Privacy Policy

1. Data controller

WorkDigest Innovations SL (in formation), tax ID B-XXXXXXXX (pending registration), registered office in Seville, Spain. Contact: info@workdigest.io.

2. Data we collect

We process the following categories of personal data:

• •Identification data: full name and email address.
• •Access data: password (stored as a bcrypt hash, never in plain text).
• •Usage data: queries made, projects created, connectors configured, and activity metadata.
• •Connected project data: content from sources the user expressly authorizes (tickets, emails, documents, commits).

3. Purpose of processing

Data is used exclusively to provide the WorkDigest service: indexing the sources the user authorizes, answering natural-language queries, managing the account, and improving service quality through aggregated, anonymized usage metrics.

4. Legal basis for processing

• •Performance of a contract (GDPR art. 6.1.b): data necessary to provide the service.
• •Consent (GDPR art. 6.1.a): for optional marketing communications.
• •Legitimate interest (GDPR art. 6.1.f): for service security and fraud prevention.

5. Recipients

Data may be accessed by the following service providers acting as data processors:

• •DigitalOcean: hosting and compute infrastructure.
• •Supabase: database and vector storage.
• •Anthropic: query processing via AI models (data is sent per query and is not retained for training purposes under the terms of the data processing agreement).

6. International transfers

Some of our providers are located outside the European Economic Area. These transfers are carried out under appropriate safeguards (European Commission Standard Contractual Clauses or applicable adequacy decisions).

7. Retention period

Data is retained for as long as the user maintains an active account and, after cancellation, for the legally required periods (generally 5 years for tax data and up to 3 years for ordinary user data, depending on applicable regulations).

8. User rights

The user may exercise the following rights recognized under the GDPR at any time:

• •Access to their personal data.
• •Rectification of inaccurate data.
• •Erasure ("right to be forgotten").
• •Portability of data in a structured format.
• •Objection to processing.
• •Restriction of processing.

To exercise these rights, send an email to info@workdigest.io specifying which right you wish to exercise and attaching a copy of your ID document.

You may also file a complaint with the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (www.aepd.es).