← Back to Home

WorkKits360 Privacy Policy

Last Updated: September 16, 2026

What This Policy Is For (In Plain Language)

You deserve to understand how your information is used. This Privacy Policy explains our practices as clearly as possible. We explain what data we collect, why we collect it, how we protect it, and what choices you have.

The short version: We collect information to run WorkKits360. We don't sell your data. You sign in with a passkey, not a password. Company work (playbooks, kits, evidence, catalog) belongs to your company. Wellbeing reflections stay private to you. Staff can turn off their own login from Account.

Table of Contents

  1. Introduction
  2. Information We Collect
  3. How We Use Your Information
  4. How We Share Your Information
  5. Wellbeing Data Protection
  6. AI and Data Processing
  7. Data Security
  8. Your Rights and Choices
  9. Data Retention and Deletion
  10. Children's Privacy
  11. International Users
  12. You're in Control
  13. Changes to This Policy
  14. Contact Us

1. Introduction

WorkKits360 ("we," "our," or "us") is a multi-tenant software-as-a-service platform that helps companies run daily operations: kits, playbooks, training, moments, tasks, and Search. This Privacy Policy describes how we collect, use, share, and protect information when you use the web app or a future worker app published for company phones.

Our Commitment: We are committed to protecting your privacy and being transparent about our data practices, especially for camera evidence and wellbeing reflections.

2. Information We Collect

2.1 Information You Provide Directly

Account Information:

  • Email address (required to identify your account)
  • Full name (optional)
  • Passkeys (WebAuthn credentials stored on your device; we store only the public key)

We do not use passwords for sign-in. We do not offer Google, Microsoft, or Apple social login.

Company Information:

  • Company name and details
  • Business type and description
  • Company values and communication preferences
  • Location names and addresses
  • Catalog noun and field labels your company configures (for example Product, Job, or Equipment)

Content You or Your Company Create:

  • Kits (projects, training, and wellbeing workflows)
  • Playbooks
  • Tasks
  • Catalog items and the field values your company chose
  • Training responses and progress
  • Moments
  • Notes and reflections (including wellbeing content)

Camera and Photo Evidence:

  • Photos you take or upload to complete a kit step (for example a close-out photo)
  • Photos used for catalog items, when your company adds them

The camera is used for work evidence, not for background recording.

Search:

  • Questions you type into Search
  • Which company sources (playbooks, moments, kits, training) were retrieved to answer

2.2 Information Collected Automatically

Authentication Data:

  • Login timestamps
  • Session cookies
  • Device and browser information
  • IP address (for security)

Usage Data:

  • Features you access
  • Actions you take
  • Time spent on sections
  • AI usage metrics (request counts and token usage for cost tracking)

Technical Data:

  • Browser type and version
  • Operating system
  • Screen size
  • Referrer URLs

2.3 Information from Third-Party Services

Invoices (company billing):

  • Subscription tier, status, and period dates
  • Seat counts and AI spend used to prepare invoices
  • We do not collect or store payment card numbers. Companies pay invoices we issue. We do not process cards in the product.

Email Services:

  • Delivery status for service email (via Resend)

Company agent connections (optional):

  • If your company connects an operations agent, we store tokens for that connection. That is a company integration, not how staff sign in.

3. How We Use Your Information

3.1 To Provide the Service

We use your information to:

  • Authenticate you with your passkey and keep your session
  • Store and organize your company's content
  • Record kit progress and photo evidence
  • Deliver training and track completion
  • Answer Search against your company's published work
  • Send important service notices

3.2 To Improve the Service

We use aggregated, anonymized data to:

  • Understand how features are used
  • Identify areas for improvement
  • Monitor reliability
  • Track AI usage and costs

Important: We do NOT use your wellbeing content, personal reflections, or private notes for analytics or improvement.

3.3 To Communicate with You

We use your email address to:

  • Send important service updates
  • Respond to support requests
  • Send billing-related communications to company owners and admins

You can opt out of marketing emails (service emails cannot be opted out of).

