time spent on each page
• General geographic location (country or region level)
• Device type and browser
• How you arrived at the website (e.g. search engine, direct link)

Google Analytics uses cookies to collect this information. The personal information is aggregated and does not directly identify you. Analytics cookies are only set if you consent via the cookie notice on first visit; if you decline or do not consent, no Google Analytics script is loaded. Please see Section 6 (Cookies) for further detail.

4. How we use your personal information

We use the personal information we collect for the following purposes:

• To contact you about beta access and product updates, where you have given consent to this
• To understand the types of people joining the waitlist (including their roles and intended use cases) and the countries they are in, so we can shape the product and beta programme and notify users when Workings is available in their region
• To respond to enquiries sent to us by email
• To monitor and improve the performance and usability of this website (via aggregated analytics)
• To process report verification requests submitted through the verify feature on our website.

5. Legal basis for processing

We process your personal information on the following legal bases under UK GDPR and, where applicable, EU GDPR:

• Consent (Article 6(1)(a)): for storing your email address and survey responses (role type, intended use case, and country) to contact you about beta access and product updates. You provide this consent explicitly by checking the consent box on the waitlist form. You may withdraw consent at any time by contacting us at privacy@workings.io.
• Consent (Article 6(1)(a)): for website analytics via Google Analytics. Analytics cookies are only set after you accept them via the cookie notice on first visit. You may withdraw consent at any time through the Cookie preferences link in the footer.
• Legitimate interests (Article 6(1)(f)): for responding to direct email enquiries.
• Legitimate interests (Article 6(1)(f)): for processing report verification requests and the associated server log data. We have a legitimate interest in providing the verification service and in retaining server logs for security purposes.

Additional bases for non-UK/EU residents:

• Residents of US states with applicable privacy laws: we rely on the same consent and legitimate interests bases described above. A number of US states (including California under the CCPA/CPRA, Virginia under the VCDPA, Colorado under the CPA, and others) grant residents additional privacy rights set out in Section 10.3 below.
• Residents of Australia: we process your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We collect personal information that is reasonably necessary for our functions. Your rights under the APPs are set out in Section 10.2 below.

6. Cookies

This website uses cookies. Cookies are small text files stored on your device when you visit a website.

We use the following types of cookies and local storage:

Essential / functional storage (always active, never used for tracking):

• workings_consent — records your cookie choice (accept or reject) so we do not ask you again (browser local storage; expires after 12 months).
• workings_waitlist_draft — temporarily holds your waitlist form entry so it is not lost if you navigate away (cleared as soon as you submit).

Analytics cookies (set only if you choose "Accept" on the cookie notice): Google Analytics sets cookies such as _ga and _ga_<id> (lasting up to approximately 13 months) to distinguish visitors and measure traffic. If you decline, none of these cookies are set and no Google Analytics script is loaded.

You can opt out of Google Analytics tracking by using the Cookie preferences link in the footer (which also clears any existing analytics cookies), by installing the Google Analytics opt-out browser add-on, or by adjusting your browser settings to block cookies.

A cookie consent notice is displayed when you first visit the website. You may change your preference at any time via the Cookie preferences link in the footer.

7. Who we share your personal information with

We do not sell your personal information. We may share your personal information with the following third parties:

• Google LLC: for website analytics via Google Analytics. Google may process personal information in the United States. This is subject to Google's standard contractual clauses and data processing terms, and where applicable the EU-US and UK-US Data Privacy Framework.
• Google Workspace (Google LLC): we use Google Workspace to send emails to waitlist members about beta access and product updates. Google may process personal information in the United States under Google's Standard Contractual Clauses and, where applicable, the EU-US and UK-US Data Privacy Framework.
• Amazon Web Services (AWS): our website hosting and content delivery provider. If located outside the UK / EEA / Australia, appropriate safeguards will be in place.
• PSF Accounting Ltd: our registered office provider. They do not process waitlist or analytics data on our behalf.
• Mechanical Rock Pty Ltd: software development and cryptographic architecture services. Located in Perth, Australia.
• Individual software development contractors: we engage individual contractors who may have access to personal information in the course of providing development and engineering services. Contractors may be located outside Australia and the UK.

