מדיניות פרטיות

This Privacy Policy explains how AZZANI, an individual-owned business operating from the Philippines and Saudi Arabia ("WorkMA", "we", "us" or "our"), collects, uses, shares and protects personal data when you use WorkMA.

For privacy requests, contact inwo@7azzani.com. General enquiries: info@workma.works.

1. Scope and Controller

We are the controller of the personal data described in this policy. This policy covers our website, dashboard, Nexus IDE, collaboration tools and AI features. It does not cover third-party websites or services that we do not control.

2. Data We Collect

• Account data: name, email address, role, workspace membership, profile information, authentication data and password hashes.
• Billing data: plan, billing cycle, transaction references and payment status. Card and payment credentials are processed by our payment providers; we do not store full card numbers.
• Workspace data: code, files, tasks, project metadata, meeting information, comments and other content you or your team create.
• AI data: prompts, selected file context and AI responses when you use Copilot. Copilot requests are sent to the AI provider associated with the workspace key.
• Usage and security data: IP address, device and browser information, timestamps, authentication events, audit logs and feature usage.
• Analytics data: page paths, page titles on public pages, referrer, approximate location, language, device category, browser, session and engagement events. Analytics is loaded only after consent and uses sanitized paths.
• Support data: messages, attachments and information you provide when requesting help.

3. How We Use Data and Legal Bases

We use personal data to provide and secure the Service, create and manage accounts, process subscriptions and payments, deliver collaboration and AI features, provide support, prevent abuse, maintain audit logs, improve the Service and comply with law.

Where GDPR or UK GDPR applies, our legal bases are: performance of a contract (providing the Service); legitimate interests (security, fraud prevention, service improvement and business operations); consent (optional analytics and any optional AI processing that requires it); and legal obligation (tax, accounting and lawful requests).

4. AI and Automated Features

Copilot is a bring-your-own-key feature. When you use it, the prompt and selected file context are sent to the configured provider, currently OpenAI, under that provider's terms and the workspace's API key. Do not put passwords, API keys, personal data or other secrets into prompts.

We do not use your workspace content to train our own models. AI output may be inaccurate or incomplete, and you are responsible for reviewing it. Sentinel currently performs a local credential and security-pattern scan; it is not a model-backed AI review.

5. Analytics and Cookies

We use Google Analytics 4 on public and authenticated pages only after you accept analytics. Google LLC acts as a processor. We disable advertising features and Google Signals, do not set analytics cookies before consent, remove query strings and numeric object IDs from tracked paths, and use a generic title for private pages.

Google Analytics data is retained for up to 14 months. See our Cookie Policy for the cookies used and how to withdraw consent.

6. Sharing and Subprocessors

We do not sell personal data or share it for cross-context behavioural advertising. We share data only as needed with:

• OpenAI for Copilot requests, using the workspace's configured key;
• Google for Google Analytics and Google Fonts;
• Payment processors, including Checkout.com, PayPal and Polar, for billing;
• Hosting, infrastructure and content-delivery providers that operate the Service;
• Professional advisers and authorities where required by law or necessary to protect rights and security.

These providers process data under their own terms and, where required, appropriate contractual safeguards. A current subprocessor list is available on request.

7. International Transfers

Our providers may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses or an applicable adequacy mechanism. Contact us for more information.

8. Retention

We retain account and workspace data while your account is active and for a reasonable period afterward for backup, security and legal purposes. Following a verified deletion request or account termination, production data is normally deleted within 30 days, subject to backup rotation, fraud prevention, dispute resolution and legally required financial records.

Security and audit logs are retained for a limited period appropriate to security and legal needs. Google Analytics data is retained for up to 14 months.

9. Security

We use technical and organisational measures including TLS for data in transit, application-layer encryption for tenant provider credentials and project secrets, access controls, audit logging and infrastructure hardening. No internet service is completely secure, and we cannot guarantee absolute security. You are responsible for protecting your credentials and for not submitting secrets to AI prompts.

10. Your Rights

Depending on your location, you may have the right to access, correct, delete, restrict or port your personal data, object to certain processing, withdraw consent, and lodge a complaint with your local supervisory authority. To exercise a right, contact inwo@7azzani.com. We may need to verify your identity before acting.

If you are a California resident, you may have rights to know, delete, correct and opt out of sale or sharing. We do not sell personal information or share it for cross-context behavioural advertising. You may use an authorised agent where permitted by law.

11. Children

The Service is intended for organisations and professional users and is not directed to children. We do not knowingly collect personal data from children below the age of legal majority. Contact us if you believe a child has provided data.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the revised version and update the "Last Updated" date. Material changes will be communicated where required. The English version controls over any translation.

13. Contact

Privacy and data-protection enquiries: inwo@7azzani.com
General enquiries: info@workma.works

Controller: AZZANI, an individual-owned business. Operating locations: Philippines and Saudi Arabia. A postal address for formal notices is available on request.