Privacy Policy

Worksum is job-management software operated by Pixrweb (“Worksum”, “we”, “us”). We are the data controller for the account and marketing data described below, and a data processor for the business data you enter into the platform. For anything in this policy you can contact us at privacy@worksum.co.uk.

Account data: your name, work email, company name, and the hashed password used to create and secure your account.

Business data you enter: clients, sites, jobs, quotes, invoices, certificates, timesheets, and the people and vehicles you manage. This may include personal data about your own staff and customers. You control this data; we process it on your behalf to provide the service.

Usage & technical data: log data, device/browser information and, where the field app is used, approximate or precise location captured when an engineer starts/stops work — used for job costing and site verification.

Billing data: handled by our payment processor. We store your plan and subscription status, not your full card details.

We process personal data to provide and secure the service (performance of our contract with you), to bill for it (contract / legitimate interests), to comply with legal and tax obligations, and — only where you have opted in — to send product updates (consent). Our legitimate interests include keeping the service secure, preventing abuse and improving the product. We do not sell your data, and we do not use your business data to train AI models.

We use a small set of sub-processors to run Worksum. Data is shared only as needed to deliver the features you switch on:

• Hosting & database — to run the application and store your data.
• Stripe / GoCardless — to run Worksum subscriptions, and (if you connect your own Stripe or GoCardless account) to take card payments and Direct Debits on your invoices, which are paid directly to you.
• Xero / QuickBooks — only if you connect them: invoices and contacts you choose to sync are sent to your own accounting account.
• Microsoft 365 — only if you connect it: calendar events and Teams links are created in your own Microsoft account, and we read free/busy to flag clashes.
• Email / SMS providers — to send the notifications and reminders you enable.

Connecting an integration is always your choice, and you can disconnect it at any time from the Integrations screen. When you connect one via OAuth, you authorise it in that provider’s own login screen — we never see your password for it.

Where a sub-processor stores or processes data outside the UK/EEA, we rely on an adequacy decision or appropriate safeguards (such as the UK International Data Transfer Agreement / Standard Contractual Clauses).

We keep your account and business data for as long as your account is active. After you close your account we retain it for a short wind-down period so you can export it, then delete or anonymise it, except where we must keep certain records (e.g. invoices) to meet legal and tax obligations.

Under UK GDPR you have the right to access, correct, delete, restrict or object to our processing of your personal data, and to data portability. Worksum gives you a one-click full export of your data at any time, and you can ask us to delete your account. To exercise any right, email privacy@worksum.co.uk. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

Passwords are stored hashed, sessions are signed, and access to your data is scoped to your organisation. We use encryption in transit and apply the security practices appropriate to a system holding business records. No system is perfectly secure, but we work to protect your data and to notify you promptly of any breach that affects you.

We use a small number of strictly-necessary cookies to keep you signed in and secure. We do not use advertising or cross-site tracking cookies.

We may update this policy as the product evolves. We’ll change the “last updated” date above and, for material changes, let you know in the app or by email.