Privacy notice.

1. Who we are

This website (workings.io) is operated by Human Workings Ltd, a company incorporated in England and Wales with company number 16688102.

Registered address:
Human Workings Ltd
c/o PSF Accounting Ltd
13 St Mary's Street
Stamford
England PE9 2DE

For any privacy-related queries, contact us at: privacy@workings.io

Human Workings Ltd is the data controller for the personal information collected through this website.

2. What this privacy notice covers

This Privacy Notice covers the personal information collected through the workings.io website. This includes website analytics, emails you send to us, the verification feature (which you reach from the “Verify a file” link on our website and which is hosted at app.workings.io/verify), and information we hold about people who joined our waitlist while we were in alpha.

It does not cover the Workings desktop application or related services, which are subject to our separate App Privacy Notice.

3. What personal information we collect

3.1 Direct contact

If you contact us by email, we will receive and store the contents of that communication, including any personal information you choose to include.

3.2 Verification

You can use the verification feature to check whether a Workings report, timelapse or original document is genuine and unchanged. You reach it from the “Verify a file” link on our website, and it is hosted at app.workings.io/verify. You do not need an account, and we do not ask for your name or email address.

When you drop a file onto the verification page, your device calculates a digital fingerprint of the file (called a “hash”). Your file is not uploaded and never leaves your device. Only the hash is sent to us, so that we can check whether it matches a Workings record.

We do not use cookies to record your verification or the counts described in Section 3.3. Our servers use your IP address to limit repeated requests, and our server logs will record it when you submit a verification request. These logs are deleted after 30 days (see Section 9). We do not store your IP address in our database.

3.3 Anonymous usage counts

When you use the verification page, we keep anonymous counts of how much it is used (how many visits, how many files are checked, and how many match or do not match). Each count records:

• what happened (the page was viewed, a file matched a Workings record, a file did not match, or a verification link was opened);
• the date and time;
• whether you were signed in to a Workings account (yes or no only); and
• the type of file checked (report, timelapse or original document) and, where a report or timelapse matches, the ID of that Workings record.

We record which report or timelapse was checked, but not who checked it. The counts do not include your IP address, your name, your account, the file you dropped, its name or its hash, and we do not link them to you.

3.4 Website analytics

We use Google Analytics to collect information about how visitors use this website. This may include:

• Pages visited and time spent on each page
• General geographic location (country or region level)
• Device type and browser
• How you arrived at the website (e.g. search engine, direct link)

Google Analytics uses cookies to collect this information. The personal information is aggregated and does not directly identify you. Analytics cookies are only set if you consent via the cookie notice on first visit; if you decline or do not consent, no Google Analytics script is loaded. Please see Section 6 (Cookies) for further detail.

Google Analytics is used on the pages of workings.io only. It is not used on the verification page at app.workings.io/verify, which is covered by the anonymous counts in Section 3.3 instead.

3.5 Waitlist

If you joined our waitlist when we were in alpha, we hold the following information:

• Your email address
• Which best describes you - role type (selected from a list of checkboxes, e.g. Student, Academic / educator, Founder / business owner, Developer / engineer, Creative professional, Freelancer / contractor, Influencer / content creator, IP developer / inventor, Consultant, Full-time employee, Other)
• Your intended use case for Workings (selected from a list of checkboxes, e.g. Protect my IP, Prove the work is mine (authorship), Provide evidence of my creative process, Generate a timelapse of my work, Show how much is human vs AI, Track contribution in group / team work, Academic integrity / coursework, Build a portfolio / showcase my craft, Just curious / exploring, Other)
• Which country you are in (selected from a dropdown list, used to notify you when Workings is available in your region)

You provided this personal information voluntarily when you completed the waitlist form and checked the consent box. We do not collect your name.

