Privacy Policy

1. Scope of this policy

This Privacy Policy explains how Crazinerd ("we," "us," "our") collects, uses, discloses, and protects personal information in connection with Workpool (the "Service") — whether you are a workspace member, a visitor to our public pages, or someone whose contact details appear in a workspace's data because a Workpool user corresponded with you or added you as a contact. It should be read together with our Terms of Service. If you are a workspace member, your workspace's Owner and Admins are separately responsible for how that workspace uses the Service to process the personal information of its own contacts and customers.

2. Information we collect

2.1 Account and workspace information

Your name, email address, a securely hashed password (never stored or logged in plain text), job title, phone number, timezone, working hours, avatar, and any other profile detail you choose to add. For each workspace: its name, slug, members, role assignments, and administrative/security settings. If you sign in with Apple or Google, we receive your name (where provided), email address, and an account identifier from that provider to create and sign in to your account.

2.2 Connected mailbox information

If you connect a mailbox, we store the IMAP/SMTP server details and credentials, or the access tokens issued by Google or Microsoft when you connect through their sign-in, needed to synchronize it. Credentials and tokens are encrypted at rest using AES-256-GCM and are never displayed in plain text once saved. We synchronize the email metadata and content necessary to display your inbox and, where you enable them, to power AI classification, drafting, summarization, and related features.

2.3 AI provider connections

If you connect a third-party AI provider account, we store what is necessary to route your requests to that provider and to display connection status. That connection is isolated to the workspace that created it and is never shared with or accessible from another workspace.

2.4 Content you create

Projects, tasks, messages and channels, files you upload, documents, calendar events, contacts and companies, forms and their submissions, templates, comments, time entries, and any other content you or your workspace create within the Service.

2.5 Payment information

Subscription and AI credit payments made on the web or from the Android app are handled by PayFast in your browser. Subscriptions and AI credit packs bought in the iOS app are processed by Apple (App Store) and managed through RevenueCat (revenuecat.com), a subscription-management service that receives an anonymous app user identifier (your workspace's ID) and the purchase receipt and transaction details from the App Store. We receive and store confirmation that a payment occurred — amount, plan or credit pack, status, and a payment or transaction reference — but we do not receive or store your full card or bank account details; those are collected and stored directly by PayFast or Apple under their own privacy policies, and RevenueCat does not receive them either.

2.6 Usage, security, and audit information

Login and logout events, administrative actions (such as role changes or member removal), automation activity, and — for platform administrators — impersonation actions, are recorded in an audit log for security, accountability, and abuse prevention. We also record operational data such as request timing, rate-limit counters, and error logs to keep the Service reliable and secure; these logs are not used to build advertising profiles.

2.7 Cookies, local storage, and device information

The web application stores your session's access token in your browser's local storage and, for browser-based sign-in, a refresh token in an HttpOnly cookie scoped strictly to authentication endpoints. We also process standard technical information sent by your browser (such as IP address and user agent) for security, rate-limiting, and diagnostic purposes. We do not use third-party advertising trackers, and we do not sell personal information to data brokers.

2.8 Support and AI-assistant communications

If you email us for support, or use the in-app "Ask AI support" feature, we — and, for that feature, the platform AI provider described in Section 2.9 — receive the content of your message in order to respond to it.

2.9 Content processed by AI features

When an AI feature runs, the content that feature processes — for example, the email being classified, summarized, or replied to, the task or document being drafted or analyzed, or the question you asked — is sent to an AI provider to generate the result. AI features run when you or another workspace member trigger them, and automatically when a connected mailbox syncs new email (to classify it and, if your workspace's AI task setting allows it, to extract tasks from it). If your workspace has connected its own AI provider (Section 2.3), that provider is used. If it has not, or none of its connections is working, we use a platform AI provider that we configure and pay for, which may be Anthropic, OpenAI, Google (Gemini), or Xkiro (xkiro.com), or another AI service we connect through an OpenAI-compatible gateway; usage is then counted against your workspace's AI credits. Each provider handles that content under its own terms and privacy policy. The app asks for your consent before you use AI features, and you can withdraw that consent at any time in AI Assistant settings.

2.10 Device and push notification information

If you allow notifications, we store a push token for your device or browser and its platform (iOS, Android, or web) so we can deliver notifications to it. Mobile notifications are sent through Expo's push service, which passes them to Apple Push Notification service (iOS) or Firebase Cloud Messaging (Android); browser notifications are sent through your browser vendor's push service. A notification contains its title, a short message, and a link to the item it concerns.

