Privacy & data protectionEffective October 4, 2026Version 3.10
Sub-processors
This page lists every sub-processor WorkMonitor engages to help deliver the Services, what each one is engaged to do, and where each processes data. It forms part of our Data Processing Addendum and is Annex III to the Standard Contractual Clauses incorporated by it.
Each sub-processor processes personal data only as needed to provide its service to us. We will impose on each of them, by written contract, data-protection obligations no less protective than those we owe you, and we remain fully liable to you for their performance. Written Article 28 terms are not yet executed with every sub-processor named below; completing them is committed work, tracked in our Legal Change Log, and we would rather say so than warrant contracts we cannot presently evidence.
We give account administrators at least 30 days' notice before a new or replacement sub-processor begins processing, and you may object on reasonable data-protection grounds. How that works is set out at the end of this page.
Infrastructure and hosting
This is where the Services run and where your data lives.
| Sub-processor | Engaged to do | Location | Privacy information |
|---|---|---|---|
| OVHcloud | Hosting and object storage for the Services, including captured images, activity records and work records. | United States | https://us.ovhcloud.com/legal/privacy-policy/ |
Payments and billing
Engaged only for customers on a paid plan.
| Sub-processor | Engaged to do | Location | Privacy information |
|---|---|---|---|
| Stripe | Payment processing, subscription billing and invoicing. Receives the billing contact and the payment method used for the subscription. Card details are entered on Stripe's hosted checkout page and never reach WorkMonitor systems; we hold only the card type, the last four digits and the expiry. Stripe's data-processing terms are at https://stripe.com/legal/dpa. | United States, European Union | https://stripe.com/privacy |
AI processing
Engaged only where an AI provider is configured for a deployment. Where none is configured, every AI feature falls back to a summary computed entirely within our own infrastructure and no data leaves it.
| Sub-processor | Engaged to do | Location | Privacy information |
|---|---|---|---|
| Anthropic | Large-language-model processing for AI features. A prompt containing the named team member and their aggregated activity metrics is sent when a day summary, team digest or written answer is generated, and when a delivered-work narrative names who shipped what. Most run only when someone asks; an organization that enables the scheduled summary agent has them generated automatically on a weekday schedule. Captured screenshots are never sent. Contractually prohibited from using the data to train or improve models, as set out in our AI Features Terms. | United States | https://www.anthropic.com/legal/privacy |
Communications and support
These carry account correspondence and support conversations.
| Sub-processor | Engaged to do | Location | Privacy information |
|---|---|---|---|
| Postmark | Transactional email delivery: invitations, digests, account notices, security alerts and billing notices. Receives the recipient address and the content of the message. | United States | https://postmarkapp.com/privacy-policy |
| Twilio | One-time sign-in codes sent by SMS to workers who sign in with a phone number instead of an email address. Receives the telephone number and the six-digit code, and nothing else — no name, no employer, no location and no activity data. It is used only when an organisation switches phone sign-in on; a workspace that does not is never in contact with it. | United States | https://www.twilio.com/legal/privacy |
| Intercom | In-product support messaging. For a signed-in user, receives the account identifier, name, email address and account creation date so a support conversation can be attributed. The messenger also loads before you sign in — on the sign-in, sign-up and password-reset pages — where a visitor who is not signed in still reaches Intercom, which receives their IP address and browser details. It does not load on the public certificate verifier or in embedded views. | United States | https://www.intercom.com/legal/privacy |
Website analytics and advertising measurement
Engaged for the purpose that is allowed for each visitor. In the UK, the EU, the rest of the European Economic Area and Switzerland that means what the visitor accepted in our cookie banner; everywhere else analytics, website session recording and advertising are on unless the visitor switches them off in our footer or their browser sends a Global Privacy Control signal. Google's script loads for every visitor: where a purpose is not allowed it sets no cookie and stores no identifier, but still sends Google cookieless signals that it uses to estimate visits and conversions — in the UK and the EU before a visitor answers and after they decline; outside them, an advertising opt-out stops advertising signals entirely.
