Privacy Policy

1. Who the controller is

The controller of your data is Ramon da Cruz Amaro, an individual residing at Avenida del Doctor Jiménez Díaz, 26, Alicante (Spain).

Representative in the European Union (GDPR art. 27): not applicable, because the controller is established in Spain.

Data protection officer (DPO): we have not appointed a data protection officer; for any question write to us at privacidad@workfly.es.

For any privacy matter, write to privacidad@workfly.es if you are in Spain or to privacidade@workfly.pt if you are in Portugal.

2. Data we process

• Account: name, email, phone number and password (stored only as a hash, which cannot be reversed).
• Tax ID from your country: in Spain, NIF or NIE (individual) or CIF (company); in Portugal, NIF (individual) or NIPC (company).
• Professional profile: description, photo, professions, services, portfolio and the cities where you work.
• Addresses: the addresses you enter in requests and in your profile.
• Content you send: requests (title, description, photos and address), quotes, appointments, messages, reviews and profile and portfolio photos.
• Identity verification, if you choose to do it: a photo of an ID document and a selfie (section 4).
• Technical data: IP address, device information (system, app version), the notification identifier (push token) and app usage events (screens and actions).
• Visits to profiles and businesses: we record the IP address and the browser or device of every visit; if you are signed in, the visit is also linked to your account, and if not, we also keep a code derived from the IP and the device. The profile owner only sees the numbers, never who visited.
• Language chosen in the app.
• Sign-up source: your answer to "how did you hear about us"; and, on the website, the campaign you came from, recorded only if you accept analytics cookies.
• Precise location: only when you allow it on your device.
• Referrals and links opened before installing: who referred you, if you created your account through a referral link (each referral that becomes an active account adds points to the referrer's ranking); for up to 24 hours, a code derived from the IP address and the type of device of anyone who opened a Workfly link in the browser before installing the app; on Android, the install source code that the Play Store provides at installation; and, on first launch, a single read of the clipboard looking for a Workfly link (on iPhone, only if you allow it), which is cleared if the link is found.
• Clients added by professionals: name, phone number and email address that a professional or business enters when adding their own clients, to organize their schedule and send the invitation to create an account.

3. Why we use it and on what legal basis

• Performance of the contract (GDPR art. 6.1.b): creating and keeping your account, showing your profile, sending and receiving requests, quotes, messages and appointments, and sending service notices.
• Legitimate interest (art. 6.1.f): platform security, fraud and abuse prevention, handling reports and improving the service; and communications about using Workfly (reminders, tips and news) by email and notification, which you can stop with the unsubscribe link in each email or in your device's notification settings. You can object to these uses (section 9).
• Consent (art. 6.1.a): precise location, analytics cookies on the website and sharing your request on social media. You can withdraw each one at any time, without affecting what was done before.
• Legal obligation (art. 6.1.c): when the law or an order from an authority requires us to keep or provide data.

Account data is required to create an account and use Workfly; the rest is optional, and not providing it only limits the related feature.

4. Identity verification

In Spain and Portugal identity verification is optional: whoever completes it gets the verified badge on their profile. To do so, you send a photo of an ID document and a selfie. These images are biometric data and we only process them with your explicit consent (GDPR art. 9.2.a), given by ticking the authorization on the upload screen. A person on our team compares the selfie with the document; we do not use automatic face recognition and there is no automated decision. The images are kept in private storage, only the Workfly team can open them, and every opening is logged.

How long we keep them. The images are kept for as long as your account exists, including after the decision to approve or reject. We keep them so we can check your identity again if fraud is suspected or the account is disputed, and remove the badge where appropriate, without asking you to send them again. You consent to this period when you tick the authorization. When you delete the account, the images are deleted.

How to withdraw consent. Write to the privacy email for your country (section 1). If your submission is still under review, it is closed without approval and without a notice in the app; in every case, the team permanently deletes the document and the selfie, and that action is kept in the audit log, with the reason. Withdrawing consent does not affect the check already done.