We may also disclose your personal information if required to do so by law or in response to a valid request from a public authority.

8. International data transfers

Our website is hosted by Amazon Web Services (AWS). Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and / or the UK International Data Transfer Addendum (IDTA) where applicable.

Google Analytics data may be processed in the United States by Google LLC, which participates in the EU-US and UK-US Data Privacy Framework and / or relies on Standard Contractual Clauses.

Personal information may also be accessed by individual software development contractors located outside Australia and the UK, including in Nepal. Where this occurs, appropriate contractual safeguards are in place.

For users in Australia: where we transfer your personal information outside Australia, we take reasonable steps to ensure the overseas recipient handles it in a manner consistent with the Australian Privacy Principles (APPs), including through contractual arrangements where required under APP 8.

9. How long we keep your personal information

• Waitlist data (email address and survey responses): retained until you withdraw consent or request deletion, or until you are transitioned to the Workings product and its associated Privacy Notice, whichever is sooner.
• Email correspondence: retained for as long as reasonably necessary to respond to and follow up on your enquiry, and for up to 3 years thereafter.
• Analytics data: retained in accordance with Google Analytics' standard retention settings (26 months by default).
• Server logs from report verification requests: retained for up to 30 days, then automatically deleted.

10. Your rights

Depending on where you are located, you may have the following rights in relation to your personal information:

• Right of access: to request a copy of the personal information we hold about you
• Right to rectification: to request correction of inaccurate personal information
• Right to erasure: to request deletion of your personal information in certain circumstances
• Right to restrict processing: to request that we limit how we use your personal information
• Right to data portability: to receive your personal information in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@workings.io. We will respond within one calendar month.

You also have the right to lodge a complaint with your local data protection authority. Details of the relevant authority for your jurisdiction are set out in the additional information sections below.

10.1 Additional information for individuals in the EEA/UK

If you are in the European Economic Area ("EEA") or UK, then please note the following additional information:

1. Data controller

The data controller of your personal information collected through this website is Human Workings Ltd (UK). Should you be based in the EEA or UK and wish to contact us to exercise your rights, please contact Human Workings Ltd using the contact details above.

2. EEA/UK legal basis

We will ordinarily collect and use your personal information only where (i) we have your consent (which will be apparent from the context, because we will ask for your consent when you provide your personal information); (ii) the use is within our legitimate interests and not adverse to your rights and freedoms; or (iii) it is necessary for compliance with a legal obligation.

We set out below each purpose and the associated lawful basis under EU and UK GDPR.

3. International transfers

If Workings transfers your personal information to a country outside of the EEA (for EEA residents) or the UK (for UK residents), it will ensure that any such transfers are compliant with EU and UK data protection law, as applicable.

In practice, this means that Workings will only transfer your personal information to a non-EEA or non-UK recipient where: (i) the recipient is located in a country that the European Commission has decided is adequate to receive personal information from the EEA or the UK Secretary of State has decided is adequate to receive personal information from the UK (as applicable); (ii) the recipient has signed appropriate contractual terms with Workings that incorporate the European Commission's Standard Contractual Clauses or the UK Information Commissioner's International Data Transfer Agreement or International Data Transfer Addendum (as applicable); or (iii) a data transfer derogation applies (for example, where you have consented to the transfer of your personal information).

Data transfers to the United States are made on the basis of Google's Standard Contractual Clauses and, where applicable, the EU-US and UK-US Data Privacy Framework. Personal data may also be accessed by individual software development contractors located outside the UK, including in Nepal. Where this occurs, appropriate contractual safeguards are in place.

If you have further questions about our international data transfers and the specific measures we use in any case, please contact us for further information.