3.4 To Ensure Security

We use technical data to:

  • Detect and prevent fraud
  • Protect against unauthorized access
  • Monitor for security threats
  • Comply with legal obligations

Limited members of our internal team may access certain customer data strictly for debugging, security investigations, or support. Access is logged and restricted.

4. How We Share Your Information

4.1 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties.

4.2 Within Your Company

Company-Owned Content:

  • Kits, playbooks, tasks, catalog items, moments, and completed work (including photo evidence) are visible to authorized people in your company based on their roles
  • Company owners and admins can see company content
  • Location admins can see content for their locations
  • Staff can see content assigned to them

Important: Wellbeing reflections are NOT shared with your company. See Section 5.

4.3 Service Providers

We share information with trusted providers who help us operate the platform:

Turso (database):

  • Stores accounts, company content, sessions-related records, and passkey public keys

OpenAI (AI processing):

  • Receives prompts and retrieved company sources for content generation and cloud Search
  • Subject to OpenAI's data processing terms
  • We do NOT use your data to train OpenAI's models (we use their API)

Resend (email):

  • Sends service and notification email

Vercel (hosting):

  • Hosts the application
  • May have access to server logs and technical data

4.4 Legal Requirements

We may share information if required by law, such as:

  • Valid legal requests (subpoenas, court orders)
  • Protecting our rights and safety
  • Preventing fraud or security threats
  • Complying with applicable laws

4.5 Business Transfers

If WorkKits360 is acquired or merged, your information may be transferred to the new entity. We will notify you of any such change.

5. Wellbeing Data Protection

This section describes how we protect private wellbeing content.

5.1 What Is Wellbeing Content?

Wellbeing content includes:

  • Reflections and notes you write in wellbeing kits
  • Personal responses to wellbeing prompts
  • Any content you explicitly mark as private or personal

5.2 Privacy Guarantees

Your wellbeing content is private to you.

What Your Company Can See:

  • That you were assigned a wellbeing kit
  • That you started or completed it
  • Completion date (if applicable)

What Your Company CANNOT See:

  • Your reflections or responses
  • Your notes or personal thoughts
  • Progress beyond started or completed

What We Can See:

  • We can see wellbeing content for technical support if you ask for help
  • We do NOT use it for analytics, AI training, or product improvement
  • We do NOT share it with your employer

5.3 AI Processing of Wellbeing Content

If you use AI inside a wellbeing kit:

  • Your input is sent to OpenAI for that request
  • OpenAI does NOT use this data to train their models
  • We do NOT store wellbeing AI interactions unless you save them
  • Your employer has NO access to those interactions

5.4 Your Control

You can choose not to use wellbeing features and request deletion of wellbeing data at privacy@workkits360.com.

6. AI and Data Processing

6.1 How We Use AI

WorkKits360 uses OpenAI models to:

  • Help managers draft kits, playbooks, training, and catalog items
  • Answer staff Search using retrieved company sources
  • Suggest next steps from a prompt or uploaded document

Search answers that use generation come from OpenAI. When generation is not available, Search can show matching snippets from your company's published work without inventing an answer.

6.2 Data Sent to AI Services

Cloud Search:

  • Your question
  • Retrieved snippets from playbooks, moments, assigned kits, and training your company published

Content generation (managers):

  • Prompts, uploaded documents, and existing company content needed to draft a kit or playbook

Camera / photos:

  • A photo is sent to OpenAI only when a feature needs to read that image (for example extracting catalog fields). Ordinary kit evidence photos are stored for your company and are not sent to OpenAI unless a feature you use does so.

OpenAI does NOT use your data to train their models. Some requests may pass through Vercel infrastructure only to reach the provider.

6.3 AI Data Retention

We retain:

  • Saved generated content in your company account
  • Kit evidence photos (stored for your company)
  • Usage counts needed for invoices

We do NOT retain:

  • Raw AI request/response logs beyond what is needed for billing and abuse review
  • Training data derived from your content

6.4 AI Accuracy and Limitations

AI-generated content can be wrong. Review it before you rely on it for training, safety, or compliance. See our Terms of Service.

