How we handle your data

Who we are

Worktree is business management software for HR, finance, inventory and commerce, made up of the Worktree web app and the worktree companion mobile app. We are based in Belfast, United Kingdom.

When a business (our customer) uses Worktree, it decides what data about its own staff, customers and suppliers goes into its account. For that data, the business is the data controller and Worktree processes it on the business's behalf. For the account details of people who sign up and use Worktree, and for visitors to this website, Worktree is the data controller.

What we collect

• Account details: your name, email address, and profile photo if you sign in with Google.
• Business data your organisation adds: for example employee records, invoices, expenses and receipts, products, stock, sales and customer details.
• Payment and billing details: subscription and payment records. Card details are entered directly with Stripe and never reach our servers.
• Files you upload, such as receipts, attachments and company logos.
• Messages you send us through the contact form, and questions you ask the in-app AI assistant.
• Technical data needed to run the service, such as sign-in sessions, IP addresses and server logs.

The worktree mobile app

The mobile app connects to your existing Worktree account. It has no separate password; you pair it by scanning a code shown in the web app.

• Camera: used to scan pairing codes and product barcodes. Scanning happens on your phone, and the app does not upload photos.
• Location: required by Stripe while you take card payments, to help prevent fraud. It is used by Stripe's payment software on your device. Worktree does not store your location.
• Face ID, Touch ID and fingerprint: used only to unlock the app. Biometric data stays on your device and is never shared with us.
• Device details: the device name, its platform (iOS or Android), when it was last used, and a push notification token so we can tell you about incoming payment requests.
• Sign-in tokens are kept in your device's secure storage. Removing the device from Profile → Mobile App in the web app signs it out.

How we use your data

We don't sell personal data, and we don't use it for advertising.

• To provide the service your organisation has signed up for, including payroll, invoicing, stock and point-of-sale features.
• To take and record payments, and to manage your subscription.
• To send service emails, such as account verification, team invitations and account notices.
• To keep Worktree secure, prevent abuse and fix problems.
• To reply to your enquiries.

Our legal basis

Under UK GDPR we rely on contract (to provide the service you or your organisation signed up for), legitimate interests (to keep the service secure and improve it), legal obligation (for example keeping financial records), and consent where we ask for it.

Who we share data with

We use trusted providers to run Worktree. Each one only receives the data needed for its job:

• Stripe: subscription billing, card payments and Tap to Pay.
• Google: Sign in with Google, and the Gemini AI service, which reads receipts you choose to scan and answers questions in the in-app assistant.
• Cloudflare: file storage.
• Resend: sending email.
• Expo, Apple and Google: delivering push notifications to the mobile app.
• Our hosting and infrastructure providers, and internal team tools we use to keep track of new sign-ups.

We may also disclose data where the law requires it. Some of these providers process data outside the UK. Where they do, they are covered by appropriate safeguards such as the UK International Data Transfer Addendum or an adequacy decision.

Cookies

Worktree uses essential cookies to keep you signed in and to secure your session. We don't use advertising or third-party tracking cookies. Stripe may set its own cookies on payment pages to prevent fraud.

How we protect data

Data is encrypted in transit and at rest. Each business's data is kept separate from every other business's, and access within a business is controlled by module permissions.

How long we keep data

We keep account and business data for as long as your organisation's account is active. When an account is closed, we delete or anonymise its data within a reasonable period, except where we must keep records for longer by law, such as financial and tax records.

Your rights

You can ask to access, correct, delete or export your personal data, or object to or restrict how we use it. If your data was added by an employer or another business using Worktree, contact that organisation first, since they control it. We will help them respond.

You can also complain to the UK Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to put things right first.

Deleting your account

To delete your Worktree account, or your organisation's account and its data, send us a request through our contact page using the email address on the account. We'll confirm your identity and tell you what will be deleted and what we have to keep by law. Deleting your account also signs out any paired mobile devices.

To stop just one phone using your account, remove it from Profile → Mobile App in the web app.

Children

Worktree is a tool for businesses and isn't intended for anyone under 16.

Changes to this policy

If we make significant changes, we'll update the date at the top of this page and let account holders know.

Contact us

Questions about privacy or this policy can be sent through our contact page.