Every document, published in full

Who this policy is for

Visitors to our website, our documentation, our help centre and our public certificate verifier.

Administrators, billing contacts and users of the WorkMonitor platform, and people at organizations who contact us about it.

Individuals whose activity is monitored through the Services by an employer ("Monitored Users"), for the limited purposes described below where we act as a controller in our own right — principally security, fraud prevention and legal compliance.

People who open, review, merge or are assigned to pull requests or issues a business keeps in WorkMonitor from GitHub, and the customers of a business who contact its AI agents; for them, as for Monitored Users, that business is the controller.

People who apply for a job with us, and people who deal with us as suppliers, partners or affiliates.

The personal data we handle

We group it by where it comes from, because that is what determines what we may do with it.

Account and profile data

Name, work email address, job title, organization, profile photo, language and time zone, authentication credentials in hashed form, single sign-on identifiers, and multi-factor authentication settings. Where you sign in with Google, LinkedIn or GitHub, we receive your name, email address and account identifier from that provider. Where your organisation has switched on phone sign-in and you sign in with a mobile telephone number instead of an email address, we store that number and send a six-digit code to it; the number is used to sign you in and for nothing else, and it is never used to locate you.

Billing data

Billing contact, billing address, tax identifiers, plan, seat count, invoices and payment history. Card numbers are entered on our payment processor's hosted page and never reach our systems; we hold only the card type, the last four digits and the expiry.

Activity data

Where an employer deploys the agent: the applications and websites in use, the titles of active windows and pages, active and idle time, working sessions, and aggregate input intensity — a count of keystrokes and mouse events expressed as an activity level. We do not record the content of what is typed. We are not a keylogger, and the agent has no capability to capture the text of a keystroke.

Screenshots

Where the employer enables them, periodic still images of the screen, at an interval and with the blurring and exclusions the employer configures. We do not record continuous video and we do not make screen recordings.

Live view frames

Where the employer enables live view and an authorized viewer opens a session, the agent sends still frames for that session. These are held transiently to deliver the session to the viewer and are discarded when the session ends; they are not added to the stored screenshot history.

AI coding tool data

Where the employer turns on the AI tool telemetry relay or AI tool discovery for a person, and that person consents: usage telemetry that AI coding tools such as Claude Code and Codex send through the WorkMonitor agent on their computer — when a session ran and for how long, the AI models used, tokens and cost, the repository and branch it worked in where the tool is set to report them, and a record of each step of the session (what kind of step it was, its timing, tokens and cost, and which model a model call used; for a session the person drives, which tool was used only when it is one of the AI tool's own built-in tools, an error's standard code where the tool reports one, and how many errors the session had, failed tool calls included, but never which call failed or whether it was allowed; for an AI tool set up to work on its own, also the name of any other tool, whether each step worked and whether it was allowed) — tied to the person the computer is enrolled to; and which AI coding tools from a fixed list run on the computer and whether each is set up to report, which the agent tells by reading the reporting settings in those tools' own settings files. Only the result leaves the computer: never the text of prompts, replies or code, never a list of the programs running, and nothing else in those files. Where the employer also chooses to configure AI tools on each computer, the agent adds WorkMonitor's reporting settings to those files, changes only its own entries, and removes them when the employer turns this off, when the person signs out, or when the computer is removed from the employer's account. If the agent is uninstalled without signing out first, its entries stay in those files until they are removed.

AI telemetry sent directly

Where the employer sets AI coding tools or AI agents to report straight to WorkMonitor without the WorkMonitor agent, for example through a company-wide setting or from an automated pipeline: the same usage telemetry, with its record of each step. This path does not depend on a person's consent in WorkMonitor. When a report carries an email address or WorkMonitor member identifier that matches a person's WorkMonitor account, the session is attributed to them.