7. Data Security

7.1 Security Measures

Technical safeguards:

  • Encryption in transit (HTTPS/TLS)
  • Database access controls and tenant isolation
  • Passkey (WebAuthn) sign-in
  • Session cookies scoped to our domain

Operational safeguards:

  • Limited access to user data
  • Incident response procedures
  • Backups

7.2 Your Responsibility

You are responsible for:

  • Protecting the device that holds your passkey
  • Not sharing your signed-in session
  • Logging out of shared devices
  • Reporting security concerns immediately

7.3 Data Breaches

If a breach occurs, we will notify affected users as soon as we reasonably can, describe what happened, and follow applicable notification laws.

8. Your Rights and Choices

8.1 Access and Portability

You have the right to:

  • Access your personal information
  • Request a copy of your data
  • Correct inaccurate information
  • Update your name and email in Account

How to Exercise: Use Account, or email privacy@workkits360.com.

8.2 Deletion

Staff: Use Delete account on Account. That turns off your login immediately and removes your passkeys. Company playbooks, kits, tasks, catalog items, and completed work stay with the company. Your name may remain on the company roster as a deactivated person so managers can see who left.

Company owners: You cannot delete the owner login from the staff Account. Transfer ownership first, or contact us.

How to Exercise: Account → Delete account, or email privacy@workkits360.com.

8.3 Opt-Out Rights

You can:

  • Opt out of marketing emails
  • Choose not to use Search or AI-assisted features your company enables

California Residents (CCPA): We do not sell your personal information. You may request to know what we collect and to delete personal information we hold about you, subject to the company-content rules above.

8.4 GDPR Rights (European Users)

If you are in the EEA, you may request access, correction, erasure, restriction, portability, and objection, and you may withdraw consent where processing is based on consent.

We respect these rights and will work with you to honor them. Contact privacy@workkits360.com.

9. Data Retention and Deletion

9.1 How Long We Keep Your Data

Active accounts: We keep data while the account and company are active.

Deleted / deactivated staff:

  • Login is turned off immediately
  • Passkeys are removed immediately
  • Personal profile fields we no longer need are deleted within 30 days
  • Wellbeing reflections are deleted or isolated so the company cannot read them
  • Company content and work history stay with the company

Photo evidence:

  • Kept with the company's kit history until the company deletes it or the company account ends

Backups:

  • Deleted data may remain in backups for up to 90 days
  • Backups are not used for normal operations

9.2 Legal Retention

We may keep billing and invoice records for up to seven (7) years for tax and accounting. Security logs may be kept longer when needed for fraud prevention or legal compliance.

10. Children's Privacy

WorkKits360 is not intended for children under 13. We do not knowingly collect personal information from children under 13.

If you believe we have, contact privacy@workkits360.com and we will delete it.

For users 13–17: Get permission from a parent or guardian before using WorkKits360.

11. International Users

11.1 Data Transfers

WorkKits360 is operated from the United States. If you are outside the United States, your information may be transferred to, stored in, and processed in the United States.

11.2 International Compliance

We work to honor GDPR, CCPA, and other applicable privacy laws. WorkKits360 is currently optimized for U.S.-based customers.

12. You're in Control

You remain in control of your personal information. Staff can update their profile and delete their login from Account. Company content is controlled by the company.

13. Changes to This Policy

If we make material changes, we will:

  • Notify you by email if you have an account
  • Post a notice on our website
  • Update the "Last Updated" date

Continued use after changes are posted means you accept the updated policy.

14. Contact Us

Email: privacy@workkits360.com

Mailing Address: WorkKits360 1301 Wright St Reno, NV 89509 USA

Response Time: We aim to respond to privacy inquiries within 30 days.

Summary

What we collect: Account details, passkeys, company content, camera evidence, Search questions, usage data, and invoice records.

Why: To run WorkKits360, keep it secure, and bill companies by invoice.

How we protect it: Passkeys, encryption in transit, access controls, and tenant isolation.

Your rights: Access, correction, deletion of your login, portability, and opt-out (varies by jurisdiction).

Wellbeing: Private to you. Your employer sees status, not reflections.

AI: Cloud Search and drafting use OpenAI. OpenAI does not train on your data through our API.

We do NOT sell your data.

Thank you for trusting WorkKits360 with your information.