WorkWeaverWorkWeaver Privacy Notice
Effective Date: October 22, 2026
Last Updated: October 23, 2026
Version: 2.0
BitFoundry Tech Private Limited · 3/80, Ganesar Street, Ganapathipalayam, Sulur, Moperipalayam, Coimbatore 641659, Tamil Nadu, India · CIN U62011TZ2025PTC035159
In plain words
This notice explains what personal data WorkWeaver collects and why. We collect only what we need to run your account, do the work you ask for, bill you correctly and keep the service safe. We do not sell your data and we do not show ads. Our website sets no tracking cookies and uses no advertising cookies or tracking pixels; some older pages still use a device identifier, which we are removing.
When a business uses WorkWeaver, the data it puts into or connects to the platform belongs to that business. We process it only on the business's instructions and never use it to train shared AI models.
The product also records how it runs: which tools an agent called, retries, errors, timeouts, timing, which model route was used, and the billing meter. Section 4.6 describes the fields. That record is designed to exclude your content, and we use it across customers only in aggregated form that identifies no one.
You can ask to see, correct or delete your data at any time by writing to workweaver@bitfoundry.ai. This summary helps you read the notice; the numbered sections are the binding text.
1. Who we are
WorkWeaver is a product and service of BitFoundry Tech Private Limited, a private limited company incorporated in India (CIN U62011TZ2025PTC035159), with its registered office at 3/80, Ganesar Street, Ganapathipalayam, Sulur, Moperipalayam, Coimbatore 641659, Tamil Nadu, India ("WorkWeaver", "we", "us").
- Privacy questions, requests, grievances and legal notices: workweaver@bitfoundry.ai
- Grievance Officer: see section 12.
- Our Grievance Officer handles all privacy questions. We will appoint a data protection officer if the law requires one.
2. What this notice covers
This notice covers personal data we handle for our own purposes:
- visitors to workweaver.ai and its pages;
- people who fill in the "Book a call" brief or book a call;
- people who sign up for a WorkWeaver workspace and the users of each workspace (account, sign-in, acceptance, support and billing data);
- Usage Data: the records the product creates about its own operation (section 4.6);
- prospects, customers' contacts and people we deal with to sell, deliver, support and invoice our services;
- people who write to us.
Our website and services are not offered in the European Union, the European Economic Area or the United Kingdom, and we do not accept sign-ups from there.
It does not cover the personal data that a customer loads into, or connects to, the WorkWeaver platform ("Customer Data"). For Customer Data, the customer decides why and how it is used, and we act only on its instructions under our Terms of Service and Data Processing Addendum. If your data reaches us through one of our customers (for example, you are in a meeting, phone call, email or WhatsApp chat that a customer's agent handles), please contact that customer first. We will help them answer you.
3. Our role under data protection laws
| Situation | India (DPDP Act 2023) | California (CCPA/CPRA) |
|---|---|---|
| Website, brief, booking, sales, contracts, invoices, our own marketing; workspace users' account, sign-in, acceptance, support and billing data; Usage Data | We are the Data Fiduciary | We act as the business for this data, to the extent the CCPA applies to us |
| Customer Data inside the platform | We are the customer's Data Processor | We are the customer's service provider |
4. What we collect
4.1 The "Book a call" brief
The brief has seven short steps. We collect what you choose to give us:
- your goal for AI, the problem you want solved, your role;
- your industry, revenue range, number of employees, stage and timing, and investment range;
- your name, email and company;
- your phone number, only if you choose to add it;
- by sending the brief you ask us to contact you about your request; we send other follow-up about our services only if you ask for it.
While you fill in the brief, your answers stay in your browser's session storage, so a page reload does not lose them. They are never put in the web address, they reach us when you submit, and your browser clears them when the session ends.
4.2 Booking a call
After you send the brief, the booking step opens WorkWeaver's Zoho CRM booking page in a new tab. Zoho CRM shows free times, books the call, and emails you a confirmation with links to change or cancel it. Zoho may set its own cookies on that booking page under its own privacy notice.