AI agent outcome data

Where the employer uses WorkMonitor to check whether the work its AI agents report done held up, read from the services those agents work in or reported to WorkMonitor by the agents directly. For a pull request an AI agent made or helped make: its title and link and the GitHub account of the person who opened it; what each person who reviewed or merged it did, when, and their GitHub account, linked to their WorkMonitor account only where the employer has confirmed that the account is theirs; and whether a person other than its author added commits, keeping each commit's reference but not who made it. Reviews are recorded the same way on any other GitHub pull request WorkMonitor keeps, such as one kept to track work. A person's own pull request is kept this way when its description, its branch name or its commits carry a mark that an AI tool made or co-wrote it (only the mark is looked for, and the description and commit messages are not stored), when the repository, branch and time of their AI coding sessions match it, or when an AI agent reports it as its work; it is then linked as work an AI agent did or helped with, confirmed where the AI tool's own record names the pull request, and otherwise it can be suggested for a manager to confirm or reject. For a conversation or call an AI agent handled: the end customer, by a one-way coded reference made from their email address, telephone number or another identifier they are known by, different for each employer and never the identifier itself, so that a customer who comes back can be recognised, while the conversation's, ticket's or call's own identifier at the service is kept as given; from Intercom Fin, the customer's ratings from 1 to 5 of the AI agent and of the conversation, never the remark left with a rating and never which member of staff was rated, and when a person first replied after the AI agent handed the conversation to a team, without recording who; and, when an AI agent hands work to a named person, the handoff and when it happened. Managers who can see an AI agent see how many reviews each person made on its pull requests, with a person named only to a manager allowed to see them; that count is not part of any score about the person. Apart from a pull request's title, none of it is the content of the work: no code, commit message or review comment, and no message or transcript of a conversation or call, is stored. An employer's export of a person's data includes the reviews and merges recorded for them, the pull requests and issues their confirmed GitHub account opened or is assigned to, and the work AI agents handed to them by name.

Work records

Timesheets, attendance, projects, tasks, deliverables, approvals, goals, invoices and the certificates and credentials generated from them. Where a business connects GitHub to track work, the deliverables include the pull requests and issues the connected GitHub account opened or is assigned to, with their title, link, state and dates and the GitHub accounts of their author and assignees, never their description.

Location data

Where the employer uses geofenced job sites, the GPS coordinates recorded with a clock-in or clock-out event on a device that supports it, and whether that position falls inside a boundary the employer defined. This is recorded at the moment of the event; the Services do not maintain a continuous location trail. Approximate location is also derived from IP address for security and fraud prevention.

Device and log data

IP address, operating system and version, device name and identifier, agent version, browser and user-agent, and the diagnostic and security logs needed to operate the Services.

Audit records

A tamper-evident record of consequential actions in the platform: who changed a setting, who viewed a capture, who exported data, who granted a permission.

Support and correspondence

Messages you send us through the in-product messenger, email, contact forms or demo requests, and our replies.

Website and marketing data

Pages viewed, the action taken, referring page, approximate location derived from IP address, and analytics identifiers — the identifiers only where analytics is allowed for you: accepted in the UK, the EU, the rest of the European Economic Area and Switzerland, or not switched off everywhere else. Where it is not allowed, Google's tag still receives each page viewed and action taken as a cookieless signal, without an identifier. Page addresses are rewritten before they are sent so that identifiers in them are replaced with a placeholder. On our public website, and with the same permission, session recordings of how you use its pages — clicks, mouse movement, scrolling and each page as displayed — with every form field, email address and number masked in your browser and no IP address recorded. See the Cookie Policy.

Advertising and conversion data

Where advertising is allowed for you — accepted in the UK or the EU, or not switched off everywhere else: the click identifier carried by an advertisement you arrived through (gclid, gbraid or wbraid), the advertising cookies the Google tag sets on our domain, the conversion you completed, the full address and title of each page of our public website you open, and of the sign-up, email confirmation and first-time setup pages of the application (Google's advertising tag sends them with every advertising hit), and a coarse bucket describing the kind of page it was — pricing, comparison, legal and ten others — which together allow a remarketing audience to be built; and, where you typed an email address into our demo request or sign-up form, a SHA-256 hash of that address, computed in your browser so the address itself is never sent. Where an account created from such a visit later pays its first invoice, the same category also covers what we report about that payment from our own servers: the click identifier, an internal account reference, the amount and currency of the invoice, when it was paid, and a consent signal stating that the visitor allowed advertising measurement and that the report may not be used to personalize advertising — no email address and no hash of one. No activity data, screenshot, window title or other data about a monitored worker is used for advertising or reaches an advertising system, and none of the identifiers, cookies or hashes in this category is collected for anyone for whom advertising is not allowed — in the UK or the EU before accepting or after declining, after an opt-out anywhere, or under a Global Privacy Control signal. In the UK and the EU, Google's tag still sends cookieless signals for such visitors, as the Cookie Policy explains. For our advertisements in ChatGPT the same category covers, where advertising is allowed for you, the click identifier OpenAI puts in the address (oppref), the cookies OpenAI's measurement script sets on our public website, the page views and conversions it reports with the page address but no query string, and — for an account created from such a visit — the two reports our servers make to OpenAI when the account is created and when it pays its first invoice: the click identifier, a random browser identifier, the time, the page, and for the payment the plan, amount and currency, with no email address and no hash of one. OpenAI's script is not loaded at all where advertising is not allowed for you.

