1. Who we are
Worklyst Ltd, a company registered in England and Wales (company number: [to be added]; registered office: [to be added]), operates the Worklyst application and the worklyst.co.uk website (the "Service"). For personal data about our users, we are the data controller. Contact us about privacy at support@worklyst.co.uk.
2. The two kinds of personal data in Worklyst
It helps to distinguish two roles:
- Your data (we are the controller). Information about you as a Worklyst user — your account, subscription and how you use the Service.
- Your customers' data (you are the controller; we are your processor). The customer records, job details, notes, photos and contact details you store in Worklyst belong to your business. We process them only to provide the Service to you, on your instructions, and we never use them for our own marketing or sell them to anyone.
3. Data we collect about you
- Account details — name, business name, trade, email address, phone number, business address, postcode and VAT number (if you add one).
- Subscription and billing data — your plan, subscription status and payment history. Card details are collected and stored by Stripe, not by us; we never see your full card number.
- Content you create — jobs, estimates, invoices, price lists, notes and photos.
- Usage and technical data — log data such as IP address, browser type and actions in the app, used for security and to keep the Service working.
- Communications — messages you send us, and applications you submit (for example the founding partner form: name, business name, type of business, email, phone number and comments).
4. How and why we use your data
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Providing the Service — accounts, diary, estimates, invoices, sending emails to your customers at your direction | Performance of a contract |
| Billing and subscription management via Stripe | Performance of a contract; legal obligation |
| Service emails about your account (receipts, important changes, security) | Performance of a contract; legitimate interests |
| Improving and securing the Service, preventing fraud and abuse | Legitimate interests |
| Responding to support requests and programme applications | Legitimate interests; steps prior to a contract |
| Marketing about Worklyst (only if you opt in; unsubscribe any time) | Consent |
| Complying with law, e.g. tax and accounting records | Legal obligation |
5. Who we share data with
We do not sell personal data. We share it only with service providers who help us run Worklyst, under contracts that protect it:
| Provider | What they do |
|---|---|
| Supabase | Database, authentication and file storage for the app |
| Vercel | Hosting for the app and website |
| Stripe | Subscription billing, and card payments from your customers (Stripe Connect) |
| Resend | Sending the emails the Service generates |
| Microsoft 365 / GoDaddy | Our support email inbox |
We may also disclose data where the law requires it, to protect our rights, or as part of a business sale or restructure (in which case this policy continues to apply).
6. International transfers
Our providers may process data outside the UK (for example in the EU or US). Where they do, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement, addendum to the EU Standard Contractual Clauses, or an adequacy decision.
7. How long we keep data
- Account and content data: for as long as your account exists. If your account is closed we delete or anonymise it within 90 days, except where we must keep records longer (for example billing records for tax purposes, kept up to 6 years).
- Founding partner and support correspondence: as long as needed to run the programme or resolve your query, then routinely deleted.
- Backups: deleted data may persist in encrypted backups for a limited period before being overwritten.
8. Security
Data is encrypted in transit and at rest, access is restricted per business through row-level security, and we use reputable providers with strong security practices. No system is perfectly secure, but we take protecting your data seriously and will notify you and the ICO of any breach where the law requires.
9. Your rights
Under UK GDPR you have the right to access your personal data, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent where processing is based on consent. To exercise any right, email support@worklyst.co.uk — we respond within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.
If you are a customer of a Worklyst user (for example you received an invoice through Worklyst), the business you dealt with is the controller of your data — please contact them first. We will assist them with your request as their processor.
10. Cookies
The app uses only essential cookies and similar storage needed to keep you signed in and keep the Service secure. We do not use advertising cookies or third-party tracking on worklyst.co.uk.
11. Children
Worklyst is a business tool for people aged 18 or over. We do not knowingly collect data from children.
12. Changes to this policy
If we make material changes we will notify you by email or in the app before they take effect. The "last updated" date at the top shows the current version.
13. Contact
Privacy questions and requests: support@worklyst.co.uk
This policy was last reviewed on 6 August 2026.