4.3 Calls and meetings with us
We keep notes of sales and delivery calls. We tell you, and ask, before we record or transcribe a call with you. If you do not agree, we do not record.
4.4 Signing up, and records of your consent
When you create a workspace we collect your name, email, company, sign-in method (email or Google) and password (handled by our identity provider, Amazon Cognito, in a form we cannot read).
When you accept our Terms of Service, this Privacy Notice and the Data Processing Addendum, we keep a record of acceptance: who accepted, for which workspace, the date and time, and the version in force. We keep it so that you and we can show what was agreed, and you can ask us for a copy at any time.
4.5 Workspace users, support and billing
For each user a customer gives access to: name, email, role, login and security events, and support conversations. For billing: the billing contact, GSTIN or other tax identifiers where needed, invoices, wallet top-ups and refunds. Card and bank payments are handled by our payment processor (Razorpay); we receive payment references and status, never full card numbers. To run and improve our customer relationship we keep, in our CRM, each customer's signup date, payments, monthly usage totals, support tickets, satisfaction scores (such as NPS and CSAT) and, if the customer chooses to answer our optional exit survey, the reasons for leaving.
4.6 Usage Data: how the product runs
The product records its own operation so that we can bill correctly, keep it reliable and secure, support you and improve it. This is Usage Data. It is generated by the product itself, it is tied to a workspace and user identifier, and it is made of fields like the ones below.
| Group | Fields |
|---|---|
| Who and where | workspace identifier, user identifier (stored as a one-way hash in metrics), product surface (web, command line, API, voice), deployment region |
| Unit of work | agent span identifier, parent span identifier, correlation identifier, skill or capability identifier, start time, end time, duration, close reason, time spent waiting on sub-agents |
| Tools | tool name, call count, outcome (success, failure, denied by policy), retry count, timeout flag, latency |
| Models | provider, model, route source (your key or WorkWeaver-managed), fallback used, input and output token counts |
| Errors and health | error type, response status code, request route pattern (with identifiers removed), queue wait time |
| Billing meters | agent-minutes, managed-inference cost, voice and meeting minutes, messages sent and received by channel (counts only), memory reads and writes (counts only), storage and data-transfer volume |
We design Usage Data to exclude your content: no prompts, messages, emails, documents, transcripts, recordings, files, agent outputs, contact details of the people your agents deal with, or credentials. We are adding automatic checks that hold Usage Data to a published field list, and we will keep this list up to date as fields change.
Diagnostic logs are separate from Usage Data. When something fails, the product writes an error log so our engineers can fix it. We remove common personal data patterns (such as emails, phone numbers and keys) from log messages, keep them for up to 1 year, and limit access to the engineers who run the service. If an error log still captures part of a customer's content, we treat that part as Customer Data under our Data Processing Addendum.
4.7 Technical data from our website
Our web servers record standard request data: IP address, browser type, the page requested, time and response codes. We use it to keep the site working and secure and to stop abuse, and keep it as section 9 says.
Our website uses no analytics cookies, advertising cookies or tracking pixels; some older pages still use a device identifier, which we are removing. The product sets only the cookies it needs to sign you in and keep your session secure.
4.8 Data from connected services
When a customer connects a service such as Google Workspace, Microsoft 365, Slack or Salesforce, the data that flows in is Customer Data (section 2). WorkWeaver's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. When a customer connects Google Workspace, WorkWeaver accesses only the Google data the customer authorises for the features it turns on: sending email from Gmail, Calendar events, and the Drive files the user picks or that WorkWeaver creates (and, where the customer uses its own Google app, reading Gmail). We follow the equivalent rules of Microsoft, Slack and Salesforce for their data: we use it only to provide the features the customer turns on, we never use it to train AI models, we never use one customer's data to benefit another, and we keep it only as long as those features need it.
4.9 Data we do not ask for
Please do not send us sensitive personal data (such as health, financial account, biometric or government ID data) through the brief or by email. We do not knowingly collect data from children (section 11).
4.10 Where we get it
Mostly from you. We also get data about you from your employer or colleagues when they name you as a contact or add you as a workspace user, from Google when you sign in with Google, from our payment processor when you pay, and from our scheduling provider when you book a call. Usage Data is created by the product as you use it.
