Privacy Policy

For workplace data, your employer or the organisation providing your workspace decides why tracking is used, who is tracked, the collection settings, access permissions and retention period. It acts as the controller or data fiduciary, as applicable. We process that data on its behalf to provide the service, subject to its instructions and the applicable service agreement.

For our own customer relationships, website operations, account administration and enquiries, Tech Extensor is responsible for deciding how personal data is used. For questions about workplace tracking, contact your organisation first. You can also contact us through Contact and privacy requests.

The following data may be collected while tracking is active, depending on workspace settings:

Collection controls and limits

Workspace administrators can control screenshots, application usage, window titles, website domains and live status. Tracking and pause behaviour depend on the workspace’s work mode and policies. The user guide explains what is recorded about you and privacy and retention settings.

The tracker does not record audio or camera video, log typed text, or directly read the contents of files, emails or chats. However, screenshots can capture those contents, including passwords or sensitive information displayed on screen. Window titles can also reveal personal information or search terms. The domain-only limit applies to website-usage records; it does not remove information visible in screenshots or titles.

Organisations must tell people about tracking before it starts, establish a lawful basis, and choose settings appropriate to the work. They should disable screenshots or window titles when those features would capture information they should not collect.

• Account information: name, work email, organisation, role, account identifiers and a hashed password for password-based accounts.
• Microsoft sign-in: identity information, such as name, email and account identifier, when your organisation enables Microsoft sign-in.
• Commercial records: subscription plan, user count, billing contact, invoices and related correspondence.
• Enquiries and support: messages, contact details and attachments you choose to send us. Please avoid sending passwords or unnecessary sensitive information.
• Technical records: IP addresses, browser and device information, request and security logs, and diagnostic information generated when the service encounters errors.

• Provide time tracking, workplace reports, timesheets and other features selected by your organisation.
• Manage accounts, invitations, authentication, password resets and service notices.
• Support customers, respond to enquiries and administer subscriptions and invoices.
• Maintain service reliability, investigate faults, prevent misuse and secure accounts.
• Meet applicable legal obligations and address legal claims or lawful requests.
• Send requested sales information or product communications, with consent where required.

The legal basis depends on the purpose and applicable law. It may include consent, contractual necessity, legal obligations, or other grounds permitted by law, including legitimate interests where recognised. Your organisation is responsible for the lawful basis for its workplace monitoring. This notice does not itself authorise monitoring or replace any consent required by law.

We do not sell personal data or use workplace records for targeted advertising. We do not use customer workplace records to train our own AI models.

Users can access their own records through the features available to their role. Authorised managers, workspace administrators and auditors can access workplace records within their assigned scope, including screenshots where their permissions allow it. Customers may download reports and share them with their own authorised recipients.

Platform administration does not grant screenshot viewing through the product. Access to infrastructure for service operation and support is distinct from workspace permissions. Screenshot images use short-lived signed links; anyone with a valid link can retrieve the image until it expires. Do not forward these links to unauthorised people.

WorkflowPulse uses the essential wfp_session cookie to recognise a signed-in session. The web application also stores authentication tokens and account information in browser local storage so that your session can survive a page reload. Local storage may also keep interface preferences. Clearing cookies or site storage can sign you out or reset those preferences.

We do not use advertising cookies or third-party marketing analytics cookies in the WorkflowPulse application. Your browser lets you clear or block site storage, although essential sign-in features may stop working if you do so.

Weekly AI summaries are disabled by default. If a workspace administrator enables them, we send aggregated weekly figures to Anthropic’s Claude service. These can include team labels, contributor counts, tracked hours, productivity and idle percentages, after-hours totals, broad week-to-week trends and the most-used website domains classified as distracting for that group.

Individual names, screenshots, window titles and full website addresses are not included in the summary request. Groups with fewer than three actual contributors are excluded, and additional grouping safeguards reduce the risk of isolating small groups. Aggregation reduces identification risk but does not guarantee anonymity, especially if team labels or website domains reveal sensitive information.

AI summaries are advisory and may be inaccurate. Organisations should review them before using them in decisions about people. Anthropic processes submitted information under the terms applicable to its API service.

