Privacy policy.

1. Who we are

This website (workings.io) is operated by Human Workings Ltd, a company incorporated in England and Wales with company number 16688102.

Registered address:
Human Workings Ltd
c/o PSF Accounting Ltd
13 St Mary's Street
Stamford
England PE9 2DE

For any privacy-related queries, contact us at: privacy@workings.io

Human Workings Ltd is the data controller for the personal data collected through this website.

2. What this policy covers

This policy covers only the personal data collected through the workings.io website - specifically the waitlist sign-up form and any direct communications you send to us. It does not cover the Workings product itself, which is subject to a separate privacy policy.

3. What data we collect

3.1 Waitlist sign-up

When you join our waitlist, we collect:

• Your email address
• Which best describes you - role type (selected from a list of checkboxes, e.g. Student, Academic / educator, Founder / business owner, Developer / engineer, Creative professional, Freelancer / contractor, Influencer / content creator, IP developer / inventor, Consultant, Full-time employee, Other)
• Your intended use case for Workings (selected from a list of checkboxes, e.g. Protect my IP, Prove the work is mine (authorship), Provide evidence of my creative process, Generate a timelapse of my work, Show how much is human vs AI, Track contribution in group / team work, Academic integrity / coursework, Build a portfolio / showcase my craft, Just curious / exploring, Other)
• Which country you are in (selected from a dropdown list, used to notify you when Workings is available in your region)

You provide this data voluntarily when you complete the waitlist form and check the consent box. We do not collect your name.

3.2 Direct contact

If you contact us by email, we will receive and store the contents of that communication, including any personal data you choose to include.

3.3 Website analytics

We use Google Analytics to collect information about how visitors use this website. This may include:

• Pages visited and time spent on each page
• General geographic location (country or region level)
• Device type and browser
• How you arrived at the website (e.g. search engine, direct link)

Google Analytics uses cookies to collect this information. The data is aggregated and does not directly identify you. Analytics cookies are only set if you consent via the cookie notice on first visit; if you decline or do not consent, no Google Analytics script is loaded. Please see Section 6 (Cookies) for further detail.

4. How we use your data

We use the data we collect for the following purposes:

• To contact you about beta access and product updates, where you have given consent to this
• To understand the types of people joining the waitlist (including their roles and intended use cases) and the countries they are in, so we can shape the product and beta programme and notify users when Workings is available in their region
• To respond to enquiries sent to us by email
• To monitor and improve the performance and usability of this website (via aggregated analytics)

5. Legal basis for processing

We process your personal data on the following legal bases under UK GDPR and, where applicable, EU GDPR:

• Consent (Article 6(1)(a)): for storing your email address and survey responses (role type, intended use case, and country) to contact you about beta access and product updates. You provide this consent explicitly by checking the consent box on the waitlist form. You may withdraw consent at any time by contacting us at privacy@workings.io.
• Consent (Article 6(1)(a)): for website analytics. Google Analytics cookies are only set after you accept them via the cookie notice, so we rely on your consent as the basis for this processing. You may withdraw it at any time through the Cookie preferences link in the footer, after which no further analytics data is collected.
• Legitimate interests (Article 6(1)(f)): for responding to direct email enquiries.

Additional bases for non-UK/EU residents:

• Residents of US states with applicable privacy laws: we rely on the same consent and legitimate interests bases described above. A number of US states (including California under the CCPA/CPRA, Virginia under the VCDPA, Colorado under the CPA, and others) grant residents additional privacy rights set out in Section 10.1 below.
• Residents of Australia: we process your data in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We collect personal information that is reasonably necessary for our functions. Your rights under the APPs are set out in Section 10 below.

6. Cookies

This website uses cookies. Cookies are small text files stored on your device when you visit a website.

We use the following types of cookies and local storage:

Essential / functional storage (always active, never used for tracking):

• workings_consent - records your cookie choice (accept or reject) so we do not ask you again (browser local storage; expires after 12 months).
• workings_waitlist_draft - temporarily holds your waitlist form entry so it is not lost if you navigate away (cleared as soon as you submit).

Analytics cookies (set only if you choose "Accept" on the cookie notice): Google Analytics sets cookies such as _ga and _ga_<id> (lasting up to approximately 13 months) to distinguish visitors and measure traffic. If you decline, none of these cookies are set and no Google Analytics script is loaded.

You can opt out of Google Analytics tracking by using the Cookie preferences link in the footer (which also clears any existing analytics cookies), by installing the Google Analytics opt-out browser add-on, or by adjusting your browser settings to block cookies.

