Privacy & data protectionEffective October 4, 2026Version 3.10

US State Privacy Rights Notice

This notice supplements our Global Privacy Policy for residents of US states with comprehensive privacy laws, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Rhode Island, Tennessee, Indiana and Kentucky, as those laws come into force.

It also serves as our notice at collection under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").

Read this together with the Global Privacy Policy, which describes our practices in full. Where this notice and that policy differ for a resident of a covered state, this notice applies to that resident.

A note on roles, because it determines who answers your request. When your employer deploys WorkMonitor, that employer is the business (or controller) and we are its service provider (or processor). Requests about monitoring data go to your employer; the section headed "If you are a monitored worker" explains what we will do if you write to us instead.

Categories of personal information we collect

The table uses the statutory categories from the CCPA. It covers the twelve months preceding the effective date of this notice and describes what we collect on an ongoing basis.

CCPA categories, sources, purposes and disclosures

Category	Examples we collect	Source	Disclosed to
A. Identifiers	Name, work email, account identifier, IP address, device identifier, single sign-on identifier, the GitHub accounts of the author and assignees of pull requests and issues kept to track work, and — where your employer has switched on phone sign-in — a mobile telephone number used only to sign you in; where your employer checks its AI agents' work, the GitHub account identifier of a person who opens, reviews or merges a pull request an AI agent made or helped make, or reviews another pull request WorkMonitor keeps, and a one-way coded reference to a customer of that business who contacted one of its AI agents, never their email address, telephone number or identifier itself; and, for a website visitor who has not opted out of advertising, an advertising click identifier and, only where that visitor typed one into one of our own forms, a hash of that email address	You, your employer, your identity provider, your device, services your employer connects	Sub-processors; destinations your employer configures; and, for that website-visitor subset only, Google and OpenAI as our advertising measurement providers — this is the disclosure that constitutes sharing, and both the browser report and the server report that make it up are described in full below
B. Customer records information	Name, employer, job title, billing address, telephone number, payment card type and last four digits	You, your employer	Payment processor; accounting advisers
C. Protected classification characteristics	We do not intentionally collect these. Our Acceptable Use Policy prohibits customers from configuring the Services to infer or record them	Not collected intentionally	Not disclosed
D. Commercial information	Plan, seat count, subscription and invoice history, products considered	You, our billing systems	Payment processor; accounting advisers; and, where an account was created from a visit that arrived on one of our advertisements and consented to advertising, the amount and currency of that account's first paid invoice, reported once to Google as the value of the conversion, and for an account that arrived from one of our ChatGPT advertisements to OpenAI with the plan — described in full below
E. Biometric information	None. The Services do not collect biometric identifiers of any kind	Not collected	Not disclosed
F. Internet or other network activity	Applications and websites in use, active window and page titles, active and idle time, aggregate keystroke and mouse intensity, the usage telemetry of AI coding tools and AI agents, with a record of each step, whether the agent passes it on or the tools send it directly, and which known AI coding tools run on the device, where your employer sets this up (never the text of prompts or code), a customer's ratings of a business's AI agent and of the conversation (never the remark left with them), pages viewed on our website, session recordings of how a visitor who has not opted out uses our public website, and the conversion completed on our website or on the sign-up pages of the application	The agent on the device, your browser, services your employer connects	Sub-processors; destinations your employer configures; and, for pages viewed and conversions completed on our own website or, in the signed-in application, on the pages where an account is created, by a browser for which advertising was not switched off, Google. Nothing collected by the agent on a device — no application, window title, activity figure or screenshot — is ever disclosed for advertising
G. Geolocation data	Approximate location derived from IP address; and, where your employer uses geofenced job sites, the GPS coordinates recorded with a clock-in or clock-out event and whether they fall inside a boundary your employer defined. Recorded at the moment of the event, not as a continuous trail	Your device, your employer's configuration	Sub-processors
H. Audio, electronic, visual or similar information	Screenshots, where your employer enables them; live view frames during an open session. No audio is ever captured, and no continuous video or screen recording is made	The agent on the device	Hosting and storage sub-processors
I. Professional or employment information	Job title, team, manager, working hours, timesheets, attendance, approvals, projects, deliverables, performance scores, the reviews a person makes on pull requests WorkMonitor keeps and the merges they make on AI agents' pull requests, a person's own pull requests linked to AI agents' work, and work AI agents hand to a person by name	You, your employer, connected HR systems, the services your employer's AI agents work in	Sub-processors; destinations your employer configures
J. Education information	Only where included in a job application you send us	You	Not otherwise disclosed
K. Inferences	Productivity, focus and engagement scores, activity summaries and AI-generated narratives derived from the above	Generated by the Services	Your employer; AI sub-processors, which are contractually prohibited from training on the data

Sensitive personal information

We do not collect or process sensitive personal information for the purpose of inferring characteristics about a consumer.

We collect account credentials, which are sensitive personal information under the CCPA, solely to authenticate users and secure accounts. We do not use or disclose them for any other purpose, and we therefore do not offer a right to limit their use — there is nothing to limit beyond providing the Services and keeping them secure.