5. Why we use it, and our legal basis
| Purpose | Data | India (DPDP) |
|---|---|---|
| Read your brief, prepare for and hold the call | Brief, booking | Your consent, which you give when you submit the brief |
Record the campaign link (for example utm_ tags) that brought you, with your brief, even without cookie consent |
Campaign tags, brief | The consent you give when you send the brief |
| Follow up about our services after the call, only if you opt in | Name, email, company, notes | Your consent, given only if you opt in; you can withdraw it at any time |
| Create and run your account, and keep records of acceptance and consent | Account data, records of consent | Legitimate use for the purpose you provided the data for (DPDP section 7(a)) |
| Meter usage, bill you, take payment and refund unused balance | Billing meters, billing and payment data | Legitimate use for the purpose you provided the data for (DPDP section 7(a)), and compliance with tax law |
| Keep the product reliable and secure, and support you | Usage Data, security logs | Legitimate use (DPDP section 7(a)), and compliance with law, including the log-keeping that CERT-In directions and the DPDP Rules require |
| Improve the product | Usage Data in aggregated form that identifies no one | Not personal data once aggregated and de-identified |
| Keep tax, accounting and legal records | Invoices, contracts | Compliance with law |
| Respond to legal claims and authorities | As needed | Compliance with law, court orders |
We read your brief ourselves to decide how best to help. We make no decisions about you that have legal or similarly significant effects solely by automated means.
Do you have to give us this data? No law requires you to fill in the brief. We need your name, email and company to book a call or create a workspace. We need billing and tax details to take payment and invoice, and Indian tax law requires some of them (such as GSTIN for GST invoices). Usage Data is part of how the product works and bills; you cannot use the product without it. If you object to this processing, we stop it within a reasonable time; because the product cannot run or bill without Usage Data, your access then ends and any unused Wallet balance is refunded (Terms 9.4).
6. What we do not do
- We do not sell personal data, and we do not share it for cross-context behavioural advertising.
- We do not use the brief, Customer Data or Connector Data to train shared or general AI models.
- We do not use one customer's Customer Data for another customer.
- We do not use sensitive personal data to infer characteristics about you.
7. Who we share it with
We share personal data only as needed for the purposes in section 5:
- Service providers who host, store, email, schedule, take payments and invoice for us, under contracts that require them to protect the data and use it only on our instructions: Amazon Web Services (hosting, storage, database, identity, email delivery), Zoho Corporation (CRM, call booking, business email, helpdesk, invoicing, surveys and email campaigns, in Zoho's India data centre), Razorpay (wallet payments and refunds) and Stripe (invoices for customers on a signed agreement, until we move them to Zoho Books). The providers that handle Customer Data are listed in Annex 3 of our Data Processing Addendum.
- Professional advisers (lawyers, accountants, auditors) under a duty of confidentiality.
- Authorities, where the law requires it or to protect rights, safety and security.
- A buyer or successor, if all or part of our business is reorganised, merged or sold, subject to this notice.
8. Where your data is stored and sent
We are based in India. Our platform and website backend are hosted in Amazon Web Services data centres in the United States (AWS US East, N. Virginia; AWS US West, Oregon). Our CRM, scheduling and invoicing run in Zoho's India data centre, and payments run on Razorpay in India and, for invoiced customers, Stripe in the United States. So your data may be processed in India, the United States and other countries where our providers operate.
Transfers outside India follow section 16 of the DPDP Act and any restrictions the Government of India notifies.
9. How long we keep it
| Data | How long |
|---|---|
| Brief and booking, if you do not become a customer | 24 months from our last contact with you, then deleted, unless you ask us to delete it sooner |
| Account, user and support records | For the life of the workspace, then up to 3 years to handle questions and claims |
| Records of acceptance and consent, and withdrawals | For as long as we rely on the consent or the agreement, and 5 years after, and longer while a dispute about it is open |
| Usage Data linked to a workspace | Detailed records up to 400 days; monthly billing totals as long as tax law requires; aggregated data that identifies no one may be kept longer |
| Invoices, payments, refunds, tax and accounting records | As long as Indian tax and company law requires (currently up to 8 years) |
| Website and security logs | Up to 1 year; longer only while an investigation is open or the law requires it |
When we no longer need data, we delete it or make it anonymous.
