This notice says what Workgraph, Inc (“we”) collects, why, who can read it, and how to reach us. Last updated 12 October 2026.
Account. Your work email address, a display name, and the company you register or join. We verify email ownership with a sign-in link or a supported identity provider. Where enabled, verified users may also set an optional password; we store a salted password hash, never the password itself.
Email onboarding. Where enabled, an email intentionally addressed to Room can create a person account and a public contact page using the sender address and display name. The page shows its name and the topics you select; creating it does not publish your email address. We retain the account, page, selected topics, request content and records of authenticated email decisions. Email messages can include request information for the exact account owner. We use sender authentication and scoped reply links to handle this flow; account creation alone does not mark your address verified or record Terms acceptance.
Content you contribute. Files, links and text you provide, any access you give us to them, selected records you import from connected tools, your needs and offers, generated briefs and claims, introduction decisions, and shared chat messages. We also retain content and records for existing Room workflows. Content is associated with its owning account and the permissions recorded for its use.
Email evidence. Where enabled, you may submit an original email file to a profile you operate so Room can check its signatures. We store the exact file, encrypted at rest, with that profile. The check runs on our servers without an AI model; it looks up the signing domain's published key, so our DNS resolver sees that domain and selector. Room does not follow links in the email or contact its sender or recipients. A signature check shows that particular signed content was unchanged under the recorded key. It does not establish who you are, that a payment happened or that the content is true. Forwarding an email to an evidence address works the same way for an email attached to the forward; the forwarding message itself is not kept. If you make an address in Room that also keeps ordinary forwards, a forward that quotes the email in its body is stored exactly as it arrived, with that profile. It has no original signature, so Room checks nothing in it and records that. Addresses agents make, and older addresses, keep only attached emails. The email stays with that profile: Room never sends it to another profile or person, and agents you connect read its check, not the email. Withdrawing it stops further checks and use. We retain the file and its check records; contact us to request deletion.
Records. Who approved what and when, provider calls, and disclosure and delivery events. Records are how the product works; they are retained with the Room.
Technical data. Server logs with IP addresses and request metadata, kept for security and operations.
Feedback and usage. Ratings and feedback you give on drafts, matches and introductions, and records of how the service is used. We use them, and aggregated or de-identified data that does not identify you or your company, to operate and improve the service.
Product analytics. Our server records which steps you take in Room, and the campaign tag of the link you arrived from, with PostHog, a product analytics processor, in the United States. Each record holds the step name, the time, the campaign tag, a few fixed details of the step (such as the sign-in method, which tool you connected, or whether the account is new), and either a random browser identifier or a one-way hash of your account identifier. When you sign in, we link that browser identifier to the hashed account identifier, so steps before and after sign-in count as one person. It holds no email address, name, file, link address, title, brief text, tool content or IP address from your browser, and no page content or recordings. Two first-party cookies carry this: room_a holds the random identifier for up to 180 days, and room_c holds the campaign tag for up to 30 days. Signing out clears both. We set neither and record nothing when your browser sends Do Not Track or Global Privacy Control. Turning analytics off here stores off in room_a for 180 days, which signing out keeps.
Connecting a tool, selecting an import or otherwise providing content authorizes us to obtain and store it. When Room offers saving alone, that action grants no model processing, staff review or matching permission. Those uses require a recorded processing agreement; existing agreements keep their original scope. For enabled personal understanding, an ordinary supported upload or source selection records the current personal-processing agreement for that exact context, without a second approval step. Earlier save-only context is not enrolled by opening a page or adding unrelated context. Separately admitted matching can compare a personal or company profile with participating people and companies. Personal understanding alone does not grant matching authority. Background discovery can use admitted context before you create or approve a brief. You separately approve outward wording. Counterparties receive only authorized representations before acceptance; registered identities and a shared chat are released after both sides accept. A shared brief may already name its author by their choice. Existing Room workflows retain their recorded permissions. We do not sell content or use it to train models.