If you do not want to send them. Refusing or withdrawing consent does not stop you from using Workfly: your profile simply goes without the badge.

5. Who we share it with

We use the providers below to run Workfly. Each one receives only the data indicated:

Provider

Neon

What for

database; receives all stored data

Where

USA (us-east-1)

Safeguard

European Commission Standard Contractual Clauses

Provider

Railway

What for

API hosting; receives every request to the app and its processing

Where

USA (east)

Safeguard

European Commission Standard Contractual Clauses

Provider

Cloudinary

What for

storage of uploaded photos; the document and selfie go to private storage

Where

USA

Safeguard

European Commission Standard Contractual Clauses

Provider

Resend

What for

sending emails; receives email address, name and message content

Where

USA

Safeguard

European Commission Standard Contractual Clauses

Provider

Brevo

What for

sending emails; receives email address, name and message content

Where

EU (France)

Safeguard

No transfer (EU)

Provider

Expo

What for

delivering notifications (push token, title and text of the notice) and app updates, which receive the IP and device and app data each time the app opens

Where

USA

Safeguard

European Commission Standard Contractual Clauses

Provider

Google

What for

app map on Android, address search, sign-in with Google, notification delivery on Android and website visit measurement, the latter only after you accept analytics cookies

Where

USA

Safeguard

European Commission Standard Contractual Clauses

Provider

Apple

What for

sign-in with Apple and notification delivery on iPhone

Where

USA

Safeguard

European Commission Standard Contractual Clauses

Provider

Anthropic

What for

writing the caption of request posts (title, description and city of the request) and suggesting the profile description (profession and the text about the work)

Where

USA

Safeguard

European Commission Standard Contractual Clauses

Provider

Meta

What for

posting the request on Instagram and Facebook (title and description of the request) and the @ handle of whoever authorized the tag

Where

USA/Ireland

Safeguard

European Commission Standard Contractual Clauses

Provider

Sentry

What for

error and performance records; on the server, the user is sent only as their id and, in error records, the URL query parameters and 5 headers (authorization, cookies, debugging and API keys) are filtered; other request data, such as the IP address, may still be sent

Where

USA

Safeguard

European Commission Standard Contractual Clauses

Provider

Vercel

What for

hosting of the website and the admin panel; receives the IP and the requests of visitors

Where

USA

Safeguard

European Commission Standard Contractual Clauses

Provider

Microsoft Clarity

What for

session recording on the website, only after you accept analytics cookies

Where

USA

Safeguard

European Commission Standard Contractual Clauses

Provider

Upstash

What for

usage-limit counters (file uploads, chat messages, real-time events) with user and conversation ids, each person's open conversation and the chat's real-time event traffic

Where

outside the EEA (region to be confirmed)

Safeguard

European Commission Standard Contractual Clauses

Other users see your public profile and, when there is a request, quote, appointment or conversation between you, whatever is needed to agree on the service. In the public name and description of a profile, we automatically remove any phone number, email address, link, social media handle or address you have written. Your phone number, your email address and the full service address are only shown to the other person once the service is agreed (quote accepted or appointment confirmed) and for up to 7 days after it is completed; before that, the professional only sees the neighborhood, city and region of the request. When you open these contact details in the app, the lookup is logged. Published requests also appear on the website's opportunities pages, open to anyone and to search engines, with the service, city, title, description, request photos, price range and date, without your name or contact details; we automatically remove phone, email and address from the title and description. A business's phone number, when provided, appears on its public page. We also provide data to authorities when the law requires it.

6. International transfers

Most providers are in the United States, outside the European Economic Area. Each transfer relies on the European Commission's adequacy decision for the EU-US Data Privacy Framework, when the provider is certified, or on the standard contractual clauses approved by the Commission (GDPR art. 46.2.c). The "Safeguard" column in section 5 shows which applies to each provider. You can ask for a copy of these safeguards at the privacy email for your country.