A cookie consent notice is displayed when you first visit the website. You may change your preference at any time via the Cookie preferences link in the footer.

7. Who we share your data with

We do not sell your personal data. We may share your data with the following third parties:

• Google LLC: for website analytics via Google Analytics. Google may process data in the United States. This is subject to Google's standard contractual clauses and data processing terms, and where applicable the EU-US and UK-US Data Privacy Framework.
• Google Workspace (Google LLC): we use Google Workspace to send emails to waitlist members about beta access and product updates. Google may process data in the United States under Google's Standard Contractual Clauses and, where applicable, the EU-US and UK-US Data Privacy Framework.
• Amazon: our website hosting and content delivery provider. If located outside the UK / EEA / Australia, appropriate safeguards will be in place.
• PSF Accounting Ltd: our registered office provider. They do not process waitlist or analytics data on our behalf.

We may also disclose your data if required to do so by law or in response to a valid request from a public authority.

8. International data transfers

Our website is hosted by Amazon. Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and / or the UK International Data Transfer Addendum (IDTA) where applicable.

Google Analytics data may be processed in the United States by Google LLC, which participates in the EU-US and UK-US Data Privacy Framework and / or relies on Standard Contractual Clauses.

For users in Australia: where we transfer your personal information outside Australia, we take reasonable steps to ensure the overseas recipient handles it in a manner consistent with the Australian Privacy Principles (APPs), including through contractual arrangements where required under APP 8.

9. How long we keep your data

• Waitlist data (email address and survey responses): retained until you withdraw consent or request deletion, or until the Workings product is launched and you are transitioned to the product privacy policy, whichever is sooner.
• Email correspondence: retained for as long as reasonably necessary to respond to and follow up on your enquiry, and for up to 3 years thereafter.
• Analytics data: retained in accordance with Google Analytics' standard retention settings (26 months by default).

10. Your rights

Depending on where you are located, you may have the following rights in relation to your personal data. We extend these rights to all users regardless of location:

• Right of access: to request a copy of the personal data we hold about you
• Right to rectification: to request correction of inaccurate data
• Right to erasure: to request deletion of your data in certain circumstances
• Right to restrict processing: to request that we limit how we use your data
• Right to data portability: to receive your data in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@workings.io. We will respond within one calendar month.

You also have the right to lodge a complaint with the relevant supervisory authority for your jurisdiction:

• UK: the Information Commissioner's Office (ICO) at ico.org.uk
• EU: your local EU data protection authority
• Australia: the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au
• USA: your applicable state privacy protection authority. California residents may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov

10.1 Additional rights for US residents (applicable state privacy laws)

A number of US states have enacted privacy laws granting residents additional rights, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut, Texas, Oregon, and Montana, among others. If you are a resident of a US state with an applicable privacy law, you have the following rights (the specific rights available and response timescales may vary slightly by state):

• Right to know - to request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties we share it with.
• Right to delete - to request deletion of your personal information, subject to certain exceptions.
• Right to correct - to request correction of inaccurate personal information.
• Right to opt out of sale or sharing - we do not sell or share personal information for cross-context behavioural advertising.
• Right to limit use of sensitive personal information - we do not collect sensitive personal information as defined under the CPRA.
• Right to non-discrimination - we will not discriminate against you for exercising any of these rights.

To exercise these rights, contact privacy@workings.io. We will respond within 45 days (with a possible 45-day extension where permitted by applicable law).

10.2 Additional rights for Australian residents (Privacy Act 1988)

If you are located in Australia, the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) apply to our handling of your personal information. In addition to the rights listed above, you have the right to:

• Complain to us about a breach of the APPs, and receive a response within 30 days.
• If not satisfied with our response, refer your complaint to the Office of the Australian Information Commissioner (OAIC).

We collect personal information from you only by lawful and fair means, and only if it is reasonably necessary for our functions. You may contact us to access or correct your personal information at privacy@workings.io.

11. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These measures include TLS encryption in transit, encryption at rest, and access controls limited to named team members. If you discover a security vulnerability, please report it to security@workings.io. However, no internet transmission is completely secure, and we cannot guarantee the security of data transmitted to us.

12. Children

This website is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, please contact us at privacy@workings.io and we will delete it promptly.

13. Changes to this policy

We may update this policy from time to time. The date at the top of this page will reflect the most recent update. We encourage you to review this policy periodically. Where changes are material, we will notify waitlist members by email where practicable.

14. Contact us

If you have any questions about this privacy policy or how we handle your personal data:

Human Workings Ltd
c/o PSF Accounting Ltd
13 St Mary's Street
Stamford
England PE9 2DE

Email: privacy@workings.io