2.11 Content reports

You can report a chat message from within the app. The report, including the reported message and who sent it, is shared with that workspace's Admins and with Crazinerd staff so they can review it and act on it.

2.12 Business records a workspace keeps about its own customers

Workspaces that use Workpool's business tools keep records about their own customers, staff, suppliers and other people: for example quotes, invoices, payments, bookings, jobs, field photos and signatures, online store orders and delivery addresses, loyalty points, store credit, memberships and vouchers, service desk tickets, client portal uploads, property records (owners, tenants, leases, deposits, inspections and statements), fleet records (vehicles, drivers, inspections, fuel, trips and traffic fines) and production records. For this information the workspace decides what is collected and why (it is the responsible party or controller), and we process it on the workspace's behalf to provide the Service. People who want to exercise their rights over such records should contact the business concerned; we will help that business respond.

2.13 WhatsApp and SMS messages

If a workspace connects WhatsApp, its own WhatsApp number is linked to OpenWA, an open-source WhatsApp gateway we run on our own servers, using the WhatsApp Web protocol. Messages sent and received on that number pass through WhatsApp (operated by Meta) under WhatsApp's own terms and privacy policy. SMS messages are sent through the workspace's own SMS gateway: an Android phone running the open-source SMS Gateway for Android, or an SMS provider the workspace connects. We store the conversations, the phone numbers involved and delivery status so the workspace's team can reply from one inbox; message bodies are encrypted at rest. Reminders for invoices and appointments respect each recipient's consent and opt-outs and the workspace's quiet hours.

2.14 Email marketing

If a workspace sends newsletters or campaigns, we keep its subscribers' email addresses, names, list memberships, consent records and delivery results (opens, clicks, bounces and unsubscribes). Campaigns are delivered through listmonk, an open-source mailing program we run on our own servers, using our email delivery provider or an SMTP service the workspace connects. New subscribers confirm by email before they receive anything (double opt-in), every campaign includes an unsubscribe link, and someone who unsubscribes is never added back by an audience rule.

2.15 Social media accounts

If a workspace connects social media accounts, the access granted by each network is stored encrypted, together with the posts, images and videos the workspace schedules and the results each network reports. Posts are published through TryPost, an open-source scheduler we run on our own servers, to the networks the workspace chose (such as Facebook, Instagram, LinkedIn or TikTok), each of which handles the post under its own terms and privacy policy.

2.16 Online store shoppers and orders

When someone buys from a workspace's online store, we process the details needed to fulfil the order on the workspace's behalf: name, email address, phone number, delivery or collection details, the items ordered, payment status and, where the store uses them, loyalty points, store credit and vouchers. Abandoned cart reminders are only sent to shoppers who agreed to receive them. If the workspace connects WooCommerce or Shopify, products, stock, orders and customer details are exchanged with that store to keep both in step.

2.17 Payments to workspaces

Customers of a workspace can pay invoices, deposits, store orders and till slips online through the workspace's own payment gateway account (PayFast, Yoco, Ozow, Paystack or Stripe). Card and bank details are entered on the gateway's own page and go directly to that gateway; Workpool never receives or stores them. We store the payment reference, amount, currency and status the gateway reports, and the gateway notifications we receive (so a repeated notification cannot record a payment twice). The workspace's gateway keys are encrypted at rest and never displayed again after they are saved.

2.18 Location information

• Driver mode. When a driver goes on duty in the mobile app, the device's location is sent while the driver is on duty, and only then, so dispatchers can see deliveries on a live map. Location history is deleted automatically after the period the workspace sets (90 days unless it chooses between 7 and 365 days).
• Clock-in. When someone clocks in or out on their phone, the device's location at that moment can be stored with the time entry so the workspace can check it happened at the branch (an optional geofence). It is kept with the timesheet record.
• Maps and addresses. Maps in the web app load their tiles from OpenStreetMap's tile servers, which receive your IP address as for any web request. Addresses of customers, jobs, deliveries and branches are converted into map positions by a Nominatim geocoding service (OpenStreetMap's public service unless the operator runs its own), which receives the address text but no names.
• Route planning. Where the optional logistics engine (Fleetbase, open source, run on our own servers) is enabled, delivery stops are sent to it, and to the routing service it is configured with, to plan routes.

