Privacy Policy

1. What this policy covers

This Privacy Policy explains how WorkplaceReady collects, stores, uses, and protects information about you and your business when you use our website and platform.

2. What we collect

We collect the information you provide directly, including:

• Account information: email address and password (via our secure authentication provider).
• Business Profile: industry, employee count, workplace type, address, operational details, and answers to the readiness questionnaire.
• Payment information: handled by Stripe. We do not store full payment card details on our servers.
• Operational request information: limited first-party technical details about requests to our own site, recorded to run, secure and diagnose the service (see section 6).
• Optional usage data: pages visited and selected product events, collected via Google Analytics 4 and our own first-party measurement only after you accept analytics (see section 6).

3. How we use your data

We use your data to:

• Generate your personalised readiness assessment and workspace reports.
• Maintain your account, process payments, and manage subscriptions.
• Improve the platform and respond to support requests.
• Send transactional emails related to your account, purchases, or assessments.

3a. Customer feedback and testimonials

Some time after you complete an assessment we may invite you, inside your workspace, to share feedback on how useful it was. Providing feedback is entirely optional, and declining has no effect on your account, your reports, or your access to any module.

Feedback you submit is stored privately and is visible only to authorised WorkplaceReady administrators. We use it to improve the assessments, reports and recommendations.

We never publish your feedback automatically. If we would like to quote part of it publicly, we prepare the exact wording and the exact attribution and ask you to approve it first. You choose how you may be identified — anonymously, by role and business type, or by name, role and company — and you can request changes, decline, or withdraw a previously approved quotation at any time by contacting us. Withdrawn quotations are removed from public use.

4. Data storage and security

Your data is stored in our secure backend infrastructure. We use industry-standard encryption, access controls, and authentication to protect it. Only you (and authorised WorkplaceReady admins for support purposes) can access your account data.

5. Service providers

We do not sell your data. We share limited information with the service providers we actually use to run WorkplaceReady:

• Supabase — authentication and platform data storage.
• Stripe — payment processing. We do not store full card details.
• Google Analytics 4 — optional website measurement, used only after you accept analytics.
• Infrastructure and hosting providers required to serve and operate the website.

We may also share data where required by law or to protect our rights.

6. Essential storage, operational request information, optional analytics and your consent preference

Essential platform storage

Our authentication provider (Supabase) uses necessary browser storage to keep you signed in. This storage is required for account, checkout and assessment functions. Refusing analytics does not disable your account, your purchases, the Customer Portal or your assessments. Essential storage is not analytics and is not optional.

Operational first-party request information

To operate, secure and diagnose the site — and to tell genuine browser visits apart from automated scanners and bots — we keep a limited record of requests made to our own servers. This is separate from optional analytics: it is not shared with advertising networks, it is not used to build a profile of you, and it happens on our own infrastructure.

For each page request we may retain: the page path (with query values removed), the campaign parameters already present in a link you followed (such as utm_source or a campaign identifier), whether a referring site was present, a coarse browser or bot family and device category, and a broad country indication provided by our hosting network. We do not store your IP address, we do not store raw request headers, and we do not use device fingerprinting or cross-site tracking.

A request record is not the same as a person. We do not link these records to individual named recipients of our outreach, and we do not attempt to identify you from them.

Optional analytics

Google Analytics 4 is optional, and so is our own first-party measurement of how pages are used. Neither runs before you choose. Google Analytics 4 is not loaded, no analytics request is made to Google, and our own measurement collects, stores and sends nothing, until you explicitly choose “Accept analytics”. When enabled, measurement covers page visits and a small set of product-use events (for example, an assessment being started or completed).

Our own measurement records only coarse signals: how far a page was scrolled in broad steps, roughly how long a page was actively in view, how many interactions occurred, and which approved product events happened and in which part of the page. It does not record keystrokes, form contents, assessment answers, mouse movement or screen recordings.

We do not send email addresses, passwords, full sensitive URLs or raw Stripe identifiers to Google Analytics. Page addresses are reduced to the page path only, so query values such as a checkout session or a password-recovery link are removed before measurement. Advertising storage, advertising user data and advertising personalisation remain disabled, and we do not use advertising pixels.

You can refuse analytics without losing any part of the service, and you can change your choice at any time using the “Analytics preferences” control in the footer of every page. No account is needed to change it. If you withdraw your choice, our own measurement stops immediately and its browser session record is discarded.

Your consent preference

When you make a choice, we store a small first-party preference in your browser recording only whether analytics was accepted or refused, and when. This exists so we do not ask you again on every page. It contains no email address, no account identifier and no campaign data, and it is never used for advertising. The preference expires after about six months, after which we ask again.

7. Your rights

You can view the account, plan and assessment information currently available to you in Account and Workspace. For correction, export or deletion of your data — including your Business Profile or your whole account — email privacy@workplaceready.app. We handle such requests in line with applicable obligations. Some financial or security records may need to be retained where we are required to keep them.

8. Data retention

We keep your data for as long as your account is active or as needed to provide the Services. When you delete your account, we remove your personal and business data from active systems within a reasonable period, unless we are required to keep it longer by law.

Minimal operational request records are kept for up to 30 days and then deleted automatically. Our own first-party measurement records — the session and event records created only after you accept analytics — are kept for up to 90 days and then deleted automatically.

9. Important disclaimer

WorkplaceReady provides informational workplace heat readiness guidance and is not legal, medical, OSHA, or safety-engineering advice. Customers are responsible for complying with local workplace safety laws and regulations, including any applicable privacy or data-protection obligations. The technical measures described in this policy, including our analytics consent controls, are provided in good faith and do not constitute a guarantee of compliance with GDPR, ePrivacy, CCPA or any other legal framework.

10. Contact

WorkplaceReady is operated by Fogwalkers OÜ, Estonia. It acts as the data controller for the information described in this policy. For privacy questions or data requests, email privacy@workplaceready.app.