Last updated 2026-10-16
Privacy Policy
This policy explains what WorkGraph AI LLC (“WorkGraph AI”, “we”) collects through this website and our platform, why, who processes it for us, and what you can ask us to do with it. We work with businesses. We don't sell personal information.
We work with US teams only for now. We don't take personal data about people in the European Union, the United Kingdom or other countries outside the United States into the platform, and we don't transfer personal data out of the United States.
What we collect
- When you book a call (/book): your name, work email, company, and anything you write in the note. We use them to create a Teams invite on our Microsoft 365 calendar and send it to you. Our own records of a booking keep the time and the button you came from, not your details.
- When you take the free diagnostic (/maturity): your answers, saved on your device as you go. When you finish, we save the answers and your scores to our database with your browser type, the page that sent you, and how long it took, even if you leave the contact step blank. The name, work email and company are optional. If you ask for your results by email, we send them through Microsoft 365, and the email tells us when it is opened and which links you click.
- When you email us: what you send.
- When you browse: nothing, unless you accept analytics. If you accept, Google Analytics 4 receives the pages you view and a few named events, and we keep a copy of the same events in our own database. See the Cookie Policy.
- When you sign in to the platform: your account details, and a session cookie that keeps you signed in.
- Client engagement data: when a company hires us, it gives us workforce data for the engagement, such as job descriptions, roles, reporting lines and interview responses. We process that data on the client's behalf under our agreement with it, and the agreement governs it. Questions about that data are best sent to the company first.
How we use it
- To reply to you, book the call you asked for, and send the results you asked for.
- To run an engagement for a client, under its agreement with us.
- To understand how the site is used, only if you accept analytics.
- To keep the site and platform secure, for example by limiting how often the booking form can be sent.
The diagnostic describes an organization, not a person. We don't use anything we collect to score, rank or make decisions about individual employees.
Who processes it for us
These providers process personal data for us, each for the purpose listed and nothing else. A provider only receives data when the feature that uses it is in use. Your data stays yours. We never mix it with another client's, and the AI models we use don't learn from it: the AI providers' commercial API terms say they don't train on what we send.
| Provider | What it does for us | Where |
|---|---|---|
| Vercel | Hosts the website and the platform. | United States and Vercel's global network |
| Neon | Our database: diagnostic submissions, our own analytics events, and client platform data. | United States |
| Microsoft 365 (Microsoft Graph) | Our calendar and email: booking invites and the diagnostic results email. | United States |
| Upstash | Rate limits on the booking form. It holds keyed hashes, never an address or IP. | United States |
| Google Analytics 4 | Site analytics, only after you accept. | United States and Google's network |
| Mux | Plays the full film, once it is published. The teaser is served from our own site. | Mux's network |
| Anthropic (Claude) | Text analysis and generation in the platform: interview transcripts, job descriptions, names and reporting lines a client supplies. | United States |
| OpenAI | Text embeddings for search across a client's engagement material. | United States |
| Google Cloud Speech-to-Text | Live dictation during interviews, where a client turns it on. We keep the transcript, not the audio. | United States |
| HeyGen | Avatar videos for learning content. It receives lesson scripts only, no client personal data. | Not stated by the provider |
We may also disclose personal data when the law requires it, to protect people or our rights, or as part of a merger or sale under confidentiality terms.
How long we keep it
We keep personal data while we need it for the reasons above. We delete your data on request: a person on our team deletes it. Nothing expires on its own yet. Client engagement data is returned or deleted at the end of an engagement, as the client's agreement says. Google Analytics data follows the retention setting in our Google Analytics account.
Your choices and rights
You can ask us what we hold about you, to correct it, or to delete it, by emailing hello@workgraphai.com. We may need to confirm it is you first. You can also use an authorized agent. We won't treat you differently for asking. California and other US state privacy laws give residents these rights; we extend them to everyone.
We don't sell personal information or share it for cross-context advertising. Declining analytics, in the banner or through “Cookie settings” at the foot of any page, is also the do-not-sell or share opt-out, and we treat a Global Privacy Control signal from your browser the same way.
Security
Data is encrypted in transit. Each client's data is kept separate from every other client's, and access is limited by role. No system is perfectly secure, so we can't promise that nothing will ever go wrong.
Children
The site and platform are for businesses and are not meant for anyone under 16. If you think a child has sent us personal data, tell us and we will delete it.
Changes
When we change this policy, we update the date at the top of this page. If a change is material, we will say so on the site.
WorkGraph AI LLC, 2026 Parsons Ridge Cir, Duluth, GA 30097, USA. Privacy questions: hello@workgraphai.com. See also our Terms of Service and Cookie Policy.