4. How we use your personal information

We use the personal information we collect for the following purposes:

• For people who joined the waitlist, to contact you about beta access and product updates, where you have given consent to this
• To understand the types of people who joined the waitlist (including their roles and intended use cases) and the countries they are in, so we can shape the product and beta programme and notify users when Workings is available in their region
• To respond to enquiries sent to us by email
• To monitor and improve the performance and usability of this website (via aggregated analytics)
• To process verification requests submitted through the verify feature on our website
• To understand how much the verification page is used (through anonymous counts)

5. Legal basis for processing

We process your personal information on the following legal bases under UK GDPR and, where applicable, EU GDPR:

• Consent (Article 6(1)(a)): for storing your email address and survey responses (role type, intended use case, and country) to contact you about beta access and product updates. You provided this consent explicitly by checking the consent box on the waitlist form. You may withdraw consent at any time by contacting us at privacy@workings.io.
• Consent (Article 6(1)(a)): for website analytics via Google Analytics. Analytics cookies are only set after you accept them via the cookie notice on first visit. You may withdraw consent at any time through the Cookie preferences link in the footer.
• Legitimate interests (Article 6(1)(f)): for responding to direct email enquiries.
• Legitimate interests (Article 6(1)(f)): for processing verification requests and the associated server log data, and for keeping anonymous counts of how much the verification page is used. We have a legitimate interest in providing the verification service, retaining server logs for security purposes, and in understanding how much the service is used.

Additional bases for non-UK/EU residents:

• Residents of US states with applicable privacy laws: we rely on the same consent and legitimate interests bases described above. A number of US states (including California under the CCPA/CPRA, Virginia under the VCDPA, Colorado under the CPA, and others) grant residents additional privacy rights set out in Section 10.3 below.
• Residents of Australia: we process your personal information in accordance with the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). We collect personal information that is reasonably necessary for our functions. Your rights under the APPs are set out in Section 10.2 below.

6. Cookies

This website uses cookies. Cookies are small text files stored on your device when you visit a website.

We use the following types of cookies and local storage:

Essential / functional storage (always active, never used for tracking): workings_consent – records your cookie choice (accept or reject) so we do not ask you again (browser local storage; expires after 12 months).

Analytics cookies (set only if you choose "Accept" on the cookie notice): Google Analytics sets cookies such as _ga and _ga_<id> (lasting up to approximately 13 months) to distinguish visitors and measure traffic. If you decline, none of these cookies are set and no Google Analytics script is loaded.

You can opt out of Google Analytics tracking by using the Cookie preferences link in the footer (which also clears any existing analytics cookies), by installing the Google Analytics opt-out browser add-on, or by adjusting your browser settings to block cookies.

A cookie consent notice is displayed when you first visit the website. You may change your preference at any time via the Cookie preferences link in the footer.

7. Who we share your personal information with

We do not sell your personal information. We may share your personal information with the following third parties:

• Google LLC: for website analytics via Google Analytics. Google may process personal information in the United States. This is subject to Google's standard contractual clauses and data processing terms, and where applicable the EU-US and UK-US Data Privacy Framework.
• Google Workspace (Google LLC): we use Google Workspace for our email, including to receive and reply to emails you send us and to send emails to waitlist members about beta access and product updates. Google may process personal information in the United States under Google's Standard Contractual Clauses and, where applicable, the EU-US and UK-US Data Privacy Framework.
• Neon: our database provider, which holds the waitlist information described in Section 3.5. Neon may process personal information in the United States.
• Vercel Inc.: our website hosting and content delivery provider. Vercel receives technical information about your visit (such as your IP address) in order to deliver the website, and may process it in the United States. This is subject to Standard Contractual Clauses and, where applicable, the EU-US and UK-US Data Privacy Framework.
• Amazon Web Services (AWS): hosts our verification page (app.workings.io/verify) and the systems behind it, including server logs and the anonymous usage counts. Where data is transferred outside the UK or EEA, appropriate safeguards are in place (see Section 8).
• PSF Accounting Ltd: our registered office provider. They do not process personal information collected through this website on our behalf.
• Mechanical Rock Pty Ltd - software development and cryptographic architecture services. Located in Perth, Australia.
• Individual software development contractors - we engage individual contractors who may have access to personal information in the course of providing development and engineering services. Contractors may be located outside Australia and the UK.

We may also disclose your personal information if required to do so by law or in response to a valid request from a public authority.