10. How we protect it
We protect personal data with encryption in transit and at rest, access limited to people who need it, multi-factor authentication for staff, separation of each customer's data, logging and monitoring, backups, and written contracts with our providers. If a breach affects your personal data, we tell you and the authorities (such as the Data Protection Board of India and CERT-In) within the times the law sets.
11. Children
Our website and services are for businesses and for people aged 18 or over. We do not knowingly collect personal data from children. If you think a child has given us data, write to workweaver@bitfoundry.ai and we will delete it.
12. Your rights and how to use them
Write to workweaver@bitfoundry.ai from the email you gave us, or tell us how to verify you. We do not charge for reasonable requests and we will not treat you worse for using your rights.
Everyone. You can ask us to: tell you what data we hold and who we shared it with; correct, complete or update it; delete it; and stop using it for follow-up. Where we rely on your consent, you can withdraw it at any time, as easily as you gave it, by the link in our messages, in the product, or by writing to us; we act on it, and it does not affect what we did before. We keep any record of your consent and its withdrawal even after we delete the rest of your data, because we may need it to show what happened in a dispute; we keep nothing else from that data, only for the period in section 9, and only where the law that applies to you allows it. A workspace Admin can also see the workspace's own usage and billing records in the product.
India (DPDP Act 2023 and Rules). As a Data Principal you have the rights to access information (section 11), to correction, completion, updating and erasure (section 12), to grievance redressal (section 13), and to nominate another person to act for you on death or incapacity (section 14). If you are not satisfied with our answer, you may complain to the Data Protection Board of India after using our grievance process.
California. You have the rights to know, access, correct and delete personal information, to opt out of sale or sharing (we do neither) and to limit the use of sensitive personal information (we do not use it for purposes that need this right). You may use an authorised agent; we may ask the agent for proof of authority and ask you to verify your identity.
Language. You may ask for this notice in English or in any language listed in the Eighth Schedule to the Constitution of India, and we will provide it.
Response times. We reply within the time the applicable law sets: within 45 days under the CCPA and within one month under Indian law (and in any event within the period the DPDP Rules set).
Grievance Officer (IT Act 2000, SPDI Rules 2011, DPDP Act 2023) Aditya Koushik, Co-Founder BitFoundry Tech Private Limited, 3/80, Ganesar Street, Ganapathipalayam, Sulur, Moperipalayam, Coimbatore 641659, Tamil Nadu, India Email: workweaver@bitfoundry.ai We acknowledge grievances promptly and resolve them within one month, or sooner if the law requires.
13. Changes to this notice
We update this notice when our practices change. The version and date at the top change, and we tell workspace owners and active contacts by email and in the product before a material change takes effect. Where a change needs your consent under the law, we ask for it.
14. Contact
BitFoundry Tech Private Limited (WorkWeaver), 3/80, Ganesar Street, Ganapathipalayam, Sulur, Moperipalayam, Coimbatore 641659, Tamil Nadu, India workweaver@bitfoundry.ai
15. Cookies and similar technologies
Our website uses only what it needs to work:
| Name | Type | Set by | Purpose | How long |
|---|---|---|---|---|
ww-brief-v1 |
Browser storage (sessionStorage) | WorkWeaver | Keeps your unsent Book-a-call answers in this tab | Until you close the tab |
| Sign-in cookies | Cookies | WorkWeaver (product) | Keep you signed in and your session secure | Until you sign out or the session ends |
| Zoho CRM booking cookies | Cookies | Zoho, only if the Zoho CRM booking page opens at the booking step | Run the booking page | As Zoho's cookie policy states |
We use no analytics, advertising or tracking cookies. If we add optional cookies, we will ask you first and update this section.
California. We do not sell or share personal information.
Last Updated: October 23, 2026