Privacy Policy

Last updated September 1, 2026. Back to Vorklee

1. Overview

Vorklee provides B2B workforce and business software (tasks, CRM, ERP, payroll, documents, and related services). This policy describes how we process personal data when you use vorklee.com and our applications.

We do not knowingly collect data from children under 16. Our services are intended for organizations and their authorized users.

2. Data we process

Identity and account data (name, email, phone, avatar) via our authentication provider.

Organization membership, employee records, CRM contacts, ERP parties, tasks, documents, and payroll data entered by your organization.

Operational telemetry: scrubbed product analytics, error monitoring (no raw secrets), and audit logs for platform administration.

3. Lawful basis (GDPR / UK GDPR)

Contract — to provide the service your organization subscribed to.

Legitimate interests — security monitoring, fraud prevention, and product improvement using scrubbed analytics.

Legal obligation — where payroll or tax records require retention under applicable law (customer responsibility for local rules).

4. California (CCPA/CPRA) and India (DPDP Act)

California residents: we do not sell personal information. You may request access or deletion through your organization administrator or by contacting privacy@vorklee.com.

India DPDP: we process data as a data processor for business customers. Your organization is the data fiduciary for employee and customer records it uploads. Contact your org admin for grievances; platform inquiries go to privacy@vorklee.com.

5. Your rights

Organization administrators can export or erase a person's records from VHome People → Privacy & DSAR (subject to legal hold).

Organization owners can request a full organization export. End-user self-service portals are planned; contact privacy@vorklee.com until they ship.

6. Retention

Soft-deleted records remain in recycle bin for 30 days unless legal hold applies.

Admin audit logs are retained for 365 days. Product analytics events expire after 31 days.

7. International transfers

Data may be processed in the United States and other regions where our subprocessors operate. We rely on vendor DPAs and standard contractual clauses where required.

See our Subprocessors page for the current vendor list.

8. Contact

Privacy inquiries: privacy@vorklee.com

Security reports: security@vorklee.com

Privacy Policy | Vorklee