Privacy Policy

1. Who this is about

Workaholic Connect is operated by Workaholic Developers ("Workaholic", "we", "us"), a software company with engineering teams in India and client operations in Canada. We build and run business systems for our clients.

This policy covers Workaholic Connect only — the service at connect.workaholicdevelopers.com that links the accounts you already own to the systems we build for you. Our main website has its own separate privacy policy covering ordinary visitors.

2. What Connect actually does

You already use tools like Google Workspace, Microsoft 365 or Dropbox. The systems we build for you often need to work alongside those tools — putting a confirmed booking on your calendar, saving a report where your team can find it, sending a confirmation from your own address.

Rather than asking you for passwords, or asking again for every separate system we build, Connect uses the industry-standard authorisation process offered by each provider. You approve a specific, listed set of permissions directly with Google, Microsoft or Dropbox. They give us a revocable token. We never see or hold your password.

3. What we access, and why

You are shown the exact list at the moment you connect, and you can review it at any time in your provider's own security settings. Nothing below is requested unless the feature you have asked for requires it.

Google

Permission	What it lets us do
openid, email, profile	Identify which account has been connected, and show your name against it.
calendar.events	Create and update the appointments your system books. We do not read or alter events we did not create.
calendar.readonly	Check availability before offering a time, so you are not double-booked.
drive.file	Save files we generate for you, and open files you explicitly choose. This permission cannot see the rest of your Drive.
spreadsheets, documents	Write the exports, reports and documents you have asked the system to produce.
contacts.readonly	Import your contacts into your own system, when you ask for that import.
tasks	Keep task lists in step between your system and Google Tasks.
youtube.upload	Publish video to channels you own, when you have asked us to manage them.

Microsoft

Permission	What it lets us do
User.Read	Identify the connected account.
Calendars.ReadWrite	Check availability and place confirmed bookings.
Files.ReadWrite	Save generated reports and exports to OneDrive or SharePoint.
Mail.Send	Send the messages your system generates — confirmations, receipts, notices — from your own address.
Contacts.ReadWrite	Keep contact records in step with your system.
offline_access	Continue working without asking you to sign in again every hour.

Dropbox

Permission	What it lets us do
account_info.read	Identify the connected account.
files.metadata.read	List file names and folders so you can choose where things are saved.
files.content.read	Open files you have explicitly pointed us at.
files.content.write	Save the reports and exports we generate for you.
sharing.write	Create share links for deliverables, when you ask for one.

4. What we store

We keep the minimum needed to keep the connection working:

• An encrypted access token issued by the provider. This is what lets us act on your behalf. It is encrypted at rest and never displayed.
• Which account is connected — the email address, display name, and which provider it belongs to.
• Which permissions you granted, and when.
• A record of actions taken — for example "created a calendar event at 09:14" — so you and we can see what the system did.

Equally important is what we do not keep:

• We do not store your password. We never receive it.
• We do not copy your mailbox, your Drive, or your contact list into our systems for our own purposes.
• We do not retain the contents of files or messages beyond what is needed to complete the specific action you asked for.

5. How we use it

We use this access for one purpose: to perform the actions the systems you have commissioned are meant to perform. Nothing else.

Specifically, and without exception:

• We do not sell your data, and we never will.
• We do not use it for advertising, profiling, or building marketing audiences.
• We do not use it to train artificial intelligence or machine learning models.
• We do not read your data out of curiosity. Staff access is limited to the people supporting your account, and it is logged.

6. Google API Services User Data Policy

Workaholic Connect's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

In plain terms: data obtained through Google APIs is used only to provide or improve the features you have asked for, is not transferred to others except as required to provide those features or by law, is not used for advertising, and is not read by humans except with your explicit permission, for security purposes, to comply with the law, or where the data has been aggregated and anonymised.

7. Who else sees it

No third party receives your connected-account data. We do not share it with advertisers, data brokers, or analytics companies.

The only exceptions are the ordinary, necessary ones:

• The provider itself. Sending a message through Microsoft necessarily involves Microsoft.
• Our own infrastructure. Connect runs on servers we control at our hosting provider. Your data is not handed to a third-party processor for its own use.
• Where the law requires it, and where we are permitted to tell you, we will tell you.

8. How long we keep it

For as long as the connection is active, and no longer. When you disconnect an account, the stored token is deleted and we instruct the provider to revoke it. Operational logs recording that an action took place — without the content of that action — may be retained for a reasonable period for security and accounting.

9. Removing access

You are never locked in. You can withdraw access at any time, two ways:

1. Through us. Use the disconnect option in your system, or write to us and we will do it. This deletes the stored token and revokes it at the provider.
2. Directly with the provider. You can revoke us from Google Account permissions, Microsoft My Apps, or your Dropbox connected-apps settings — without asking us first. We think that is how it should be.

Revoking access stops any feature that depended on it. Nothing else about your systems is affected.

10. Keeping it safe

Tokens are encrypted at rest, all traffic runs over TLS, and access is restricted and logged. Our Security page sets out precisely what we do — and is deliberately limited to measures actually in place.

11. Your rights

Depending on where you are, you may have rights under laws such as India's Digital Personal Data Protection Act, Canadian privacy legislation, or the GDPR. Regardless of which applies to you, we will honour a request to:

• be told what connected-account data we hold;
• have it corrected;
• have it deleted, and the connection revoked;
• receive a copy in a portable format;
• object to a particular use.

Write to info@workaholicdevelopers.com. We aim to respond within 30 days and will tell you promptly if a request will take longer.

12. Where your data goes

Workaholic has teams in India and Canada, and our infrastructure is located with our hosting provider. Your data may therefore be processed in more than one country. Wherever it is handled, the protections in this policy apply.

13. Children

Connect is a business service and is not directed at children. We do not knowingly create connections for anyone under 18.

14. Changes to this policy

If we change what we access or what we do with it, we will update this page and change the date above. Where a change materially affects you, we will tell you directly rather than relying on you to notice.

15. Contact

Questions about this policy, or about anything Connect has done on your behalf, go to info@workaholicdevelopers.com. A person reads that address.