8. International data transfers

Our website is hosted by Vercel Inc. and our verification page is hosted by Amazon Web Services (AWS). Waitlist information is held in a database provided by Neon. Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) and / or the UK International Data Transfer Addendum (IDTA) where applicable.

Google Analytics data may be processed in the United States by Google LLC, which participates in the EU-US and UK-US Data Privacy Framework and / or relies on Standard Contractual Clauses.

Personal information may also be accessed by individual software development contractors located outside Australia and the UK, including in Nepal. Where this occurs, appropriate contractual safeguards are in place.

For users in Australia: where we transfer your personal information outside Australia, we take reasonable steps to ensure the overseas recipient handles it in a manner consistent with the Australian Privacy Principles (APPs), including through contractual arrangements where required under APP 8.

9. How long we keep your personal information

• Waitlist data (email address and survey responses): retained until you withdraw consent or request deletion, or until you are transitioned to the Workings product and its associated Privacy Notice, whichever is sooner.
• Email correspondence: retained for as long as reasonably necessary to respond to and follow up on your enquiry, and for up to 3 years thereafter.
• Analytics data: retained in accordance with Google Analytics' standard retention settings (26 months by default).
• Server logs from verification requests: retained for up to 30 days, then automatically deleted.
• Anonymous usage counts from the verification page: kept without a fixed deletion date.

10. Your rights

Depending on where you are located, you may have the following rights in relation to your personal information:

• Right of access: to request a copy of the personal information we hold about you
• Right to rectification: to request correction of inaccurate personal information
• Right to erasure: to request deletion of your personal information in certain circumstances
• Right to restrict processing: to request that we limit how we use your personal information
• Right to data portability: to receive your personal information in a structured, machine-readable format
• Right to object: to object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@workings.io. We will respond within one calendar month.

You also have the right to lodge a complaint with your local data protection authority. Details of the relevant authority for your jurisdiction are set out in the additional information sections below.

10.1 Additional information for individuals in the EEA/UK

If you are in the European Economic Area ("EEA") or UK, then please note the following additional information:

1. Data controller

The data controller of your personal information collected through this website is Human Workings Ltd (UK). Should you be based in the EEA or UK and wish to contact us to exercise your rights, please contact Human Workings Ltd using the contact details above.

2. EEA/UK legal basis

We will ordinarily collect and use your personal information only where (i) we have your consent (which will be apparent from the context, because we will ask for your consent when you provide your personal information); (ii) the use is within our legitimate interests and not adverse to your rights and freedoms; or (iii) it is necessary for compliance with a legal obligation.

We set out below each purpose and the associated lawful basis under EU and UK GDPR.

3. International transfers

If Workings transfers your personal information to a country outside of the EEA (for EEA residents) or the UK (for UK residents), it will ensure that any such transfers are compliant with EU and UK data protection law, as applicable.

In practice, this means that Workings will only transfer your personal information to a non-EEA or non-UK recipient where: (i) the recipient is located in a country that the European Commission has decided is adequate to receive personal information from the EEA or the UK Secretary of State has decided is adequate to receive personal information from the UK (as applicable); (ii) the recipient has signed appropriate contractual terms with Workings that incorporate the European Commission's Standard Contractual Clauses or the UK Information Commissioner's International Data Transfer Agreement or International Data Transfer Addendum (as applicable); or (iii) a data transfer derogation applies (for example, where you have consented to the transfer of your personal information).

Data transfers to the United States are made on the basis of our providers' (including Google's, Vercel's and Neon's) Standard Contractual Clauses and, where applicable, the EU-US and UK-US Data Privacy Framework. Personal data may also be accessed by individual software development contractors located outside the UK, including in Nepal. Where this occurs, appropriate contractual safeguards are in place.

If you have further questions about our international data transfers and the specific measures we use in any case, please contact us for further information.

If you wish to make a complaint about our handling of your personal information, you may contact the Information Commissioner's Office (ICO) at ico.org.uk (for UK residents) or your local EU data protection authority (for EEA residents).