Recruitment data

Where you apply to work with us: your application, CV, correspondence, interview notes and the outcome.

• —We do not knowingly collect special categories of personal data — health, biometric, genetic, racial or ethnic origin, political opinions, religious beliefs, trade-union membership, sex life or sexual orientation — and the Acceptable Use Policy prohibits customers from configuring the Services to infer or record them. Because activity data includes window and page titles, such information can in principle appear incidentally in a capture; that is one reason the platform provides deny lists, blurring and redaction, and one reason employers are required to configure them.
• —We do not sell personal data. We do share one narrow category for advertising: where advertising is allowed for a visitor to our public website — accepted in the UK or the EU, and on by default elsewhere unless they opt out — the conversion data described above is disclosed to Google, and for visitors who arrive from one of our advertisements in ChatGPT to OpenAI, so that we can measure which of our advertisements worked, and California law calls that sharing for cross-context behavioural advertising. It covers that visitor, and it covers the purchase an account they created later makes — their own commercial dealings with us and nothing beyond them. Everything the platform captures about a monitored worker — activity records, screenshots, window titles, timesheets, scores and their identity — is never sold, never shared for advertising, and never reaches an advertising system in any form.

Where we get it

Directly from you, when you create an account, contact us, buy a subscription or apply for a job.

From your employer, where it invites you to an account or configures monitoring for your device.

From the WorkMonitor agent and extensions installed on a device, at the configuration the employer has set.

From your identity provider, where you sign in with Google, LinkedIn, GitHub or a corporate single sign-on.

From our own systems, in the form of logs, audit records and usage telemetry.

From third parties you connect, where an employer configures an HR, payroll, identity or project integration, or connects a service its AI agents work in, that sends us records about people.

Why we use it, and our legal basis

Where the GDPR, the UK GDPR or a comparable law applies, we rely on the legal bases set out below for the processing we carry out as a controller. Where we act as a processor for an employer, the legal basis for the monitoring itself is that employer's to establish, not ours.

• —Where we rely on legitimate interests, we have considered whether our interest is overridden by your interests and rights, and we have recorded that assessment. You may object to processing based on legitimate interests, as described in the rights section below.

Automated decision-making

We do not make decisions about you based solely on automated processing that produce a legal effect for you or similarly significantly affect you.

The platform produces scores, indices and AI-generated summaries about work. These are inputs for a manager, not decisions. Under our Acceptable Use Policy and our AI Features Terms, a customer may not use them as the sole basis for a decision about discipline, dismissal, pay, promotion or a formal performance rating without meaningful human review. If your employer has made such a decision about you, the decision and the obligation to explain it are theirs.

Who we share it with

We share personal data only in the situations set out here.

• —Your organization. If you use the Services under an employer's account, that employer — and the administrators and managers it authorizes — can see the data the platform holds about you, within the scope it has configured.
• —Sub-processors. Service providers that process personal data on our behalf under written terms, listed in full, with what each one does and where, in our Sub-processor list. We give at least 30 days' notice before adding or replacing one.
• —Destinations you configure. Where a customer connects an HR, payroll, accounting, chat, project, warehouse or payout system, we transmit data to it on the customer's instruction. That provider is the customer's own processor and its agreement with the customer governs what happens next.
• —Our advertising measurement provider. Where advertising is allowed for a visitor to our public website, Google receives the conversion data described in the "Advertising and conversion data" entry above, so that we can measure our own advertising. Two things reach it: what that visitor's browser reports, and — once, if an account they created pays its first invoice — what our servers report about that payment, which carries no email address and no hash of one. Nothing about a Monitored User reaches it: no activity data, no screenshot, no window title, no timesheet, no score, and no identity or address of a monitored worker, hashed or otherwise.
• —Professional advisers. Our lawyers, accountants, auditors and insurers, under duties of confidentiality.
• —Authorities, where required. Only as described in our Law Enforcement and Government Requests policy, which sets out what we require before we disclose anything and when we tell you about it.
• —A corporate transaction. If we are involved in a merger, acquisition, financing or sale of assets, personal data may be transferred as part of it, subject to this policy and to notice to affected customers. A buyer would take the data on terms no less protective than these.