7. Sharing on social media

In Spain and Portugal, a request is only shared on Workfly's social media if you authorize it in the request itself. The post shows the service, the city, the title, the description, the price range and the date, without your name, your photo or your contact details; phone numbers, emails and addresses are removed from the text automatically. If you authorize it, we tag your Instagram as a collaborator. You can undo the authorization on the request screen while it has not been posted; to remove a post that is already live, write to the privacy email for your country.

8. How long we keep it

Data

Read notifications

Period

90 days

Data

Unread notifications

Period

180 days

Data

Processed emails (sent, skipped or failed)

Period

180 days

Data

App usage events (include IP and device)

Period

90 days

Data

Log of changes made through the API (audit)

Period

180 days

Data

Log of sign-ups, sign-ins (including failed ones), sign-outs, session renewals and password resets

Period

365 days

Data

Notice delivery failures

Period

90 days

Data

Bot visits to profiles and businesses

Period

30 days

Data

Human visits to profiles and businesses (IP, browser and, where applicable, the account)

Period

no automatic deletion by time limit; deleted when the account is deleted (visits with no linked account have no fixed period)

Data

Email verification and password reset codes

Period

1 day after they expire

Data

Expired sessions

Period

30 days after they expire

Data

ID document and selfie from identity verification

Period

while the account exists (section 4)

Data

Security logs (lookups of another person's contact details, account deletion and team actions, such as every opening of identity images)

Period

kept for security and accountability; the system does not delete them automatically

Account data is kept while the account exists. When you delete your account in the app, we permanently delete the account and all the data linked to it: profile (including description, photos and portfolio), requests, quotes, appointments, messages, reviews, devices, social sign-ins, sessions, the record of the documents you accepted and the identity images. The conversations, reviews and appointments you had with other people also stop existing for them. Deletion cannot be undone. Deletion also erases any messages you sent us through the suggestions and complaints form, the visits you made to profiles and businesses, the app usage events and, if your contact was on our outreach list, the name, phone number and send history on that list. We also delete the client records that professionals and businesses kept about you and that were linked to your account through an appointment, and we ask our team to remove by hand the posts of your requests on Workfly's social media. Only the audit logs remain (sign-up, sign-ins and sign-outs, changes made through the API and team actions), which we keep for security and accountability until the end of the periods in the table above, your email address, kept only as an unsubscribe record so you never receive our outreach again even if your contact reaches us again, the database backups, which keep the history of the last 48 hours, the notices and emails other people have already received with your name, and the client records a professional created on their own with your phone number, with no link to your account.

9. Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection, and to withdraw at any time any consent you have given.

• Erasure: you can delete your account in the app itself or ask for deletion at the privacy email for your country; the effect is the same.
• Portability: use "Download my data" in the app or on the website to receive a file with your data. The file does not include the full ID number (it is masked), the identity verification images (only the status and dates of each submission), messages you received (only the ones you sent), suggestions and complaints sent through the form, app usage events, the session and notification tokens or technical records (access, audit and visit logs). Each list includes up to 1,000 items (messages, up to 5,000; notifications, up to 500), and the file states which list was cut; if you want a full copy, ask at the privacy email for your country.
• Other rights: write to privacidad@workfly.es (Spain) or privacidade@workfly.pt (Portugal).

We reply within 1 month, which may be extended in the cases set out in GDPR art. 12.3.

If you believe your rights have not been respected, you can lodge a complaint with the supervisory authority: in Spain, the Agencia Española de Protección de Datos (AEPD, www.aepd.es); in Portugal, the Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt).

How the website uses cookies is described in the Cookie Policy.

10. Automated decisions and ordering

We do not make automated decisions that produce legal effects on you or that significantly affect you. The order of search results and the position in the ranking are calculated by fixed rules, described in the Terms of Use.

11. Minors

Workfly is only for people aged 18 or over. If we learn that we are processing a minor's data, we delete it.

12. Changes

When this policy changes, we publish a new version with the update date and let you know in the app, which asks you to read the new version.