WorkTree

Privacy Policy

Effective date: October 3, 2026

Worktree Technologies LLC operates the WorkTree website and application. Our mailing address is Calle 1 #15, Sector El Frutal, Hato Tejas, Bayamón, Puerto Rico 00959. Send privacy questions, access or deletion requests, and complaints to Pedro@worktreeapp.com and Tommy@worktreeapp.com.

This Policy explains the categories of personal information we may collect, where it comes from, how we use and disclose it, how long we retain it, and how to contact us about it. It applies to website visitors, people who contact us, and Service users. Not every described feature is enabled for every account. Where an organization controls its workspace information, WorkTree generally processes that information to provide the Service on its behalf; the organization may separately determine what its authorized users upload, share, and retain.

1. Information we collect and its sources

Depending on your use of the Service, we collect or receive:

Sources include you, your organization and its authorized members, enabled connected services, and automated operation of the Service. You may browse public informational pages without registering, although technical information may still be processed when a page is requested.

2. Purposes of processing

We use information to operate and secure the website and application; create and administer accounts and workspaces; provide requested collaboration, integration, and AI functionality; authenticate users; respond to inquiries and support requests; troubleshoot and maintain the Service; detect abuse and investigate security incidents; comply with legal obligations; and protect legitimate rights and interests. We may use operational information to understand reliability and improve functionality. We do not treat access to an organizational workspace as permission to use its content for unrelated advertising or to disclose it to unrelated third parties.

3. Organizational workspaces and individual requests

Your organization ordinarily determines workspace membership, permissions, and the information it places in WorkTree. Its administrators and authorized users may access, modify, export, or remove workspace information consistent with their roles. WorkTree processes workspace information to deliver the Service and follow authorized instructions, while separately handling account administration, website operations, security, and direct communications for its own operational purposes. For a request concerning organization-controlled information, we may direct you to the organization or coordinate with its administrator, while handling requests for information WorkTree controls directly.

4. AI processing

When an AI feature is used, WorkTree may transmit the prompt and the selected information needed for that feature to an AI technology provider. Not every AI feature waits for a separate request each time: where it is enabled for a workspace, WorkTree may automatically generate a daily briefing for its members. A briefing draws on workspace information and, for a member who has connected a mailbox, on details of that member’s stored messages such as subject, sender, priority, and time of receipt. WorkTree currently routes AI requests through OpenRouter to the model providers it makes available, and configures those requests to require that the provider neither retain the content nor use it for training. Such providers may process the transmitted material under their applicable service terms and configurations. That configuration is a setting we apply, not a guarantee about every provider: retention periods and restrictions on model training vary by provider, and we do not guarantee zero retention or a prohibition on model training for every provider. Do not enter information into an AI feature unless you and your organization are authorized to process it in that way. Contact us for information about the providers and terms applicable to your organization’s enabled configuration. AI outputs may contain errors and should be reviewed by a person before consequential use.

5. Connected services

If you authorize a Google, Microsoft, or other integration, WorkTree may receive information within the permissions you approve and the feature you enable. You can generally revoke access through the connected provider and contact us for assistance disconnecting it. Revocation may stop future access but does not automatically remove information previously copied into a workspace or records retained for security, legal, or operational reasons. A connected provider independently governs its own services and account data under its terms and privacy notice.

Microsoft 365 and Outlook

When you choose to connect a Microsoft account, WorkTree requests only these permissions:

WorkTree stores message details and a short preview of each synchronized message, together with any AI summary or classification produced for it. Full message bodies and attachments are retrieved when needed and are not kept as stored copies. Calendar events are held in a short-lived cache and are not stored in the WorkTree database. Access credentials for the connection are stored in encrypted form.

WorkTree uses connected mailbox content for more than synchronization. Where the features are enabled, it produces AI summaries, recaps, and suggested tasks from messages, prioritizes messages, and includes message details in the daily briefing described in Section 4. By connecting a Microsoft account you expressly authorize these uses in addition to synchronization; if you do not agree to them, do not connect the account. For an account provided by an organization, that organization’s agreement with WorkTree must also permit them.

WorkTree does not sell Microsoft account data, does not use it or anything derived from it for advertising or marketing, does not use it to build credit or lending profiles, and does not use it to train generalized AI or machine-learning models. People at WorkTree access it only at your request, to investigate a security or abuse concern, to meet a legal requirement, or where necessary to operate the Service.

Disconnecting the account in WorkTree deletes the connection and its synchronized messages. You can also withdraw WorkTree’s access at Microsoft: for a personal account at https://account.live.com/consent/Manage, and for a work or school account at https://myapps.microsoft.com or through your administrator. Withdrawing access at Microsoft alone stops WorkTree from renewing its access, but access Microsoft has already issued can remain usable until it expires, typically within about an hour. To stop access immediately, disconnect the account in WorkTree as well.