Precise geolocation is sensitive personal information under the CCPA, and we handle it in one narrow case: where an employer uses geofenced job sites, GPS coordinates are recorded with a clock-in or clock-out event so that the event can be matched against a boundary the employer defined. We say so plainly rather than claiming we collect no precise location. It is recorded at the moment of the event, not continuously, we process it only as the employer's service provider and only to provide the Services, and we never use it to infer characteristics about anyone.

Because that processing is carried out on your employer's instructions, the right to limit the use of sensitive personal information runs against your employer, which decides whether job sites are used at all. Ask your employer to turn the feature off or to remove you from its scope; we will act on its instruction.

Why we collect it

We use each category for the business purposes described in the Global Privacy Policy: to provide and secure the Services, to bill for them, to support customers, to detect and prevent fraud and abuse, to improve the product, to comply with law, and to establish or defend legal claims.

We retain each category for the periods set out in the retention table in the Global Privacy Policy. Where a period cannot be stated exactly, we retain the data only for as long as is reasonably necessary for the purpose it was collected for.

We will not collect additional categories of personal information, or use what we have collected for a materially different purpose, without first giving you notice. Version 3.1 of this notice, which took effect on September 8, 2026, was that notice for one new purpose: measuring our own advertising, described in the three sections that follow. It reaches a visitor to our website who accepts it, and the record of a purchase made by an account created from such a visit — and nobody else.

We do not sell personal information, and we share one narrow category for advertising

We do not sell personal information, we have never sold it, and we have not sold it in the preceding twelve months. No consideration of any kind is received for personal information, and there is no arrangement under which any could be.

Sharing is a different question and the honest answer is yes, in one place. We advertise WorkMonitor on Google. In the United States, as everywhere outside the UK, the EU, the rest of the European Economic Area and Switzerland, advertising is on by default: unless a visitor to our public website opts out — with "Do Not Sell or Share My Personal Information", with Decline in Cookie Settings, or with a Global Privacy Control signal — that visitor's browser is given an advertising identifier, and each page they open is reported to our advertising account with its full address and title, and as one of thirteen coarse buckets describing the kind of page it was — pricing, comparison, legal and ten others. We build remarketing audiences from those pages and buckets, and Google may use what it receives to select our advertisements for that visitor across other sites. That is sharing for cross-context behavioural advertising as the CCPA defines it, and we call it that rather than calling it analytics.

We also advertise WorkMonitor in ChatGPT. Under the same default and the same opt-outs, OpenAI's measurement script runs on our public website for a visitor who has not opted out and reports to OpenAI the pages they open, by address without a query string and as the same coarse bucket, and the conversions they complete there; and where an account is created from a visit that arrived on one of our ChatGPT advertisements, our servers report to OpenAI that the account was created and, if it pays, its first payment. Every one of those reports tells OpenAI it may not be used to personalize advertising. We treat this as sharing too, and the same "Do Not Sell or Share My Personal Information" control, Decline in Cookie Settings and Global Privacy Control signal stop it.

The same permission covers conversion measurement, which is the reason for it: telling Google that a sign-up, a demo request, a download or a first payment followed an advertisement click, so that we can stop paying for the advertisements that bring nobody. We say what that permission covers rather than describing a stream of conversions as though every one of them were already flowing. A conversion is reported only for a conversion action that has been created in our advertising account, and those are created one at a time, so on any given day some are reporting and others are not yet. Nothing else changes when one is switched on — the same permission, the same identifiers, the same limits described in the next section.

The lookback, stated as a lookback: we did not share personal information for cross-context behavioural advertising in the twelve months preceding version 3.1 of this notice, which took effect on September 8, 2026. The sharing described above begins with that version and no earlier.

What is not shared, and will not be. Nothing an employer's deployment produces is shared for advertising: no application or window title, no activity figure, no screenshot, no timesheet, no score, no inference, and no identity of a monitored worker. The advertising processing described here concerns visitors to our own website and the commercial relationship an account holder has with us, and our Platform Terms of Service commit us to that boundary in the section on Customer Data.

We do not knowingly sell or share the personal information of consumers under 16 years of age. The Services are not directed to children.

We disclose personal information to sub-processors for business purposes only, under written contracts that limit them to processing it on our instructions and prohibit them from selling it or using it for their own purposes.

What a conversion report contains, in your browser and from our servers

Two different reports can carry a conversion to Google, and they are not the same thing, so both are set out here rather than one standing in for the other.

The first is sent by your browser. Unless you have opted out of advertising, when you complete something we count on our own website — a demo request, a sign-up, a download — the tag reports the conversion, the click identifier of the advertisement you arrived through, and, where you typed an email address into that same form at that moment, a SHA-256 hash of that address. The hashing happens in your browser before anything is sent, so the address itself never leaves it, and it is only ever the address you just typed: never one we hold for somebody else, never one read out of a link, and never the address of a person monitored through the platform.

