Data Processing Addendum

For data you upload or connect (“Customer Data”), you are the controller and Workliq AI is the processor. We process Customer Data only on your documented instructions — which, in practice, means only to perform the analysis you ask for through the product.

For account data (your name, email, billing details, audit records), we act as a controller. That is covered by our Privacy Policy.

We process the contents of files you upload and the results of queries you run against connected databases, for as long as the dataset exists in your workspace.

We do not train any model on your data. Ever, on any plan, including the free tier. Your data is not used to improve the service for other customers.

Analysis is executed by a query engine (DuckDB) against your rows. Language models are used to interpret your question and to write prose — they never compute your numbers. When a model is used to draft a query or a summary, only the schema (column names and types) and a small sample of rows are sent, never the full dataset.

External benchmarking never transmits your figures. When the optional research feature looks up an industry benchmark, the outgoing query is built from the metric name and industry only.

We use a small number of sub-processors to deliver the service. The current list, with the purpose and location of each, is maintained at /subprocessors.

We will give notice before adding a sub-processor that processes Customer Data. If you object on reasonable data-protection grounds, you may terminate the affected service without penalty for the remainder of the paid term.

The technical and organisational measures we actually operate:

• Tenant isolation — every database read and write is scoped to your client ID, enforced at the API edge and covered by an automated cross-tenant test that runs in CI.
• Encryption — TLS 1.2+ in transit with HSTS; encryption at rest on the storage volume.
• Access control — role-based permissions (owner / admin / analyst / viewer), password hashing with bcrypt, expiring JWTs, optional 2FA.
• Audit trail — every significant action is written to a SHA-256 hash-chained log, so tampering, reordering or deletion is cryptographically detectable. Exportable as CSV.
• Query safety — generated SQL is validated before execution: SELECT-only, no system tables, column names checked against the schema, and file access confined to an allowlisted directory.
• Code sandboxing — notebook Python runs with imports and dangerous builtins blocked.
• Backups — encrypted, taken nightly, with a restore drill script used to verify they are actually restorable.

Our current certification status is published honestly on our security page — including what is planned rather than achieved. We do not claim certifications we do not hold.

You can export or permanently delete any dataset from the product at any time. Deletion removes the stored file and its derived analysis; the audit record that a deletion occurred is retained, because an audit log that can be edited is not an audit log.

If you receive a data subject request (access, rectification, erasure, portability) that relates to Customer Data, you can satisfy most of it directly in the product. Where you cannot, email privacy@workliq.me and we will assist within 5 business days.

You decide what to upload. If Customer Data contains personal data, you confirm you have a lawful basis to process it and to have us process it on your behalf.

Please do not upload special-category data (health, biometric, racial or ethnic origin, political opinions, religious beliefs, sexual orientation) or payment card numbers. The service is not designed for them and we do not hold PCI-DSS certification.

If we become aware of a personal data breach affecting Customer Data, we will notify you without undue delay and in any case within 72 hours of becoming aware, with the information we have at the time — nature of the breach, categories and approximate volume of data, likely consequences, and the measures taken.

We will send a follow-up as facts are established rather than delay the first notice until the picture is complete.

Customer Data is retained while your account is active. On termination you have 30 days to export, after which datasets and derived analysis are deleted. Audit logs are retained for 365 days. Encrypted backups age out on their own rotation, no later than 35 days.

Our infrastructure is hosted in India. Where a sub-processor operates outside your jurisdiction, transfers rely on Standard Contractual Clauses or an equivalent lawful transfer mechanism. Locations are listed per sub-processor at /subprocessors.

On reasonable written notice, and no more than once in any 12-month period, we will provide the information reasonably necessary to demonstrate compliance with this addendum. Where an independent audit report becomes available it will be offered in place of an on-site audit.

Data protection queries: privacy@workliq.me
Security reports: security@workliq.me