Privacy policy

Last updated 31 August 2026

This explains what we collect and why. It is written to be read, not to be unreadable.

What we collect

When you visit the website

• Pages viewed, referring site, and any campaign parameters in the URL you arrived on.
• Approximate location and device type, derived by our analytics provider.

Website analytics is provided by PostHog, hosted in the EU. It is served through our own domain rather than a third-party one, so your browser only ever talks to us.

When you sign up

• Your name, work email address, company name, and optionally your team size.
• The plan you chose and how you found us.
• Your password, stored only as an argon2id hash. We cannot read it.

When you use Workden

• The CRM records you create: companies, contacts, deals, tasks and activity.
• Security events — sign-ins, permission changes and similar — in an audit log.

What we never send to analytics

This is worth being specific about. Our analytics never receives contact names, email addresses, phone numbers, deal values, CRM notes, message contents, or anything else you typed into the product. Analytics events carry plan keys, campaign parameters and opaque identifiers only — and that restriction is enforced in code, not by policy.

Payment information

Card details are collected and stored by Stripe on their own checkout pages. Workden never sees them. We keep the Stripe customer and subscription identifiers so we can tell which workspace is on which plan.

Who we share with

• Stripe — payment and subscription processing.
• PostHog (EU) — website and product analytics, within the limits above.
• Our hosting provider — the server the application runs on.

We do not sell personal data, and we do not use your CRM contents to train models.

How long we keep things

• CRM data: for as long as your workspace exists.
• Signup and enquiry records: kept as our record of how customers found us.
• Audit logs: retained as a security record.
• Backups: encrypted, nightly, on a rolling retention window.

Your rights

If you are in the UK or EU you can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. Ask through the contact page and we will respond within one month.

If you are a contact stored inside a customer's Workden workspace, that customer controls that data and is the right first point of contact — though you may always come to us and we will help.

Marketing email

We only email you product updates if you ticked the box at signup. That box is never pre-ticked, and every such email has an unsubscribe link. Service email about your account and billing is not marketing and is sent regardless.

Cookies

A session cookie keeps you signed in — the product does not work without it. Analytics uses a first-party cookie and local storage to recognise a returning visitor, and we honour your browser's Do Not Track setting.

Changes

If this policy changes materially we will say so before it takes effect. The date at the top always reflects the current version.