Skip to content
WORKDEN

Privacy policy

Last updated 11 October 2026

This explains what we collect and why. It is written to be read, not to be unreadable.

What we collect

When you visit the website

  • Pages viewed, referring site, and any campaign parameters in the URL you arrived on.
  • Approximate location and device type, derived by our analytics provider.
  • If you type your email address into a sign-up box on the website: that address, the page you were on, and the wording you agreed to when you pressed the button.

Website analytics is provided by PostHog, hosted in the EU. It is served through our own domain rather than a third-party one, so for that your browser only talks to us.

The public website also uses Google Analytics. It is loaded from Google when you arrive, and tells Google which pages you viewed, roughly where you are and what kind of device you are using. A notice on your first visit lets you switch it off. If you say no, it is stopped and is not loaded on later visits, and it is never loaded for a browser that sends the Global Privacy Control signal.

When you sign up

  • Your name, work email address, company name, and optionally your team size.
  • The plan you chose and how you found us.
  • Your password, stored only as a one-way hash produced by a deliberately slow, memory-hard method. We cannot read it, and neither could anyone who took a copy of the database.

When you use Workden

  • The CRM records you create: companies, contacts, deals, tasks and activity.
  • If you connect a mailbox: the credentials for it, encrypted with a key belonging to your workspace, and the messages you send or sync through it. That connection is private to the person who made it, not to the workspace, and not to us for any purpose beyond running it.
  • If you use email marketing: your campaigns, your audiences, and the consent and unsubscribe state for the addresses you mail.
  • If you switch on tracking: that a message was opened or a link clicked, and when. No IP address, no device fingerprint and no location is recorded against it.
  • If you connect a shop or website: the order and enquiry data needed to put that activity onto the right customer's timeline. For Shopify, exactly what that means is set out below.
  • If you connect an AI assistant: the fact of the connection, what you allowed it to do, and the record of what it proposed and who approved it. We do not receive or store your conversations with that assistant.
  • Security events, such as sign-ins and permission changes, in an audit log.

If you connect a Shopify store

Connecting a store gives Workden read-only access. It cannot create, change or delete anything in your store. It reads:

  • Customers: name, email address, phone number, address, tags, notes, and whether they have agreed to email and SMS marketing.
  • Orders: what was bought, prices, discounts, shipping, tax, refunds, and fulfilment and tracking details. Shopify does not send card details, and Workden never has them.
  • Products: titles, product types and vendors, so an order can say what kind of thing was bought.
  • Abandoned checkouts: the items and the customer's contact details. When you connect, that is the last 90 days, which is all Shopify keeps; after that, new ones as they happen.

We use it to show each customer's orders on their record in your workspace, to your team and to any AI assistant you choose to connect to it. It is not shared with other businesses and not used for advertising. A customer's marketing consent is recorded so you can see it, but connecting a store never subscribes anybody to your marketing. The access Shopify grants us is stored encrypted.

If you disconnect the store in Workden, we stop reading it. What was already brought in stays in your workspace until you delete it, like any other record you hold.

If you uninstall the app from Shopify, Shopify tells us 48 hours later and we delete the store data we hold: the store's customer records, orders, checkouts, the raw data behind them, and our access to the store. Your contacts, and the entries on their timelines recording what they ordered, stay. They are your business's record of its customers, and removing an app should not empty your CRM.

If one of your customers asks Shopify what data is held about them, we tell your workspace's owners and admins in Workden, because the data is yours and so is the answer. If they ask to be erased, see How long we keep things below.

What we never send to analytics

This is worth being specific about. Our analytics never receives contact names, email addresses, phone numbers, deal values, CRM notes, message contents, or anything else you typed into the product. Analytics events carry plan keys, campaign parameters and opaque identifiers only. That restriction is enforced in code, not by policy.

Payment information

Card details are collected and stored by Stripe on their own checkout pages. Workden never sees them. We keep the Stripe customer and subscription identifiers so we can tell which workspace is on which plan.