The second is sent by our own servers, and it exists because a purchase usually happens days or weeks after the advertisement was clicked, often in a different browser, where a cookie can no longer connect the two. Where an organization was created from a visit that carried an advertisement click identifier and for which advertising was allowed, and that organization later pays its first invoice, we report that payment once to our advertising account, through a conversion action created in that account like any other and subject to the same qualification stated in the previous section. That report carries the click identifier, an internal reference we use to make sure the same payment is never reported twice, the amount and currency of the invoice, when it was paid, and a consent signal stating that the visitor allowed advertising measurement and that the report may not be used to personalize advertising. It carries no email address and no hash of one, and no report of this kind is sent for an organization whose visit did not allow advertising.

What that second report is, stated plainly because the distinction is the whole of it: a record of an account holder's own commercial relationship with us — they clicked our advertisement, they bought our product, and we are telling the advertising account that paid for the click. It is not monitoring data and it never contains any. No application or window title, no activity figure, no screenshot, no timesheet, no score, no inference, and no identity or email address of any person monitored through the Services — hashed or otherwise — is in it or can be put in it. That limb is absolute, and our Platform Terms of Service make it an express term rather than a description.

Both reports depend on advertising being allowed for the visitor and both stop when they opt out. Opting out also deletes the click identifier we stored, and cancels any conversion that has been queued and not yet sent.

Your rights

Depending on your state of residence, you may have the rights below. Where a state gives a right we have not listed, we will honour it.

Know and access — to know what personal information we have collected about you, the categories, the sources, the purposes, the categories of third parties it was disclosed to, and to receive a copy of the specific pieces.
Delete — to ask us to delete personal information we collected from you, subject to the exceptions the statute allows.
Correct — to ask us to correct inaccurate personal information.
Opt out of sale, sharing and targeted advertising — we do not sell, and we share only as described above. The opt-out is the "Do Not Sell or Share My Personal Information" link in the footer of every page of our website, which on one click refuses advertising, deletes the advertising cookies already set and deletes the click identifier we stored. We honour the Global Privacy Control signal as the same opt-out. The section headed "How to opt out of sharing for advertising" explains both, and explains why the cookie banner is not a third one.
Limit the use of sensitive personal information — as explained above, we use it only to authenticate and secure, which the statute does not require us to limit.
Opt out of profiling in furtherance of decisions producing legal or similarly significant effects — we do not carry out such profiling as a controller. Where your employer does, the right is exercised against your employer.
Portability — to receive personal information you provided in a portable, readily usable format where technically feasible.
Appeal — where your state provides it, to appeal a decision we make about your request. We will respond to an appeal within the period your state's law allows and will tell you how to contact your Attorney General if we deny it.
Non-discrimination — we will not deny you goods or services, charge you a different price, or give you a different level of quality because you exercised a right. We offer no financial incentives for personal information.

How to make a request

Write to privacy@workmonitor.ai with the subject line "US privacy request", telling us which right you want to exercise and the state you live in. You may also write to Digital Socket LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

We will verify your identity before acting, using information already associated with your account. For a request to know the specific pieces of personal information we hold, we apply a higher standard of verification, because the consequence of getting it wrong is disclosing your data to someone else.

We will confirm receipt within 10 business days and respond within 45 days. If we need more time, we will tell you within the first 45 days and take no more than a further 45 days.

You may use an authorized agent. We will ask for written permission signed by you, and we may still ask you to verify your own identity directly.

Requests are free unless they are manifestly unfounded or excessive, in which case we will tell you why before charging anything or declining.

If you are a monitored worker

California's privacy law covers employees, applicants and contractors, and several other states are moving in the same direction.

Your employer is the business with respect to your monitoring data. It decides what is collected and how long it is kept, and it is the party that must answer your request. We act as its service provider, and we are contractually and legally restricted from disclosing, correcting or deleting its data on the instruction of anyone else.

Send your request to your employer. If you send it to us, we will acknowledge it, tell you plainly what we can and cannot do, and forward it to your employer without undue delay unless doing so would be unlawful.

Nothing here prevents you from contacting your state Attorney General or the California Privacy Protection Agency directly.

Requests we received

We will publish annual metrics on the requests we receive, as California requires of businesses that meet the applicable threshold, once we have a full reporting year to report on. This document is dated October 4, 2026 and no full reporting year has yet closed, so no figures are stated here rather than figures being invented.

Other US notices

Shine the Light. California Civil Code section 1798.83 allows California residents to ask about disclosures of personal information to third parties for their direct marketing purposes. We make no such disclosures.

Do Not Track. There is no common standard for how a website should respond to a browser Do Not Track signal, and we do not respond to it. The Global Privacy Control signal is different and we do honour it: a browser that sends it has advertising refused for it without being asked, which is the opt-out of sharing that this notice describes.

Nevada. Nevada residents may direct a business not to sell certain covered information. We do not sell it. You may still send a request to privacy@workmonitor.ai.

Contact

Privacy requests and questions: privacy@workmonitor.ai. Our Data Protection Officer can be reached at dpo@workmonitor.ai.

By post: Digital Socket LLC, 131 Continental Dr, Suite 305, Newark, DE 19713, United States.

Questions about this document:legal@workmonitor.aiBack to the register

Every document, published in full