Workky Privacy Policy

WORKKY, Inc. ("Workky," "we," "us") provides Emma, an AI receptionist for service businesses, and Workky CRM. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices you have. It covers:

• Visitors to workky.ai and people who contact us or request a demo.
• Customers — businesses that use Emma and Workky CRM, and their staff.
• Callers — people who call or message a business that uses Emma.

Questions: privacy@workky.ai.

1. Two Roles: Business and Service Provider

For visitors and customers, Workky is the "business" (controller): we decide how your information is used.

For callers, the Workky customer you called is the business. Workky is that customer's service provider (processor). We process caller information only on the customer's instructions and only to provide the Services. If you called a business that uses Emma and want to access, correct, or delete your information, contact that business directly; we will help them respond.

2. Information We Collect

2.1 From visitors and customers

2.2 From callers (processed for our customers)

Callers may share sensitive information (for example, details of a legal matter or a health concern). We process it only to deliver the conversation to the business. Workky does not currently accept Protected Health Information under HIPAA; see our Compliance page.

2.3 Demo line and contact forms

If you call our public demo number or use a website demo, that conversation is recorded like any Emma call. Please do not share health, financial, or other sensitive information in a demo.

3. How We Use Information

• Provide, operate, and support Emma and Workky CRM.
• Answer calls, transcribe them, book appointments, send SMS confirmations, and store records in the customer's CRM.
• Bill customers and prevent fraud.
• Communicate with customers about their account and service changes.
• Send marketing to prospects and customers (you can opt out at any time).
• Secure our systems and investigate abuse.
• Comply with law.

We do not use call recordings, transcripts, or CRM data to train or improve AI models. Our AI vendors process this data only to generate Emma's responses and are contractually prohibited from training on it.

4. How We Share Information

We share personal information only with:

• Service providers that process data for us under contract: cloud hosting (Amazon Web Services), telephony and SMS (Twilio, which receives a phone number only to deliver the call or text; see section 5), AI language and voice models (OpenAI, Google), AI processing (Anthropic), payments (Stripe), and email/analytics tools. The current list is at workky.ai/subprocessors.
• Our customers — caller information goes to the business the caller contacted.
• Calendar and tools a customer connects, at the customer's direction.
• Legal and safety — to comply with law, respond to lawful requests, enforce our Terms, or protect rights and safety.
• Business transfers — if Workky is acquired or merged, with notice to you.

We do not sell personal information and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months.

5. Text messaging

Mobile phone numbers and SMS opt-in consent collected by Workky are never shared with, sold to, or rented to third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties.

6. Cookies

We use essential cookies to run the site and, with your consent, analytics and marketing cookies. See our Cookie Policy. You can change your choices any time via the cookie banner.

7. Retention

• Call recordings and transcripts: 90 days by default; customers may set a shorter or longer period in Workky CRM.
• CRM records: for as long as the customer's account is active, then deleted within 30 days of closure.
• Account and billing records: up to 7 years as required by tax and accounting rules.
• Marketing data: until you unsubscribe or 3 years of inactivity.
• Backups: purged within 90 days.

8. Security

We use encryption in transit (TLS 1.2+) and at rest, role-based access controls, multi-factor authentication for Workky staff, per-customer data separation, logging, and vendors that maintain SOC 2 or equivalent audits. No system is perfectly secure; if a breach affects your personal information we will notify you as required by law, including California Civil Code §1798.82.

9. Your California Privacy Rights (CCPA/CPRA)

California residents have the right to:

• Know what personal information we collect, use, and disclose, and to request a copy.
• Delete personal information we hold, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing — we do not sell or share, so no opt-out is needed.
• Limit use of sensitive personal information — we use sensitive information only to provide the Services, which is a permitted use.
• Non-discrimination for exercising these rights.

To exercise these rights, email privacy@workky.ai or use the form at workky.ai/privacy-request. We will verify your identity by matching information you provide with what we have on file, and respond within 45 days. You may use an authorized agent with written permission.

If you are a caller to one of our customers, we will forward your request to that business and assist them.

Residents of other states with privacy laws (for example, Colorado, Connecticut, Virginia, Texas, Oregon) may exercise similar rights through the same channels.

10. Children

The Services are for businesses and are not directed to anyone under 18. We do not knowingly collect information from children. If a child's information reaches us through a call, we process it only as the customer's service provider; contact the business you called.

11. Where Data Is Stored

Data is stored and processed in the United States on Amazon Web Services. Some vendors may process data in other countries under appropriate safeguards.

12. Changes

We will post updates here and change the date above. For material changes we will notify customers by email.

13. Contact

WORKKY, Inc. Email: privacy@workky.ai Privacy request form: workky.ai/privacy-request