Google appears once on this page and does two things under two separate records of consent. Measurement follows the analytics permission; conversion measurement for our own advertising follows the advertising permission, which is refused by default in the UK and the EU and is refused without asking wherever the browser sends a Global Privacy Control signal. The two records can diverge and often do — under that signal, for a visitor who accepted analytics before advertising was ever asked about, and for anyone who has used our "Do Not Sell or Share My Personal Information" control — but our cookie banner itself asks them together, with one Accept and one Decline covering both, so it is not a way of keeping one and dropping the other.
One flow on this page does not come from a browser at all, and it is set out here rather than only in the row below. Where an organization was created from a visit that carried an advertisement click identifier and for which advertising was allowed, and that organization pays its first invoice, our own servers report that payment once to our advertising account. Nothing about that report passes through the visitor's browser, so no cookie setting and no browser control describes it; the way to stop it is to refuse advertising, which deletes the stored click identifier and cancels anything queued.
The same is true of OpenAI, for an organization created from a visit that arrived on one of our advertisements in ChatGPT: our servers report to OpenAI once when that organization is created and once if it pays its first invoice, each report carrying only what its row below lists, and refusing advertising deletes the stored click identifier and cancels anything queued in exactly the same way. OpenAI's own measurement script runs only on our public website, and only where advertising is allowed for the visitor — it has no cookieless mode, so where advertising is not allowed it is not loaded at all.
| Sub-processor | Engaged to do | Location | Privacy information |
|---|---|---|---|
| Google (Google Analytics 4 and Google Ads conversion measurement) | Two purposes under two records of consent, one processor. ANALYTICS: measurement of how our public website and the signed-in application are used, as two separate properties, where analytics is allowed for you. What is sent is the page viewed and the action taken. Page addresses are rewritten before they are sent, so an identifier in a path — a team member, a certificate reference — is replaced with a placeholder, and query strings and fragments from the signed-in application are removed entirely rather than filtered. ADVERTISING, where advertising is allowed for you, and it reaches Google along two different routes. From your browser, on our public website and, in the signed-in application, only on the pages where an account is created — the sign-up form, the email confirmation page and first-time setup: the full address of the page, including its query string, and its title, which Google's tag sends with every advertising hit, with the address of the referring page where your browser provides one; a coarse bucket for the kind of page it was — pricing, comparison, legal and ten others; the click identifier of the advertisement you arrived through; the conversion completed, for each conversion action we have created in the advertising account, which we create one at a time; and, only where you typed one into our demo request or sign-up form, a SHA-256 hash of that email address, computed in your browser so the address itself never leaves it. From our servers, once, if an organization created from such a visit pays its first invoice: the click identifier, an internal account reference, the amount and currency of that invoice, when it was paid, and a consent signal stating that the visitor allowed advertising measurement and that the report may not be used to personalize advertising — no email address and no hash of one. With advertising accepted we build remarketing audiences from those pages and their buckets and Google may use what it receives to select our advertisements for you on other sites, which California law calls sharing for cross-context behavioural advertising. Neither purpose and neither route receives a raw email address, an organization name, or any captured activity, window title or screenshot data, and none of them receives anything about a person monitored through the Services — no identifier of a monitored worker, hashed or otherwise. Neither is loaded in our non-production environments or on the public certificate verifier. Advertising storage stays denied wherever advertising is not allowed — in the UK or the EU before a visitor accepts or after they decline, after an opt-out anywhere, or under a Global Privacy Control signal — and no server-side report is made for an organization whose visit did not allow advertising. | United States | https://business.safety.google/privacy/ |
| Smartlook (Smartlook.com, s.r.o., a Cisco company) | Session recording of visits to our public website, where analytics is allowed for you: the pages opened, clicks, mouse movement and scrolling, and each page as it was displayed, with every form field, email address and number masked in the browser before anything is sent; page addresses without their fragment and with sensitive values replaced; approximate location (country and city), browser, operating system, device type and screen size. No IP address and no network traffic is recorded, and nothing is recorded in the signed-in application, in non-production environments or on the public certificate verifier. Smartlook has announced that it will close its service on 30 September 2027 and delete every recording it holds then. | European Union (Czech Republic) | https://help.smartlook.com/docs/privacy-policy |
| OpenAI (ChatGPT advertising conversion measurement) | Measurement of our own advertising in ChatGPT, where advertising is allowed for you, along two routes. From your browser, on our public website only: OpenAI's measurement script, which reports the page views and conversions on our site — such as a demo request, a click on a sign-up button, a plan picked, a newsletter sign-up — with the kind of page as a coarse bucket, the address of the page and of the referring page each without its query string or fragment, the click identifier of the ChatGPT advertisement you arrived through, a random identifier for your browser on our site, and, as with any request, your IP address and browser details. Our site checks whether the script's automatic matching of form fields is on before loading it, and does not load it while it is, so no email address, hashed or otherwise, reaches OpenAI from a form. From our servers, for an organization created from a visit that arrived on a ChatGPT advertisement: once when it is created and once if it pays its first invoice, the click identifier, the browser identifier where there is one, when it happened, the page it belongs to and, for the payment, the plan, the amount and the currency — no email address and no hash of one, no name and no IP address. Every report, from either route, tells OpenAI it may not be used to personalize advertising. Nothing about a person monitored through the Services reaches OpenAI. Not loaded in the signed-in application, in our non-production environments or on the public certificate verifier. | United States | https://openai.com/policies/privacy-policy/ |
Services that receive no personal data
Named for completeness, because a security reviewer will find them in a network trace and should not have to wonder.