External AI providers. To read, assess and draft, Room sends the text it needs to external AI providers (a routing service and the company that runs the model). They receive bounded input for the action you took or the permission you recorded. For Room’s current features (briefs, Connect, matching, Explore and understanding your context), each request uses one fixed route, with no fallback to other providers, data collection denied and zero data retention requested. Room workflows (data mapping, recurring partner Rooms and Clean Room Runs) use the providers and settings recorded in their own setup, and those may not request zero retention or a fixed route. We choose these providers and models and may change them; a change never asks you to consent again or ends a permission you recorded. Room staff review drafts before releasing them to you; a separate review checks proposed outward content. An external provider reads whatever is sent to it and processes it under its own terms.
Hosted execution. Ordinary Runs execute on infrastructure we operate. We do not claim operator blindness for those Runs: the service operator can technically read data processed there. Each record states the execution venue.
Connected tools. You authorize a provider connection, then a specific import scope. Some provider permissions cover more than the selection room imports; the selection screen explains this. Credentials are encrypted in the connector vault and are not included in evidence or model prompts. Google Drive’s file picker receives a short-lived access token in your browser. Staff review applies only where the recorded agreement includes it; the personal-understanding agreement does not grant staff-review access.
Google data. Room's use and transfer of Google API data complies with the Google API Services User Data Policy, including its Limited Use requirements. These commitments also apply to information derived from Google data. We use this information to provide the features you authorize in Room. We do not use it for advertising, sell it, or use it to train models. Transfers are limited to delivering authorized features, security needs, legal requirements, or a business transfer with your prior consent. Human access requires your affirmative agreement for the specific data, a security need, a legal requirement, or an applicable aggregate-data exception under that policy. Disconnecting Google stops new imports and leaves saved records in your account; contact us to request deletion. Where the Google-specific limitations in this section conflict with broader data-use permissions elsewhere in this notice or the terms, these Google-specific limitations take precedence.
Credit offers. Founding and referral eligibility reviews require separate permission to read the company profile and selected context. Review decisions and recorded awards are retained. Referral links use a first-party cookie for up to 30 days to carry the referral into signup. When a referral qualifies, the referring business sees its own award amount and date, not the invited business’s identity, context or review notes.
Support chat. The chat window on our home page, sign-in page and app is run by Chatwoot. Messages you send there are stored by Chatwoot and read by Room staff. Before a chat starts we ask for your email so we can reply. When you are signed in, the chat carries your name, email and company instead. Chatwoot stores a cookie in your browser to keep your conversation; signing out clears it.
Email. We send sign-in links and short notices about requests, reviews, and answers waiting for you. Notices contain links, not content. Contact messages you submit, including your account email or the email address you enter and any organization you enter, are delivered by our email service to the Room team so we can reply.
Invite requests. You may optionally connect X through its sign-in page to verify a social account. Submitting your request saves your email and connected X account IDs, handles and profile links in Room for invitation review and prioritization by authorized platform staff. These details are encrypted at rest. Staff alerts carry request details through our email service. We retain applications and invitation decisions to manage access and support; contact us to request deletion. A connected X account does not verify ownership of the email you enter. A first-party encrypted cookie keeps your draft and connected identities for 30 minutes after your last change. OAuth access tokens are used during verification and are not retained for ongoing access. We do not use these connections to post or import your social content.
We use hosting, email delivery, support chat, product analytics, and model providers as processors. Each receives only what its function needs. We disclose data when the law requires it. We do not share it with advertisers.
Account data is kept while your account is active. Disconnecting a source removes its saved credential and stops future acquisition. Stored imported context and derived understanding remain in your account. They may continue to support company understanding and matching under their separately current processing and matching permissions; disconnecting a source alone does not revoke those permissions. Revoking processing permission is a separate action that stops new processing and discovery. Existing legacy contracts maintain their original dependency restrictions. It does not delete imported snapshots, established chats or recorded disclosures. Changes within an admitted source scope can be processed under its current agreement. Later source additions are recorded separately and wait behind an active processing pass. Provider-side access withdrawal is detected on a subsequent API call, rather than immediately. To close your account or request deletion of saved content, contact us; we confirm what was removed and what records remain. A deletion-request workflow is planned but not yet available.
You can access, correct, export, or ask us to delete your personal data. Write to us through the contact form. Depending on where you live you may have additional rights under local law; we honor them.
Changes to this notice are posted here with a new date.