Who we share with

  • Stripe: payment and subscription processing.
  • PostHog (EU): website and product analytics, within the limits above.
  • Google: website analytics, on the public website only and not once you have said no to analytics cookies. Never from inside the product.
  • Resend: delivery of the marketing email you send, and the bounce and complaint results that come back. They receive the message and the addresses you are sending it to, and nothing else about your workspace.
  • Your own mail provider: where you have connected a mailbox, the mail you send through it goes through them, as it would if you had pressed send in their app.
  • Our hosting provider: the server the application runs on.

An AI provider is not on this list. Workden does not send your data to a model on your behalf; where you connect an assistant, it is your account reading your workspace, under an authorisation you granted and can revoke.

We do not sell personal data, and we do not use your CRM contents to train models.

How long we keep things

Your CRM records are yours: contacts, companies, deals, notes and order history stay for as long as your workspace exists, because deciding when to delete your own customer list is your call and not ours. What we delete on a clock is the copies we make to run the product, once they have served their purpose.

  • Raw data received from a connected shop, meaning the unprocessed webhook payloads behind your timeline entries: 90 days.
  • Abandoned checkouts read from your shop, and their raw payloads: 180 days after the shopper last touched them. The timeline entry stays; the basket does not.
  • Items you have resolved in the connector review queue: 90 days. Anything still waiting for you is kept until you deal with it.
  • Automation run history: 90 days. Audit logs: 400 days, so a question asked in an annual review can still be answered.
  • Support tickets you send us, and the replies on them: 400 days after we mark the ticket done. A ticket that is still open is kept until it is. Whatever you type into one is kept with it, so it is worth not pasting a password into a support request.
  • Encrypted backups: 30 days, rolling. A record you delete can still exist in a backup until that backup ages out.
  • If your subscription ends, we keep the workspace for 30 days so you can come back, and then delete it and everything in it.
  • Signup and enquiry records: kept as our record of how customers found us.
  • An email address given in a sign-up box on the website: until you unsubscribe or ask us to remove it.

If a shopper asks a merchant using Workden to erase them, Shopify tells us and we delete the copies we hold: the store customer record, their orders and checkouts, and the raw data behind them. We delete the contact itself only if our connector created it. A contact the business typed in or imported is the business's own record, and we strip our entries from it rather than destroying it.

If something goes wrong

If personal data is ever exposed, we tell the businesses affected without undue delay, and we report to the ICO within 72 hours where the law requires it. Where the risk to you is high, we tell you directly. We have a written plan for this rather than an intention to write one.

Your rights

If you are in the UK or EU you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Ask through the contact page and we will respond within one month.

If you are a contact stored inside a customer's Workden workspace, that customer controls that data and is the right first point of contact, though you may always come to us and we will help.

If you received a marketing email sent through Workden, it was sent by that business rather than by us, on their instructions and from their own list. The unsubscribe link in it works immediately and applies wherever they might otherwise mail you from Workden again; you do not need our permission or an account to use it.

Marketing email

We only email you product updates if you ticked the box at signup, or gave us your address in a sign-up box on the website. The box at signup is never pre-ticked, and every such email has an unsubscribe link. Service email about your account and billing is not marketing and is sent regardless.

Cookies

A session cookie keeps you signed in, and the product does not work without it. Analytics uses a first-party cookie and local storage to recognise a returning visitor, and we honour your browser's Do Not Track setting.

On the public website, Google Analytics sets cookies of its own to tell one visit from another, from your first page unless you have said no. If you say no, it is switched off, its cookies are removed, and our own website analytics stops keeping anything in your browser as well. Your answer is remembered in your browser, along with which pop-up messages you have closed, so that you are not asked again. You can change your answer with the Cookie settings link at the foot of any page.

Changes

If this policy changes materially we will say so before it takes effect. The date at the top always reflects the current version.