Privacy policy

Who is responsible

NEWWORK [legal form to confirm], [Street and number to confirm], [Postcode and city to confirm], [Country to confirm]. Privacy questions: privacy@newworkprojects.com.

This website

Hosting and server logs

Vercel serves this website. When you visit, Vercel processes the technical data needed to deliver it and protect it from abuse (IP address, time, the address requested, your browser) and keeps it briefly in logs. The legal basis is our legitimate interest in running the site securely (Art. 6(1)(f) GDPR).

No cookies, no tracking

The website sets no cookies and stores nothing in your browser; the fonts are served from our own server. It loads nothing from third parties.

Counting visits

We count page views ourselves, on our server in the EU. We record the page, the domain of the site that linked to it, a campaign tag from the link (utm_source), the device class (phone, tablet, desktop) and the country our host derives from the IP address. So that a visitor counts once a day, we hash the IP address and the browser’s user agent with a key that changes every day. We never store the IP address, we delete the hash after two days, and nobody can be recognised across days or across other sites. If your browser sends Global Privacy Control or Do Not Track, we count the view but not the visitor. What remains are daily numbers per page and source (Art. 6(1)(f) GDPR).

When you follow a sign-up link, it carries the page you were on and the source that brought you to the website. If you create an account, we keep these and how you signed up with the account, so we can see which pages and channels lead to sign-ups.

Brief Checker

The readiness score is computed in your browser, and nothing leaves your device for it. When you ask for an AI rewrite, we send the text to our server and to OpenAI to write the answer. We don’t store the text. OpenAI does not use API data for training and may keep requests for up to 30 days to detect abuse. To limit rewrites per visitor we store a salted hash of your IP address (never the address itself) and remove it after two days (Art. 6(1)(f) GDPR).

Email

When you write to us, we process what you send to answer (Art. 6(1)(b) or (f) GDPR).

The NEWWORK Projects app

• Your account: name, email address, profile picture and how you sign in (email, Google or Microsoft), to provide the service (Art. 6(1)(b) GDPR).
• Workspace content (tickets, comments, files, time): we process it on behalf of the organisation that owns the workspace, under our data processing agreement. That organisation is the controller.
• Audit log: changes you make in a workspace and your sign-ins (time, method and IP address) are recorded in that workspace’s audit log, which its admins on Business and Enterprise can read. Entries are kept for a year on those plans and 90 days on others (Art. 6(1)(f) GDPR, and on behalf of the workspace under the DPA).
• Support access: our staff do not read workspace content. Only when a workspace admin lets NEWWORK support in, for 1, 3 or 7 days, may support read its projects and tickets, without files and without changing anything. The admins see every page support opened and can end access at any time.
• Billing: billing contact, address, VAT ID and payment details, through Stripe (Art. 6(1)(b) and (c) GDPR). We keep invoices as commercial and tax law requires.
• Emails such as sign-in links, invitations and notifications are sent through Resend.
• AI: when members use the built-in AI, the text of the request goes to OpenAI. With the workspace’s own OpenAI key, requests run on that account. For each request we keep the feature, model, token counts, duration and cost, never the text, and delete them after 13 months.
• Usage counts: how often a workspace uses screens, features and MCP tools, counted per day without recording who did what and without content. We use them for allowances, pricing and deciding what to improve, and delete them after 25 months (Art. 6(1)(b) and (f) GDPR).
• Error reports: when a screen or a server request fails, the error, the browser, the page path and the server route go to Sentry in the EU, so we can fix it. They contain no ticket content, names or email addresses, Sentry stores no IP addresses for us, and reports are deleted after at most 90 days (Art. 6(1)(f) GDPR).

Recipients and transfers

We use these providers: Supabase, Vercel, OpenAI, Stripe, Resend, Sentry. The trust page lists what each one does and where. Transfers to the United States rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

How long we keep data

Account data until you delete your account; workspace content until its owner deletes it or the workspace. It leaves backups when they roll over. Legal retention duties stay unaffected.

Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15 to 21 GDPR). Write to privacy@newworkprojects.com. You can also complain to a data protection supervisory authority.