We use service providers for hosting, databases, file storage, email delivery and service diagnostics as needed to operate WorkflowPulse. Their access is limited to the purposes of providing those services. The providers used depend on the deployment and enabled features.

• Cloudflare R2: screenshot and related file storage when R2 storage is configured; other deployments use server-local storage.
• Sentry: diagnostic and error reporting when configured.
• Microsoft: authentication when Microsoft sign-in is enabled.
• Anthropic: aggregated AI-summary requests only when a workspace enables that feature.
• Customer integrations: information included in alerts sent to an organisation’s connected services, such as Slack, according to its configuration.

We may disclose information to comply with applicable law or valid legal process, protect rights and service security, or support a business transfer such as a merger or acquisition, subject to applicable confidentiality and data-protection requirements. Contact us for deployment-specific information about service providers.

Data is stored on the infrastructure used for your WorkflowPulse deployment. Hosting, storage and integration providers may process data in countries outside your own. This policy does not promise storage exclusively in India or in any other particular country. Contact us for the hosting region and transfer arrangements applicable to your workspace. International processing is subject to applicable legal requirements and any location commitments in your organisation’s service agreement.

Workspace administrators can set raw tracking-data retention from 1 to 3,650 days; the default is 90 days. A scheduled nightly process removes screenshots and their previews, activity counts, application and website records, idle events and integrity events older than that workspace’s retention period. The setting also applies to suspended workspaces.

This raw-data retention setting does not delete time logs, tracker sessions, timesheets, approval history, daily aggregates, audit logs, exports or comments. These records support reporting, billing and accountability and need separate retention decisions. Copies downloaded by your organisation are under its control.

Account, support and commercial records are retained as needed for their purpose and applicable legal obligations. For workspace closure or deletion requests, contact us to arrange the scope and timing under your service agreement. Closing or suspending an account does not by itself mean every record has been immediately erased. Records required for legal obligations or claims may need to be retained, and backup copies may remain until their normal replacement or expiry.

The hosted service uses HTTPS, hashed passwords for password-based accounts, workspace separation, role-based access controls and short-lived signed screenshot links. Audit logs record supported administrative and business actions; they are not a complete record of every data access. No system is completely secure. Report suspected unauthorised access promptly using the contact details below. If a personal-data breach requires notification, we will notify affected customers, individuals or authorities as applicable law requires.

Depending on the law applicable to you and when its provisions take effect, you may have rights to access information about your personal data, correct it, request deletion, withdraw consent, object to or restrict certain processing, receive a portable copy, nominate a representative, or complain to a competent data-protection authority. Rights are subject to applicable conditions and exceptions; this policy does not imply that every listed right applies in every country.

For workplace records, contact your organisation, which controls that data. We assist it in handling requests. For information we control, email bd@techextensor.com with the subject “WorkflowPulse privacy request”. Include your workspace name, account email and a description of the request. We may need to verify your identity or authority before disclosing or changing records. Do not email passwords or identity documents unless we request them through an appropriate channel.

We handle requests within the time required by applicable law. Withdrawing consent does not affect earlier lawful processing and may affect features that depend on it. You can raise a concern with us using the same email address and, where available under applicable law, escalate it to the competent authority.

WorkflowPulse is intended for workplace use by adults aged 18 or older. We do not knowingly collect personal data from children. If you believe a child’s information has been submitted, contact us so we can investigate and take appropriate action.

For privacy questions, requests or complaints, contact Tech Extensor:

• Email: bd@techextensor.com. Use the subject “WorkflowPulse privacy”.
• Post: Tech Extensor, Swati Crimson & Clover, Shilaj Circle, Sardar Patel Ring Road, Thaltej, Ahmedabad, Gujarat 380054, India.

Please describe your concern and identify the relevant workspace so we can route it to the appropriate team. If the request concerns employer-controlled records, we may refer it to your organisation or coordinate a response with it.

We may update this policy as our service or legal obligations change. We will publish the revised version here and update the dates at the top. For material changes, we will provide additional notice through the service or customer communications where required.