• —We do not sell personal data, and we do not disclose Customer Data to a model developer or use it to train generative models — see the AI Features Terms.
• —The one disclosure that needs stating rather than denying: with a website visitor's consent, we share that visitor's conversion data with Google for cross-context behavioural advertising, and where an account created from that visit pays its first invoice we report that purchase to Google as well, as described above and in the Cookie Policy. That is the whole of it, and what it amounts to is the account holder's own commercial relationship with us. It never includes activity data, screenshots, window titles or anything else the platform captured about a person monitored through the Services, and no employer's monitoring data is used to advertise anything to anyone.

Where your data is processed, and international transfers

The Services run on infrastructure located in the United States, and our sub-processors are listed with the locations in which each processes data.

If you are in the European Economic Area, the United Kingdom or Switzerland, this means your personal data is transferred outside your country to a jurisdiction that has not received an adequacy decision.

We do not participate in the EU-US Data Privacy Framework, the UK Extension, or the Swiss-US Data Privacy Framework. We do not claim any certification we do not hold.

For those transfers we rely on the European Commission's Standard Contractual Clauses, on the UK International Data Transfer Addendum for UK transfers, and on the Swiss adaptations for Swiss transfers, together with supplementary technical and organizational measures. The clauses, the modules that apply and the measures are set out in our Data Processing Addendum, and we will provide a copy on request to privacy@workmonitor.ai.

We have carried out and maintain a transfer impact assessment covering these transfers, and we will share our summary of it with a customer's privacy team on request.

How long we keep it

Where we act as a processor, the customer sets the retention period within the limits of its plan, and we delete on that schedule and on the customer's instruction.

• —We may retain data for longer where we must to comply with a legal obligation, to establish or defend a legal claim, or to enforce our agreements — and where we do, we keep only what is needed for that purpose and keep protecting it.
• —Backups are kept for disaster recovery and are cycled out on their own schedule. Data deleted from the live systems is removed from backups as those backups expire.

Your rights

Depending on where you are, you may have the following rights. We honour them for everyone we can, whether or not the law where you live requires it.

• —Access — to be told whether we hold personal data about you and to receive a copy.
• —Rectification — to have inaccurate data corrected and incomplete data completed.
• —Erasure — to have data deleted, where there is no overriding reason for us to keep it.
• —Restriction — to have us pause processing while a dispute about accuracy or legitimacy is resolved.
• —Portability — to receive data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible.
• —Objection — to object to processing based on legitimate interests, and to object at any time to direct marketing, which we will always honour.
• —Withdraw consent — where we rely on consent, at any time, without affecting processing already carried out.
• —Complain — to your local supervisory authority or data protection regulator. We would rather you came to us first, but you are not required to.

• —To exercise a right, write to privacy@workmonitor.ai. We will verify your identity before we act, so that we do not disclose someone's data to the wrong person, and we will respond within one month, or tell you within one month if we need longer and why. There is no charge unless a request is manifestly unfounded or excessive.
• —If you are in the United States, additional and differently named rights may apply to you. They are set out in our US State Privacy Notice.

If you are a monitored worker

Where your employer deploys WorkMonitor, your employer is the controller of the data about you and we are its processor. The law generally requires us to direct your request to it, and we are not permitted to hand over, correct or delete an employer's data on the say-so of someone else.

So: send your request to your employer first. It has the tools in the platform to answer it, and the Data Processing Addendum obliges us to assist it in doing so.

If you write to us at privacy@workmonitor.ai instead, we will acknowledge you, tell you plainly what we can and cannot do, and pass the request to the employer without undue delay unless doing so would be unlawful.

Two things are not limited by any of that. If you believe your employer's use of WorkMonitor is unlawful, you may tell us and we will look at it, as described in the Acceptable Use Policy. And you may complain to your own supervisory authority at any time, without going through your employer or through us.

The same applies if you contacted an AI agent of a business that uses WorkMonitor, or opened, reviewed, merged or were assigned to a pull request or issue it keeps from GitHub: that business is the controller, so send your request to it first.

The Worker Privacy Notice describes in plain terms what the software can and cannot see.

Security

We protect personal data with technical and organizational measures appropriate to the risk, described in detail in our Security Policy and in Annex II of the Data Processing Addendum.

In summary: traffic to and from our endpoints is encrypted in transit with TLS 1.2 or higher, with HTTP Strict Transport Security enforced, and screenshots are uploaded to storage over encrypted connections; the credentials and secrets we hold, such as integration tokens, single sign-on secrets and two-factor authentication seeds, are encrypted at the application layer with AES-256; access is role-based, least-privilege and scoped to an organization by the credential itself; staff access to customer environments is limited, logged and reviewable, and every member of our staff must use two-factor authentication to sign in to our administration console; and consequential actions land on a tamper-evident audit chain.