| Service | What it does | What it receives |
|---|---|---|
| Cloudflare | DNS hosting for our domains. | No personal data. |
| jsDelivr and fonts.scalar.com | Serve the viewer and fonts for our public API reference page, which needs no login. | Opening that one page sends your IP address and browser details to those hosts. The script is pinned to a specific version and checked against a cryptographic hash, so it cannot be swapped for different code. No account data and no captured data is present on that page. Nothing else on our site or in the product loads from either host. |
Destinations you configure
Where you configure a data-warehouse export, an HR-system integration, a chat notification, a project-tool time entry, or a payroll, accounting or payout connector, data is sent to a destination the customer selects and contracts with directly, using credentials you supplied.
Those destinations do receive personal data. They are your own processors rather than WorkMonitor sub-processors: we transmit to them on your instruction, and your agreement with that provider governs what happens next. They are therefore not listed here, and adding one does not trigger the notice process below — you are the one adding it.
The full catalogue of connectors the Services can talk to is published in our integrations directory.
Notification of changes
We will give account administrators at least 30 days' notice before a new or replacement sub-processor begins processing personal data. Notice goes to the administrator email addresses on the account, so keep them current; you may also ask us at privacy@workmonitor.ai to add a named recipient for these notices.
You may object on reasonable data-protection grounds by writing to privacy@workmonitor.ai within the notice period, giving your reasons. We will work with you in good faith — which may mean a configuration change, an alternative, or an explanation of measures that address the concern. If we cannot resolve it in a reasonable time, you may terminate the affected subscription without penalty and we will refund prepaid, unused fees.
In an emergency — where a sub-processor must be replaced immediately to keep the Services running or to close a security risk — we may act first and notify you as soon as we can, with the same right to object afterwards.
One case this process does not cover, said plainly so that nobody has to guess. Adding advertising measurement to the analytics row in September 2026 did not trigger the notice period, because that processor was already disclosed here and the new purpose adds no new one. What the new purpose does reach, beyond website-visitor data, is one narrow thing that belongs to the customer rather than to a visitor: when an account pays its first invoice, the amount of that invoice is reported to the advertising account against the click identifier, as the row above sets out. That is the account's own commercial relationship with us and no part of what the platform captures about anyone. It is recorded in the Legal Change Log, and a customer who would rather it were not reported for their organization can say so at privacy@workmonitor.ai, which deletes the click identifier we hold and stops it.
Nor does it cover a processor we engage only for visitors to our public website, where we alone decide what is collected and why. Session recording, added in October 2026, is one: it receives nothing a customer gives us and processes no personal data on a customer's behalf, so it is not a sub-processor of customer data and the notice period does not apply to it. It is listed above so that you can see it all the same.
Every change to this list is recorded in our Legal Change Log, so you can see what changed and when.
Questions
Questions about a sub-processor, or a request for the data-processing terms we hold with one: privacy@workmonitor.ai, or our Data Protection Officer at dpo@workmonitor.ai.