10.2 Additional rights for Australian residents (Privacy Act 1988)

In Australia, the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APP) in Schedule 1 of that Act apply to our handling of your personal information.

10.2.a Notice of collection - Australian Privacy Principle 5

We collect personal information from you when you contact us by email or use the verification feature on our website, and we hold information from people who joined our waitlist. We collect this information for the purposes set out in Section 4 of this Privacy Notice.

10.2.b International disclosures

For the purposes of Section 8 (International data transfers) above, we are likely to transfer your information overseas, and the countries are likely to include the United Kingdom and the United States (via Google LLC for analytics and email services, Vercel Inc. for website hosting, and Neon for waitlist information) and Nepal (via individual software development contractors).

10.2.c Failure to provide information

If the personal information you provide to us is incomplete or inaccurate, we may be unable to respond to your enquiry. Provision of personal information through the website is entirely voluntary.

10.2.d Access and correction

You may access the personal information we hold about you upon making a written request to privacy@workings.io. We will respond to your request within a reasonable period. We may charge you a reasonable fee for processing your request but not for making the request itself.

We may decline a request for access to personal information in circumstances prescribed by the Privacy Act, and if we do, we will give you written notice setting out the reasons for the refusal, including details of the mechanisms available to you to make a complaint.

If you believe the personal information we hold about you is inaccurate, incomplete, or out of date, please notify us immediately. We will take reasonable steps to correct the information.

If we refuse to correct your personal information, we will give you written notice setting out our reasons for our refusal, including details of the mechanisms available to you to make a complaint.

10.2.e Complaints and feedback

If you wish to make a complaint about a breach of the Privacy Act, the APPs, or a privacy code that applies to us, please contact us at privacy@workings.io and we will take reasonable steps to investigate the complaint and respond to you.

If after this process you are not satisfied with our response, you can submit a complaint to the Office of the Australian Information Commissioner. To lodge a complaint, visit oaic.gov.au/privacy/privacy-complaints or contact the Information Commissioner's office directly.

If you have any queries or concerns about this Privacy Notice or how we handle your personal information, please contact us at privacy@workings.io. Alternatively, you can write to us at Human Workings Ltd, c/o PSF Accounting Ltd, 13 St Mary's Street, Stamford, England PE9 2DE.

For more information about privacy in general, you can visit the Office of the Australian Information Commissioner's website at www.oaic.gov.au.

10.3 Additional rights for US residents (applicable state privacy laws)

A number of US states have enacted privacy laws granting residents additional rights, including California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut, Texas, Oregon, and Montana, among others. If you are a resident of a US state with an applicable privacy law, you have the following rights (the specific rights available and response timescales may vary slightly by state):

• Right to know — to request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and the categories of third parties we share it with.
• Right to delete — to request deletion of your personal information, subject to certain exceptions.
• Right to correct — to request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell or share personal information for cross-context behavioural advertising.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information as defined under applicable state privacy laws.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights.

To exercise these rights, contact privacy@workings.io. We will respond within 45 days (with a possible 45-day extension where permitted by applicable law).

You also have the right to lodge a complaint with your applicable state privacy authority. California residents may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov.

11. Security

We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, or disclosure. These measures include TLS encryption in transit, encryption at rest, and access controls limited to named team members. If you discover a security vulnerability, please report it to security@workings.io. However, no internet transmission is completely secure, and we cannot guarantee the security of personal information transmitted to us.

12. Children

This website is not directed at children under the age of 18. We do not knowingly collect personal information from children under 18. If you believe we have inadvertently collected such personal information, please contact us at privacy@workings.io and we will delete it promptly.

13. Changes to this privacy notice

We may update this Privacy Notice from time to time. The date at the top of this page will reflect the most recent update. We encourage you to review this Privacy Notice periodically. Where changes are material, we will notify waitlist members by email where practicable, and highlight them on our website.

14. Contact us

If you have any questions about this privacy notice or how we handle your personal information:

Human Workings Ltd
c/o PSF Accounting Ltd
13 St Mary's Street
Stamford
England PE9 2DE

Email: privacy@workings.io