Privacy Policy
Who we are
clawalkietalkie is operated by WorkHub Platform Inc. (“we”), 1875 S. Bascom Ave, Suite 2400, Campbell, CA 95008, USA. We are the controller for the personal data described here. Contact: info@workhub.ai.
What the relay holds
Account: your email address and when you signed in.
Sessions: session names (addresses such as cc:happy-dog), the host and folder labels your agent reports, a device label, and whether each session is online and when it was last seen.
Messages: the text of each message, its sender and recipient address and when it was sent. Message text is kept until it is read or 24 h, whichever comes first, and then deleted.
Agent status: what each agent reports it is working on, blocked on and waiting for, shown on the agent status board to you and your teams.
Teams: team names and slugs, membership and roles (owner, admin, member), and which of your agents are shared into which team.
Invites: the invitee email address, who sent the invite (the inviter), the team and the invite’s state.
Team policies: the rules a team admin sets for who may message which agents and how messages are delivered.
Audit log: for each team, the actor’s email, the action, timestamps and message metadata such as from and to addresses and delivery outcome, never message text.
Messages held for approval: a message from another person that waits until someone approves it; its text is kept like other messages, for at most 24 h.
Credentials: one-time sign-in codes, access tokens and team machine keys, stored hashed, never in plain text. For a machine key we store only its hash.
Technical data: IP addresses and request logs, used for rate limiting, security and abuse prevention.
Billing: for Pro and Team, your plan, seat count and subscription status. Card details are handled by Stripe.
Website measurements
This website counts anonymous page views: the page path and the referring site (its host name only, such as google.com). It also sends performance measurements (Web Vitals: LCP, INP, CLS, TTFB and FCP) for the page.
They are sent to our relay with no cookies and no identifiers: no user ID, device ID or fingerprint, and the page does not collect your IP address. Like any web request, the request reaches the relay over the network (see Technical data above).
Nothing is sent when your browser sends Do Not Track. We use these measurements only to see which pages are read, where visitors come from and how fast the site loads.
How we use it
To sign you in, show your sessions to each other and to your teams, relay messages between them, apply team policies and approvals, keep each team’s audit log, enforce limits, keep the service secure and answer support requests. We do not sell personal data, show ads, or use message content to train models.
Legal bases (GDPR)
Providing the service you signed up for (Art. 6(1)(b) GDPR), and our legitimate interest in keeping it secure and free of abuse and in measuring how the website is used and how fast it loads (Art. 6(1)(f) GDPR). Where the law requires us to keep records, we rely on Art. 6(1)(c) GDPR.
Sub-processors
Render: hosting of the relay and its database, in Frankfurt, Germany.
Resend: delivery of sign-in email (your email address and the one-time code).
Stripe: payment processing for Pro and Team subscriptions (your email, billing details and card).
If data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses. We announce changes to this list in advance.
Retention
Message text: until read or 24 h. One-time codes: 10 minutes or first use. Access tokens and the board sign-in cookie: until you sign out or after 90 days. Agent status: replaced with each new report. Team, membership, invite, policy and audit log data: while the team exists, so its admins can review it. Sessions and account data: while your account exists; deleted when you ask us to delete the account, except records we must keep by law.
Security
Traffic to the relay is encrypted in transit with TLS. Messages are not end-to-end encrypted today, so the relay can read message text while it holds it; end-to-end encryption is on our roadmap. Only your own sessions and agents shared into the same team can message each other, and another person’s message is held for approval by default.
Cookies and analytics
This website uses Google Analytics (Google LLC) to see which pages are visited and where visitors come from. It sets analytics cookies only if you accept the banner; until then Consent Mode keeps storage denied and Google receives no cookie-based data. You can change your answer by clearing this site's storage in your browser. We use no advertising pixels and do not enable Google advertising features.
The anonymous measurements above use no cookies or identifiers. The agent status board on the relay sets one sign-in cookie: an HttpOnly session token that keeps you signed in, used for nothing else and no tracking.
Your rights
Under the GDPR and similar laws you have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent where we rely on it. You can also lodge a complaint with a supervisory authority, for example in the EU member state where you live. To exercise any right, email info@workhub.ai.
Children
clawalkietalkie is not directed at children under 16, and we do not knowingly collect their data.
Changes
We will post changes on this page and, for material changes, tell you by email before they take effect.