2.19 Calendar connections and booking sites

If you connect Google Calendar, Microsoft Outlook or a CalDAV calendar (such as Apple iCloud), we store the access tokens or app password encrypted and read event times to block busy slots; bookings and jobs can be written to the connected calendar. A lodge or guesthouse can import the iCal links of booking sites such as Airbnb and Booking.com: the links are stored encrypted, the imported busy dates block availability, and event titles (which booking sites sometimes fill with guest names) are encrypted and shown to managers only. Calendar links Workpool publishes for booking sites to read contain dates and the word "Booked" or the service name, never guest names, phone numbers or notes.

2.20 Electronic signatures

When a workspace sends a document for signature, we store the document (encrypted) and its SHA-256 fingerprint, and for each signer their name, email address, role, the time they viewed, verified, signed or declined, their IP address and browser details, how they were verified (a one-time code sent to their email, stored only as a hash) and their typed or drawn signature. Each event is linked to the previous one by a hash so later changes can be detected, and a certificate PDF records the trail. This evidence is kept with the workspace's records for as long as the workspace keeps the request.

2.21 Intake forms and sensitive information

Intake and consent forms can collect information the law treats as special or sensitive, such as health and medical details, and identity numbers. Answers a workspace marks as sensitive, identity numbers and similar references are encrypted at rest with AES-256-GCM, shown only to the roles the workspace allows, and each access to them is recorded in the audit log. The workspace is responsible for having a lawful reason, such as the person's consent, to collect this information.

2.22 Dashboards and the AI ops assistant

Dashboards are calculated inside Workpool from the workspace's own data. The assistant that answers questions about those numbers stays off until a workspace admin turns it on, each person must agree to AI processing before using it, and staff seats cannot use it. When someone asks a question, the question and the results of read-only lookups that person is allowed to see are sent to the AI provider described in Section 2.9. Those results are mostly totals and are limited in size, and they never include contacts' phone numbers, email addresses or street addresses, custom field values or message content. The question is stored encrypted with a record of which lookups ran; the answer is not stored.

2.23 Staff, rosters and kiosks

For staff members a workspace manages, we store rosters, shifts, clock-in and clock-out times, timesheets, leave, and commission figures the workspace records. Kiosk PINs are stored only as a secure hash. Shop-floor and driver screens record the operations, quantities, inspections, fuel slips and trips each person logs.

2.24 WordPress plugin visitors

If a workspace adds the Workpool plugin to its WordPress site, what visitors type into its forms (such as name, email address, phone number, message and booking details) and their IP address, used for abuse limits, are sent to that workspace in Workpool. The plugin does not set cookies or track visitors.

3. How we use information

• To provide, operate, secure, and maintain the Service, including workspace isolation between tenants;
• To authenticate you and enforce role-based access within your workspace;
• To process subscription and AI credit payments and manage billing through PayFast, or through Apple, Google, and RevenueCat for purchases made in the mobile apps;
• To power features you explicitly enable, such as mail sync, AI classification/drafting, AI-powered support answers, messaging, email marketing, social posting, calendar sync, online payments and e-signatures;
• To process the business records described in Section 2.12 on behalf of the workspace that keeps them;
• To send you notifications you have allowed on your devices or browser;
• To review and act on content reported by users;
• To detect, investigate, and prevent fraud, abuse, and security incidents, including through rate limiting and audit logging;
• To provide customer support, including the logged and notified superadmin access described in Section 6;
• To send you service communications (for example, security notices, billing notices, and password-reset emails) and, where you have not opted out, product updates;
• To comply with legal obligations and respond to lawful requests from public authorities; and
• To analyze aggregated, de-identified usage patterns to improve the Service's reliability and features.

We do not use the content of your connected mailbox or other Customer Data to train any AI model, and we do not sell personal information.

4. Legal bases for processing

Where applicable data protection law requires a legal basis for processing (for example, under the GDPR for users in the EU/UK, or the equivalent conditions for lawful processing under South Africa's Protection of Personal Information Act, 2013 ("POPIA")), we rely on one or more of the following: performance of our contract with you (providing the Service you signed up for); our legitimate interests in operating, securing, and improving the Service, provided those interests are not overridden by your rights; compliance with a legal obligation; and, where required, your consent (for example, for optional marketing communications, or for sending content to AI providers as described in Section 2.9), which you may withdraw at any time.