Google

When you choose to connect a Google account, WorkTree requests only these permissions:

Storage, AI use, and disconnection work as described for Microsoft above. You can also remove WorkTree’s access in your Google Account permissions.

WorkTree’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy) and, for Gmail and other Google Workspace permissions, the Google Workspace APIs User Data and Developer Policy (https://developers.google.com/workspace/workspace-api-user-data-developer-policy), including their Limited Use requirements. WorkTree does not sell Google user data, does not use it for advertising, does not use it to build credit or lending profiles, and does not use or transfer it to develop, improve, or train generalized AI or machine-learning models. People at WorkTree read it only with your agreement to view specific messages, to investigate a security or abuse concern, to meet a legal requirement, or for internal operations that Google’s policies permit.

6. Disclosures and recipients

We disclose information as necessary to: (a) your organization and authorized workspace members; (b) service providers performing hosting, storage, authentication, communications, support, security, integrations, or AI processing for us; (c) connected services you or your organization authorize; (d) authorities or other recipients where disclosure is legally required or otherwise lawful and necessary to protect rights or safety; and (e) parties to a corporate transaction, subject to appropriate confidentiality and legal safeguards. Our current service providers are Clerk (sign-in and identity), Supabase (database and file storage), Vercel (hosting), OpenRouter (routing AI requests to model providers), Upstash (rate limiting and short-lived caching), Resend (service email), and, where enabled, Sentry (error diagnostics) and OpenStreetMap Nominatim (looking up a location). We do not sell organizational workspace content as an advertising product. Providers, processing regions, and subprocessors may differ by configuration; contact us for the current information applicable to your deployment.

7. Cookies and similar technologies

The website and application may use cookies and similar storage for authentication, session continuity, preferences, security, and operation. At present these are: sign-in and session cookies set by our identity provider, Clerk; a language-preference cookie (worktree_locale) and an active-team cookie (worktree_active_team), each kept for up to about one year; a cookie lasting about ten minutes that secures the connection of a third-party account; and browser storage for interface preferences such as the sidebar, calendar, and recently viewed items. None of these is used for advertising. Your browser may allow you to block or delete them; disabling necessary storage may prevent sign-in or other functionality. If optional analytics or advertising technologies are enabled, we will provide the applicable disclosures and choices required by law.

8. Retention and deletion

We keep information for as long as reasonably necessary to provide the relevant service or fulfill the purposes described above, subject to applicable agreements and lawful requirements. Account and workspace data may remain while an account or organizational relationship is active. Support communications, access and security logs, integration records, and backups may have different retention periods because their purposes differ. When information is no longer needed, we take steps to delete or de-identify it in accordance with applicable processes and obligations; some information may remain where needed for legal compliance, security, dispute resolution, or backup rotation. Disconnecting an integration does not by itself delete information already incorporated into a workspace. We cannot promise a uniform deletion deadline across all systems. For a specific request or the retention terms applicable to your organization, contact us at the email addresses above.

9. Security

We maintain administrative, technical, and organizational measures designed to protect information against unauthorized access, alteration, disclosure, or loss, taking account of the nature of the information and the risks involved. Access is limited according to roles and operational need. No system or transmission method is completely secure. This Policy does not commit us to a particular certification, encryption implementation, hosting region, or incident-notification deadline; any such commitment applies only where it is stated in an applicable written agreement.

10. Your requests and choices

You may contact us to request information about our processing, access to or correction of your personal information, deletion where available, or assistance with account closure and integrations. We may verify your identity, protect other people’s rights, and coordinate requests relating to organization-controlled workspaces with the relevant administrator. We will explain where an applicable law or legitimate retention obligation limits a request. You may also manage some information through available account or organization settings and revoke third-party permissions with the relevant provider. We will respond in accordance with applicable law; the rights available to you depend on the law that applies to you.

11. International processing

Our service providers may process information in Puerto Rico, the United States, or other locations depending on the provider and enabled configuration. Privacy and data-protection rules may differ across those locations. We do not promise exclusive storage or processing in any particular region unless expressly agreed in writing. Where a law applicable to a particular transfer requires safeguards, we will address those requirements as applicable.

12. Children

The application is intended only for users 18 years of age or older and is not directed to children. If you believe a person under 18 has registered or submitted personal information, contact us at the email addresses above so we can investigate and take appropriate action.

13. Changes and contact

We may update this Policy as practices or legal obligations change. We will publish the revised version with a new effective date and provide additional notice when required. We will not use a revised Policy to retroactively remove rights or substitute for consent required by law. Questions, complaints, and requests may be sent to Pedro@worktreeapp.com and Tommy@worktreeapp.com, or mailed to Worktree Technologies LLC, Calle 1 #15, Sector El Frutal, Hato Tejas, Bayamón, Puerto Rico 00959. If a translation differs from this English version, the English version controls only to the extent permitted by applicable law.