If you wish to make a complaint about our handling of your personal information, you may contact the Information Commissioner's Office (ICO) at ico.org.uk (for UK residents) or your local EU data protection authority (for EEA residents).

10.2 Additional rights for Australian residents (Privacy Act 1988)

In Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APP) in Schedule 1 of that Act apply to our handling of your personal information.

10.2.a Notice of collection — Australian Privacy Principle 5

We collect personal information from you when you join our waitlist, contact us by email, or use the report verification feature on our website. We collect this information for the purposes set out in Section 4 of this Privacy Notice.

10.2.b International disclosures

For the purposes of Section 8 (International data transfers) above, we are likely to transfer your information overseas, and the countries are likely to include the United Kingdom and the United States (via Google LLC for analytics and email services) and Nepal (via individual software development contractors).

10.2.c Failure to provide information

If the personal information you provide to us is incomplete or inaccurate, we may be unable to add you to our waitlist or respond to your enquiry. Provision of personal information through the website is entirely voluntary.

10.2.d Access and correction

You may access the personal information we hold about you upon making a written request to privacy@workings.io. We will respond to your request within a reasonable period. We may charge you a reasonable fee for processing your request but not for making the request itself.

We may decline a request for access to personal information in circumstances prescribed by the Privacy Act, and if we do, we will give you written notice setting out the reasons for the refusal, including details of the mechanisms available to you to make a complaint.

If you believe the personal information we hold about you is inaccurate, incomplete, or out of date, please notify us immediately. We will take reasonable steps to correct the information.

If we refuse to correct your personal information, we will give you written notice setting out our reasons for our refusal, including details of the mechanisms available to you to make a complaint.

10.2.e Complaints and feedback

If you wish to make a complaint about a breach of the Privacy Act, the APPs, or a privacy code that applies to us, please contact us at privacy@workings.io and we will take reasonable steps to investigate the complaint and respond to you.

If after this process you are not satisfied with our response, you can submit a complaint to the Office of the Australian Information Commissioner. To lodge a complaint, visit oaic.gov.au/privacy/privacy-complaints or contact the Information Commissioner's office directly.

If you have any queries or concerns about this Privacy Notice or how we handle your personal information, please contact us at privacy@workings.io. Alternatively, you can write to us at Human Workings Ltd, c/o PSF Accounting Ltd, 13 St Mary's Street, Stamford, England PE9 2DE.

For more information about privacy in general, you can visit the Office of the Australian Information Commissioner's website at www.oaic.gov.au.

10.3 Additional rights for US residents (applicable state privacy laws)

A number of US states have enacted privacy laws granting residents additional rights, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut, Texas, Oregon, and Montana, among others. If you are a resident of a US state with an applicable privacy law, you have the following rights (the specific rights available and response timescales may vary slightly by state):

• Right to know — to request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties we share it with.
• Right to delete — to request deletion of your personal information, subject to certain exceptions.
• Right to correct — to request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information as defined under applicable state privacy laws.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

To exercise these rights, contact privacy@workings.io. We will respond within 45 days (with a possible 45-day extension where permitted by applicable law).

You also have the right to lodge a complaint with your applicable state privacy authority. California residents may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov.

11. Security

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure. These measures include TLS encryption in transit, encryption at rest, and access controls limited to named team members. If you discover a security vulnerability, please report it to security@workings.io. However, no internet transmission is completely secure, and we cannot guarantee the security of personal information transmitted to us.

12. Children

This website is not directed at children under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected such personal information, please contact us at privacy@workings.io and we will delete it promptly.

13. Changes to this privacy notice

We may update this Privacy Notice from time to time. The date at the top of this page will reflect the most recent update. We encourage you to review this Privacy Notice periodically. Where changes are material, we will notify waitlist members by email where practicable.

14. Contact us

If you have any questions about this privacy notice or how we handle your personal information:

Human Workings Ltd
c/o PSF Accounting Ltd
13 St Mary's Street
Stamford
England PE9 2DE

Email: privacy@workings.io