5. Who we share information with

• PayFast — to process your subscription payment, as your payment processor;
• Apple (App Store) — to process subscriptions and AI credit packs bought in the iOS app, under its own terms and privacy policy;
• RevenueCat (revenuecat.com), our subscription-management processor for in-app purchases — an anonymous app user identifier (your workspace's ID) and the purchase receipt and transaction details, but never your card details;
• Your own connected AI provider (currently Anthropic, OpenAI, or Google, or a self-hosted Ollama server, depending on what you connect) — only when you configure that connection, and only the content needed to carry out the AI action, as described in Section 2.9;
• Our platform AI provider (Anthropic, OpenAI, Google, Xkiro, or another AI service we connect, as described in Section 2.9) — when your workspace has no working AI connection of its own, and for the "Ask AI support" feature, only the content needed to carry out the AI action;
• Expo, Apple Push Notification service, Firebase Cloud Messaging, and browser push services — your device's push token and the notification content, to deliver notifications you have allowed;
• Your own connected mail server — to send and receive email exactly as you configure;
• Payment gateways a workspace connects (PayFast, Yoco, Ozow, Paystack or Stripe) — the amount, reference and customer details needed to take a payment for that workspace, under the gateway's own terms;
• WhatsApp (Meta) — messages a workspace sends and receives on its linked WhatsApp number — and the SMS gateway or provider a workspace connects — the SMS messages it sends;
• Social networks a workspace connects (such as Facebook, Instagram, LinkedIn, X, TikTok, YouTube, Pinterest, Bluesky or Google Business Profile) — the posts and media it publishes;
• Our email delivery provider, or the SMTP service a workspace connects — recipient addresses and content of system emails, signing codes and campaigns;
• Google, Microsoft and CalDAV calendar providers you connect — the calendar events you choose to sync — and booking sites that read a workspace's calendar link — dates only;
• WooCommerce or Shopify stores a workspace connects — products, stock, orders and customer details kept in step;
• OpenStreetMap services (map tiles and Nominatim geocoding) — your IP address when a map loads, and address text to find a map position;
• Google reCAPTCHA, where enabled on this deployment, subject to Google's privacy policy;
• Google Analytics — on our public website pages only (not inside the signed-in app), to measure visits, subject to Google's privacy policy;
• Infrastructure and hosting providers who host the servers, database, and backups the Service runs on, acting under confidentiality and data-processing obligations, solely to operate the Service on our behalf;
• Authorized platform administrators (superadmins) — for support purposes, as described in Section 6, always logged and with the account holder notified;
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, subject to that successor assuming the commitments in this policy for previously collected data;
• Law enforcement, regulators, or other third parties — only where required by law, to protect our legal rights, or to protect the safety of our users, our systems, or the public.

OpenWA (WhatsApp), listmonk (email campaigns), TryPost (social posting) and, where enabled, Fleetbase (logistics) are open-source programs we run on our own infrastructure, so they are not separate companies receiving your data; information leaves them only for the outside services named above.

We do not sell your personal information to third parties, and we do not share it for cross-context behavioral advertising.

6. Superadmin access

A limited number of authorized platform administrators can search for an account to provide support and, where genuinely necessary to diagnose or resolve an issue, sign in as that user ("impersonation"). Every such action is permanently recorded in an audit log, and the affected account holder is notified that it occurred — this logging and notification cannot be disabled by us or by the superadmin performing the action. Superadmin status itself is never granted through the ordinary product interface; it requires a separate, deliberate administrative action.

7. Data security

We apply technical and organizational measures designed to protect personal information, including: encryption at rest (AES-256-GCM) for mailbox credentials, AI-provider secrets, payment gateway keys, messaging, social and calendar credentials, message bodies, sensitive intake answers, identity numbers and documents sent for signature; logging of access to sensitive records; separation of every workspace's data from every other workspace's; secure password hashing (bcrypt) rather than plain-text storage; encryption in transit for traffic to the Service; rate limiting on authentication and other sensitive endpoints to resist brute-force and abuse; role-based access control within each workspace; and permanent, non-disableable logging of administrative and superadmin impersonation actions. No method of electronic storage or transmission is completely secure. If we become aware of a security breach affecting your personal information, we will notify you and, where required, the relevant regulator, in accordance with applicable law.

