Privacy Policy

What the Workforce Intelligence connection service and documentation site do with personal data, and the choices you have.

Effective · Last updated

Who we are#

This service is operated by Workforce Intelligence, Inc. ("we", "us"). Our postal address is 1 Seneca St, Floor 24, Buffalo, NY 14203. You can reach us at privacy@workforceintelligence.ai.

What this service is#

This policy covers two things we run:

  • The connection service. A customer's own Workforce Intelligence installation uses it to connect to accounts at the outside services that your organization's installation connects through this service, without registering its own application with each one. When a person chooses to connect an account, the connection service completes the sign-in step with the provider of that service and hands the result back to the installation that asked for it.
  • The documentation site. The public user and administrator guides for Workforce Intelligence.

This is not the customer's Workforce Intelligence installation. Each installation has its own operator, and that operator's own privacy policy covers the data the installation holds, including the content of connected accounts. We never receive that content.

What data passes through the connection service#

When a person connects an account, or an installation refreshes an existing connection, the following passes through the service:

  • The authorization code the provider issues after the person approves access.
  • The access token and refresh token the provider issues in exchange for that code, and the new tokens issued when a connection is refreshed.
  • The web address of the installation that started the connection, so we can send the person back to it.
  • The provider's name and the permissions (scopes) requested.
  • A connection-attempt identifier and a one-way fingerprint created by the installation, which let the installation prove the result is meant for it.

We use this data only to complete the connection or refresh that the person's installation asked for.

What we do not do#

  • We do not keep access tokens or refresh tokens. The only place a token is held, even briefly, is a sealed, encrypted hand-off record. It is accepted for at most 5 minutes and is deleted the first time the installation collects it. A refresh stores nothing at all.
  • We do not read the content of connected accounts. We never call a provider's data interfaces such as mail, files, calendars or messages. The only provider calls we make are the sign-in token exchange and the token refresh.
  • We do not sell or share this data.
  • We do not use it for advertising.
  • We do not use it to create, train or improve any machine learning or artificial intelligence model.

Operational logs#

We keep operational logs to run and protect the service. A log line contains the request path, request method, response status, how long the request took, the provider's name, the outcome of the step and a stable error code or error type. Logs never contain tokens, authorization codes, client secrets, handoff identifiers or query strings. The connection routes are also excluded from request tracing. Logs are kept for one month and then deleted.

Network metadata#

Our cloud hosting provider and its web firewall process the IP address and request details of every request in order to deliver the service and block abuse. We have not turned on load balancer access logs or web firewall request logging. The web firewall retains a small sample of recent requests, including source address and headers, for three hours, and records request counts as aggregate metrics.

The documentation site#

The documentation site is static. It sets no cookies, includes no analytics or advertising, and loads nothing from third parties. If you choose a light or dark theme, that choice is stored in your own browser's local storage and is never sent to us. Search runs in your browser against an index served by the site.

  • To provide the connection service a customer's installation requested. The bases are performance of our agreement with the customer and the legitimate interest of the person connecting their own account.
  • To keep the service secure, prevent abuse and fix faults. The basis is our legitimate interest in running a secure and reliable service.
  • To meet legal obligations, where the law requires it.

We do not use consent as a basis, because we do not collect data for purposes that need it.

Retention#

Data How long it exists
Pending connection attempt record (no personal data, an unguessable identifier only) Rejected after 10 minutes; removed when the provider returns the person
Sealed hand-off record holding the result Rejected after 5 minutes; deleted on the first collection attempt
Tokens during a refresh Held in memory for the request only; never stored
Operational logs One month
Web firewall request samples Three hours

Expired records are rejected as soon as they expire. Our database then removes them physically; Amazon Web Services documents that it deletes expired items "typically within a few days after their expiration". Until a record is removed it remains encrypted. The table has no backups.

Who receives data#

  • Our hosting provider, Amazon Web Services, which hosts the service, its database, its secrets store and its web firewall.
  • The outside service the person chooses, whose provider receives the sign-in exchange and refresh requests necessary to issue tokens.
  • The installation that started the connection, which receives the tokens in the final step.

We do not sell personal data or share it with anyone else, except where the law requires it.

International transfers#

The service is hosted on Amazon Web Services in the United States, and data is processed only there. If you are outside the United States, your information is transferred to and processed in the United States when you use the service.

Security#

The hand-off records are encrypted, connections use HTTPS only, and requests are validated. Data handling and security describes each measure.

Your rights#

Depending on where you live, you can ask us to give you access to your personal data, correct it, delete it, restrict or object to our processing of it, or provide it in a portable form. You can also complain to your local data protection authority.

Because we do not store tokens beyond the short hand-off window, most requests are answered by confirming that we hold no personal data about you beyond operational logs and network metadata kept for the periods above. To make a request, write to privacy@workforceintelligence.ai. To remove an installation's access to your account, see the section on revoking access in Data handling and security.

Google user data#

If you connect a Google account through this service, the following applies to information received from Google.

The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

The use and transfer by Workforce Intelligence, Inc. to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements, and to the Google Workspace API User Data and Developer Policy.

What Google data we access. We access only what Google returns when the person approves the sign-in: an authorization code, and the access token and refresh token issued for it. The permissions (scopes) requested are chosen by the customer's installation when it starts the connection, and the service accepts only scopes from the list it supports for that provider; the person sees them on Google's consent screen before approving. We do not use those tokens to call Google APIs. We never read the content of the account, such as mail, files or calendars, and we take no actions on the person's behalf.

How we use it. We use Google user data only to provide the connection a customer's installation asked for: completing the sign-in, delivering the resulting tokens to that installation, and refreshing those tokens when the installation asks. This is a user-facing feature of the installation the person chose to connect.

How we store it. We do not store Google user data beyond the sealed, encrypted hand-off record described above, which is accepted for at most 5 minutes and deleted the first time the installation collects it. A refresh stores nothing. Tokens are encrypted in transit over HTTPS and at rest while held in the hand-off record.

How we share it. We do not transfer Google user data to others, except to the installation that started the connection, as necessary for security or abuse investigation, or to comply with law. We do not sell it, and we do not transfer it to advertising platforms, data brokers or information resellers.

Humans and models. We do not allow humans to read Google user data. Tokens are sealed and we do not open them for review. We do not use Google user data for advertising, and we do not use it to create, train or improve any machine learning or artificial intelligence model.

Retention and deletion. Google user data exists in this service only for the periods in the retention table above. Because nothing is kept beyond them, there is nothing further to delete; to remove an installation's access to your Google account, revoke it in your Google Account permissions, as described in the section on revoking access in Data handling and security. You can also write to privacy@workforceintelligence.ai with any request.

Data from other outside services#

For any other outside service an installation connects through this service, we use data from the person's account only to provide the connection the customer asked for, under the same limits as for Google: it passes through the service during connecting and refreshing, we do not read the content of the account, we do not store tokens beyond the sealed hand-off record, and we do not sell, share, advertise with or train models on it.

Children#

The service is not directed to children under 16, and we do not knowingly collect personal data from them.

Changes to this policy#

When we change this policy we update the "Last updated" date above. If a change affects how we use data the service already handles, we publish it before it takes effect and change the "Effective" date.

Contact#

Workforce Intelligence, Inc.
1 Seneca St, Floor 24, Buffalo, NY 14203
privacy@workforceintelligence.ai