Privacy Policy

Workbench (“Workbench”, “we”, “us”) is a shared work-management tool for small teams, available at managemywork.space. This policy explains what personal information we collect, why we collect it, who we share it with, and the rights you have over it.

For the purposes of the EU and UK General Data Protection Regulation (“GDPR”) and South Africa’s Protection of Personal Information Act (“POPIA”), the data controller and responsible party is [Legal entity name], [Registered address]. You can reach us about anything in this policy at privacy@managemywork.space.

This policy covers our marketing site, the sign-up and sign-in flow, and the Workbench application. Where your workspace was created by an employer or a team administrator, that organisation decides how the workspace and its content are used and is a controller of that data in its own right. This policy describes only our own processing; for your organisation’s practices, contact your workspace administrator.

Information you give us

• Account. Your email address, a password (stored only as a salted hash by our authentication provider), and a display name.
• Profile. An optional profile picture and any other details you choose to add.
• Workspace content. Tasks, descriptions, comments, assignments, work logs, time estimates and actuals, project and template data, and anything else you or your teammates enter. Some of this may identify you or other people.
• Feedback. If you use the feedback form, the message you send plus an optional name and email address.
• Support. The contents of emails you send us.

Information we collect automatically

• Log and device data. Our hosting provider records your IP address, browser and device type, the referring page, and timestamps for each request. We use this for security, debugging, and abuse prevention.
• Feedback anti-abuse. When you submit the feedback form we store a one-way, salted hash of your IP address — not the address itself — solely to rate-limit spam.
• Analytics. We use Ahrefs Web Analytics, a cookieless product that reports aggregate traffic such as page views, referrers, and approximate country. It does not set cookies, does not build a profile of you, and cannot be used by us to identify you.

We use only strictly necessary cookies. These are set by our authentication provider to keep you signed in and to protect against cross-site request forgery. We do not use advertising, retargeting, or cross-site tracking cookies, which is why you will not see a cookie-consent banner. You can block cookies in your browser settings, but you will not be able to sign in to Workbench if you do.

We use personal information for the purposes below. Where the GDPR applies, the legal basis for each purpose is shown in brackets.

• To provide, operate, and maintain the service and your account [performance of a contract].
• To send transactional email — notifications, review requests, workspace invitations, and calendar blocks [performance of a contract; our legitimate interest in keeping your team informed].
• To keep the service secure, prevent and investigate abuse, and debug problems [our legitimate interest in a safe, working service].
• To understand aggregate usage and improve the product [our legitimate interest in developing Workbench].
• To respond to your feedback and support requests [our legitimate interest in supporting users].
• To comply with the law [legal obligation].

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use it for automated decision-making that produces legal or similarly significant effects.

We do not share your personal information except with the service providers listed below, who process it only on our instructions and under contract, and where we are required to by law or need to in order to protect rights, safety, or the integrity of the service.

If Workbench is ever involved in a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify you beforehand, and any new owner will be bound by this policy or will ask for your consent to a new one.

Our providers may process personal information in the United States and other countries outside the EEA, the United Kingdom, and South Africa. Where personal data is transferred across borders, we rely on recognised safeguards — the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and the equivalent conditions under POPIA — together with our providers’ own compliance programmes.

• Account and profile data: for as long as your account is active, then deleted or anonymised within 90 days of account closure.
• Workspace content: until you or your workspace administrator delete it, or the workspace is closed.
• Feedback submissions: up to 24 months.
• Server logs: typically 30 days, longer where retained for a specific security investigation.
• Backups: encrypted backups may persist for up to 30 days after deletion before being overwritten.

Personal information is encrypted in transit (TLS) and at rest. Access is limited to people who need it, authentication is handled by a dedicated provider, and database access is constrained by row-level security so that each workspace only sees its own data. No method of transmission or storage is completely secure; if a breach affects your personal information we will notify you and the relevant regulator as required by law.

Depending on where you live, you may have the right to access a copy of your personal information, correct it, delete it, restrict or object to how we process it, receive it in a portable format, and withdraw any consent you have given. Under POPIA you may also object to processing on reasonable grounds. These rights have limits and we may need to verify your identity before acting.

You can do much of this yourself in the app: update your details in profile settings, delete content you have created, or close your account. For anything else, email privacy@managemywork.space and we will respond within 30 days (one month where the GDPR applies). If your workspace was created by an employer or team, please also contact them, since they control that content.

Workbench is a workplace tool and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, contact us and we will delete it.

We will post any changes on this page and update the date at the top. For material changes we will give you notice by email or in the app before they take effect.

[Legal entity name]
[Registered address]
privacy@managemywork.space

You also have the right to complain to a data protection authority. In South Africa this is the Information Regulator (inforeg.org.za). In the EEA or the UK it is the supervisory authority in your country of residence.