We describe encryption precisely, because it is the claim most often overstated in our market, and we do not claim encryption beyond what is described here and in Annex II of our Data Processing Addendum. A detailed description of our controls and their current limitations is available to customers and prospective customers under a non-disclosure agreement.

We hold no security certifications. SOC 2 and ISO 27001 are in preparation. If a certificate is a hard requirement in your procurement, this is the honest place to find that out.

No system is perfectly secure. If we become aware of a personal-data breach affecting Customer Data, we will notify the affected customer without undue delay in accordance with the Data Processing Addendum. Where we are the controller of affected data, we will notify the relevant supervisory authority and affected individuals where the law requires.

To report a vulnerability, use our Vulnerability Disclosure Policy.

Cookies, tracking and advertising

Our website uses cookies and similar technologies. Strictly necessary cookies are set without consent because the site cannot work without them. For everything else, where you are decides: in the UK, the EU, the rest of the European Economic Area and Switzerland, analytics, website session recording and advertising are asked for first and stay off until you accept; everywhere else they are on by default and you can switch them off. Google's script loads for every visitor; where a purpose is not allowed it writes no cookie and stores no identifier, but still sends Google cookieless signals it uses to estimate visits and conversions.

Two permissions, recorded separately. Analytics — Google Analytics 4, and Smartlook session recordings on our public website — measures how the website and the application are used. Advertising — Google Ads conversion measurement — tells us which of our advertisements led to a sign-up, and it is the processing that constitutes sharing for cross-context behavioural advertising under California law.

In the UK and the EU, advertising is refused unless you accept it; elsewhere it is on unless you switch it off. It is refused, without asking, wherever your browser sends a Global Privacy Control signal, and for anyone who accepted analytics under an edition of our Cookie Policy that never put the advertising question. Two footer controls change a decision and they are not interchangeable: Cookie Settings opens the banner, which asks both permissions together and cannot keep one while dropping the other, and "Do Not Sell or Share My Personal Information" beside it refuses advertising alone on one click and leaves your analytics decision untouched. Either way, withdrawing deletes the cookies already set, and refusing advertising also deletes the click identifier stored on our servers.

Nothing captured about a monitored worker is used for advertising. The advertising tag runs on our public website and, in the signed-in application, only on the pages where an account is created, and it receives page and conversion data about the person using the browser. Separately, after a first invoice is paid, our servers report that purchase to Google — the click identifier, an internal reference, the invoice's amount and currency, when it was paid, and a consent signal stating that the visitor allowed advertising measurement and that the report may not be used to personalize advertising — which is described in full in the Cookie Policy and in our US State Privacy Rights Notice. Neither path receives activity data, screenshots, window titles, timesheets, scores, or the identity or address of any monitored worker.

The full list, what each one does and how long it lasts, is in the Cookie Policy.

Children

The Services are for business use and are not directed to children. We do not knowingly collect personal data from anyone under 16.

An employer may only monitor a minor where that minor is lawfully employed by it and every requirement applying to the employment of minors has been met, as required by the Acceptable Use Policy.

If you believe we hold data about a child in error, write to privacy@workmonitor.ai and we will delete it.

Marketing

We send marketing email only to business contacts, and only where we may lawfully do so. Every marketing message has an unsubscribe link that works, and unsubscribing takes effect promptly.

Unsubscribing from marketing does not stop service messages about your account — invoices, security notices, changes to these documents — because those are part of providing the Services.

Data protection roles and how to reach them

We have appointed a Data Protection Officer, who can be reached at dpo@workmonitor.ai or by post at the registered office below, marked for their attention.

We are established in the United States and do not currently have an establishment in the European Union or the United Kingdom. We are in the process of appointing representatives under Article 27 of the EU GDPR and Article 27 of the UK GDPR, and we will publish their details in this policy and in our Legal Change Log as soon as they are appointed. Until then, individuals and authorities in the EU, the UK and Switzerland should contact our Data Protection Officer at dpo@workmonitor.ai, which is monitored and answered.

General privacy questions: privacy@workmonitor.ai. Postal address: Digital Socket LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

Changes to this policy

We may update this policy. The effective date at the top of the page always shows when the current version took effect, and every change is recorded in our Legal Change Log.

Where a change materially affects how we handle personal data, we will give notice to account administrators before it takes effect, and we will obtain consent where the law requires it.