8. Data retention

We retain personal information for as long as your workspace remains active (or until you delete your account, as described in Section 9), and thereafter for a reasonable period to allow data export (see Section 22 of the Terms of Service), meet legal, tax, or accounting obligations, resolve disputes, and enforce our agreements. Database backups are retained on a rolling basis (currently fourteen (14) days by default) and are then deleted in the ordinary course; audit logs of administrative and superadmin actions are retained for a longer period for security and accountability purposes. Some information has its own shorter period: driver location history is deleted after the period the workspace sets (90 days by default, between 7 and 365 days); uploaded import files are deleted 30 days after the import finishes; and delivery logs of outgoing webhooks are deleted after 30 days. E-signature evidence and the business records in Section 2.12 are kept for as long as the workspace keeps them. When retention is no longer necessary, information is deleted or irreversibly anonymized.

9. Your rights

Subject to applicable law, you may have the right to: access the personal information we hold about you; correct inaccurate or incomplete information; request deletion of your information; object to or request restriction of certain processing; receive a portable copy of information you provided to us; and withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before that withdrawal. To exercise any of these rights, contact us at hello@crazinerd.com. Where you are a member of a workspace rather than its Owner or Admin, some requests concerning workspace content (for example, deleting a record a workspace maintains about you) may need to be directed to that workspace, since the workspace administers its own data as set out in Section 1.

You can delete your account yourself, in the mobile app (Settings > Delete account) or on the web (in Settings), or by asking us at hello@crazinerd.com. Deleting your account also deletes any workspace in which you are the only member; if you are the sole Owner of a workspace that has other members, you must first transfer ownership to another member. Deleted information is removed from our active systems and from backups as they roll over, as described in Section 8. More information is available at workpool.site/delete-account.

9.1 South Africa (POPIA)

If POPIA applies to the processing of your personal information, you have the rights described above as a data subject under POPIA, including the right to lodge a complaint with the Information Regulator of South Africa if you believe your information has been processed unlawfully. You can reach our Information Officer at hello@crazinerd.com for any POPIA-related request.

9.2 European Economic Area, UK, and Switzerland (GDPR)

If the GDPR or UK GDPR applies to you, you have the rights described above as a data subject, and you have the right to lodge a complaint with your local data protection supervisory authority. Where required, we act as a data processor on behalf of a workspace for the Customer Data that workspace controls, and as a data controller for account and billing information we hold in our own right.

9.3 Other jurisdictions

If another privacy law grants you specific rights not otherwise described here, we will honor requests made under that law to the extent it applies to you; contact us using the details in Section 13 and we will respond according to the timelines that law requires.

10. Cookies and similar technology

We use local storage and a session cookie strictly for authentication — keeping you signed in and, for browser clients, securely storing your refresh token. On our public website pages (the home page, the features, industry, pricing, works-with and WordPress pages, sign-up, sign-in, download, and legal pages) we use Google Analytics, which sets its own cookies to count visits and see how visitors find us; it never runs inside the signed-in app, so it never sees your mail, projects, or other workspace content. You can block it with Google's browser opt-out add-on or your browser's cookie settings. We do not use advertising cookies, and we do not respond differently to browser "Do Not Track" signals because we do not engage in the cross-site tracking those signals are designed to address. If Google reCAPTCHA is enabled on this deployment, Google may set its own cookies when the widget loads, governed by Google's own privacy policy.

11. Automated processing

Where you enable AI classification, drafting, or extraction features, the Service uses automated processing to suggest classifications, draft text, or extracted tasks. A drafted reply is not sent until a person sends it, and a suggested task is not created until a person approves it unless your workspace has chosen an automatic AI task setting, in which case tasks may be created automatically and can be edited or deleted like any other task. The AI ops assistant answers questions from the workspace's own figures for the person who asked. These features do not make a decision producing legal or similarly significant effects about you without human involvement.

12. Children's privacy

The Service is intended for business use by adults and organizations and is not directed at children. We do not knowingly collect personal information from children under the age required for consent to data processing in their jurisdiction. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to investigate and delete it.

13. International data transfers

Depending on where the Service is hosted and where you, your workspace, and your contacts are located, your personal information may be processed in a country other than your own, which may have different data protection laws. Where we transfer personal information across borders, we take steps required by applicable law to protect it, which may include contractual safeguards with the recipient.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Service or our practices. We will update the "Last updated" date above and, for material changes, make a reasonable effort to notify you — for example, by email or an in-app notice — before the change takes effect. Your continued use of the Service after a change takes effect constitutes your acceptance of the updated policy.

15. Contact us

For any question about this policy, to exercise a privacy right, or to reach our Information Officer for POPIA purposes, email hello@crazinerd.com.