Privacy Policy

Workload (https://workload.ai) helps teams run customer-facing workflows from their approved company knowledge—curated facts, policies, and reference answers—while keeping a person in control of every external action. In our currently supported Gmail workflow, Workload reads incoming inquiries in a connected mailbox, prepares a draft reply grounded in approved company facts inside Workload's review console, and sends the reply only after an authorized reviewer approves or edits it.

When you connect a Gmail account, you grant Workload permission to read email, and create drafts and send replies your team approves (restricted in practice to new activity after connection, plus any older thread scope agreed with your workspace). Depending on how you interact with Workload, we collect and use:

• Email content and metadata: Connected email address, sender and recipient details, subjects, dates, labels, and message text from relevant threads, used to identify incoming inquiries, prepare draft replies, display context to authorized reviewers, and send the exact replies your team approves. Workload stores drafts in its own review console and does not create Gmail drafts or change Gmail labels.
• Account connection credentials: Encrypted Google OAuth tokens used solely to maintain your authorized mailbox connection. Credentials are never sent to AI models or included in data exports.
• Workspace and review records: Approved company facts, proposed drafts, reviewer edits and approvals, and service usage records, used to ground replies in your company knowledge and maintain an operational audit trail.
• Contact and booking information: Name, work email, company details, and site attribution collected when you schedule a call or contact us on workload.ai, used to respond to inquiries and measure website performance. Website tools never receive Gmail data.

• AI processing and model training: To draft replies, Workload sends selected conversation context and relevant company facts to our AI model provider for inference. Workload never uses customer email, company knowledge, or Google user data to train, fine-tune, or improve general-purpose AI or machine learning models. We configure AI requests to opt out of payload logging and response caching; upstream provider retention terms on our current routed billing setup remain subject to direct provider verification.
• No sale or advertising: We never sell, rent, or trade Google user data, share it with data brokers, or use it for advertising, creditworthiness, or unrelated profiling. We share Google user data only to provide the user-facing features you authorized, for security, or as required by law; any transfer in a merger, acquisition, or asset sale requires explicit prior user consent.
• Human access: Authorized reviewers in your workspace view retained inquiry context and drafts in Workload. Workload staff are prohibited from reading customer email except with explicit documented customer consent for a specific support request, when necessary for security, or as required by law, with the reason and scope recorded.

We use the following service providers to operate Workload:

• Amazon Web Services (AWS): Cloud hosting, databases, encrypted storage, and backups.
• Cloudflare: Network edge, reviewer access authentication, and AI inference routing.
• Temporal: Workflow scheduling and execution state.
• Google LLC: Connected Gmail mailbox access and OAuth sign-in.
• PostHog (US): Error diagnostics only: a fixed failure code, where in our code it happened, an opaque company ID and the software release. Never email content, addresses, drafts, prompts or error messages.
• Cal.com and HubSpot: Public website scheduling and contact analytics only (never connected to Gmail data).

• Retention: Email content and metadata, drafts, review decisions, and company facts are kept until removed upon a verified administrator request or under a written workspace agreement; automated scheduled expiry is not active today. Content-free audit records (identifiers, timestamps, and status codes, without email text or credentials) and disaster-recovery backups (which do not have a fixed automatic expiration window today) are kept to maintain service integrity and recovery.
• Disconnecting Google access: You can revoke Workload's access at any time in your Google Account permissions to stop new email reads and sends. Disconnecting stops future access but does not automatically delete previously stored records. (https://myaccount.google.com/permissions)
• Export and deletion requests: A verified workspace administrator can request data export or deletion by emailing hello@workload.ai. Because automated multi-store export and deletion tools are still in development, requests today are handled manually using available operator procedures (excluding credentials), and we confirm what was exported or removed along with any stores, backups, or provider copies that remain pending. Any specific retention, export, or deletion commitments in a signed workspace agreement govern that workspace once its onboarding requirements are in place. Deleting Workload's copies does not delete emails in Gmail, recall sent messages, or override third-party providers' own retention policies.

Workload protects data using encryption in transit and at rest and workspace-scoped access controls (this does not represent end-to-end encryption or a completed third-party certification today). For privacy questions, exports, or deletion requests, email hello@workload.ai with your workspace name and administrator role.