Privacy Policy

1. Our role

For account and billing information we are the controller. For content that a customer organization (the “Workspace”) puts into the Service — messages, files, tasks, announcements and wiki pages — the Workspace is the controller and we process it on the Workspace's instructions.

2. Information we collect

• Account: email address, display name, password (stored only as an Argon2id hash), language and time zone.
• Workspace: company name, departments, job titles and roles entered by administrators.
• Content: messages, files, tasks, comments, announcements and wiki pages you create.
• Usage and security logs: sign-in time, IP address (stored as a hash where possible), browser type, pages visited and error logs.
• Website analytics: page path, referrer, language and approximate country. We do not use advertising cookies.

3. Purposes

• Providing the Service, authenticating users and enforcing permissions.
• Sending invitations, password resets and notifications you enabled.
• Security, fraud prevention, audit logging and incident response.
• Improving the Service with aggregated statistics.
• Answering inquiries and meeting legal obligations.

4. Retention and deletion

• Account information: until you delete your account, then deleted within 30 days.
• Workspace content: until the Workspace is terminated or the content is deleted under its retention policy, then deleted within 30 days.
• Backups: overwritten on a rolling cycle of up to 35 days.
• Access logs: 3 months, or longer where the law requires.

Deleted data is destroyed in a way that cannot be restored; paper records, if any, are shredded.

5. Disclosure to third parties

We do not sell personal information. We disclose it to third parties only with your consent, at the Workspace's instruction, or when required by law.

6. Processors and overseas transfer

We use the following processors. Data is transferred over encrypted networks when you use the Service.

• Cloudflare, Inc. (USA, global network): website delivery, security and proxying.
• Railway Corporation (USA): application servers and database hosting.
• AI providers such as Anthropic PBC or OpenAI, L.L.C. (USA): only when a Workspace enables AI features; only the question and the excerpts the user may access are sent, and they are not used to train models under our agreements.
• Email delivery provider (USA): invitation, password reset and notification emails.

Items transferred: the data listed in section 2 that is necessary for each function. Retention: as described in section 4. You can refuse an overseas transfer by not using the related feature or by deleting your account, but some features may then be unavailable.

7. Your rights

You may request access, correction, deletion, suspension of processing or a copy of your personal information at any time, in the app settings or by email. If your data belongs to a Workspace, we may forward your request to its administrator. We respond without undue delay and within the period required by law.

8. Security measures

• Encryption in transit (HTTPS/TLS) and hashed passwords.
• Strict tenant isolation, role-based access control and permission checks on every request.
• Short-lived download links, upload signature checks and rate limiting.
• Audit logs for administrative actions and minimal access by staff.

9. Cookies

We use strictly necessary cookies for sign-in sessions and CSRF protection. Website analytics does not use cookies; visitors are counted with a daily-rotating anonymous hash. You can block cookies in your browser, but you will not be able to sign in.

10. Children

The Service is intended for business use and is not directed at children under 14.

11. Privacy officer and contact

Privacy officer: WorkHub Privacy Team

Email: [email protected]

You may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (www.kopico.go.kr, 1833-6972).

12. Changes

We will announce changes to this policy at least 7 days in advance (30 days for material changes) on this page or in the Service.