Privacy Policy

This Privacy Policy applies to the Workinno service, operated by MINOTOR FINANSAL YAZILIM TEKNOLOJILERI A.S. (Tax No: 6211127647, MERSIS: 0621112764700001, Cinarli Mh. 1572 Sk. No:33, Konak / Izmir 35170, Turkey). The company acts as data controller under both Turkish KVKK and EU GDPR. Contact: [email protected] or [email protected].

Users in the European Union: you may send all requests and complaints about your data directly to Workinno at [email protected]. Your request is answered within thirty days at the latest. You also always retain the right to lodge a complaint with the data protection authority of your member state.

When you use Workinno, the following data is processed:

• Account data: name, email, phone, profile photo, workspace information.
• Usage data: login records, IP address, browser information, pages visited, features used (analytics, kept separate from personal identity).
• Content data: tasks, customers, projects, notes, files, messages — anything you upload or create on the platform; owned by you or your workspace.
• Third-party connection data: phone numbers, email addresses, message content, and media files from accounts you connect (WhatsApp, Instagram, Messenger, Telegram, Gmail, Outlook, etc.).
• Billing data: plan, payment method (via Stripe — card details are not stored on Workinno servers), invoice information.

Your personal data is processed for:

• Service delivery and account management (KVKK Art. 5/2-c: performance of contract; GDPR Art. 6/1/b).
• Billing and legal obligations (KVKK Art. 5/2-ç; GDPR Art. 6/1/c).
• Security, fraud prevention, audit (KVKK Art. 5/2-f: legitimate interest; GDPR Art. 6/1/f).
• Support and communication (performance of contract).
• Service improvement, analytics, product development (legitimate interest; analytics kept separate from personal identity).
• Marketing communication only with your explicit consent (KVKK Art. 5/1; GDPR Art. 6/1/a) — you can opt out anytime.

For service delivery, we work with the following sub-processors:

• Stripe, Inc. (USA) — payment processing and subscription billing. Card details are not stored on Workinno servers; transmitted directly to Stripe.
• Resend, Inc. (USA) — service notifications and transactional email delivery.
• Cloudflare, Inc. (USA) — CDN, DNS, security (WAF), DDoS protection.
• Hetzner Online GmbH (Germany) — database, application server and file storage infrastructure (the files you upload are stored here).
• Sentry (Functional Software, Inc.) (US company; data processed in the EU region) — browser-side error reporting. Only technical information is sent (error message, page URL, browser version); personal data transmission and session replay are disabled.
• Anthropic, PBC (USA) — AI assistant (Inno) — only your question and relevant context are sent; not used for training.
• OpenAI, L.L.C. (USA) — assistant voice channel (Realtime API) — voice transmitted only during conversation.
• Mapbox, Inc. (USA) — map display (addresses module).
• MaxMind, Inc. (USA) — IP geolocation (GeoLite2).
• Meta Platforms, Inc. (USA) — applies only if your workspace connects a WhatsApp Business / Messenger / Instagram channel. Inbound and outbound messages, phone numbers, email addresses, and media files from these channels are processed via Meta's WhatsApp Business Platform / Messenger Platform / Instagram Graph API. Meta processes this data under its own privacy policy.
• Google LLC / Microsoft Corporation (USA) — applies only if your workspace connects a Gmail / Outlook account; email content is processed via Google / Microsoft APIs.

The list is published on this page when updated.

When you connect a Google Drive account to your workspace, Workinno accesses your Google Drive data only in a limited way (the drive.file scope):

• We can access only the files you explicitly select through the Google Picker or that you create through Workinno.
• We cannot see, list, or scan any other files in your Drive.

We use this access solely to:

• Attach a file you selected to your workspace and show its preview and link,
• Save a file you create in Workinno to Google Drive,
• Update or remove those files at your request.

We do not use your Google Drive data for advertising, do not sell it to third parties, and do not allow humans to read it (except where required by law, for security/abuse review, or with your explicit consent). You can disconnect the integration at any time from the application settings; doing so deletes the stored access tokens.

Workinno's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your personal data is retained for the following periods:

• Active account data: for as long as your account is open.
• Account deletion: after you confirm the request by email, a 30-day waiting period applies during which you can cancel it. When it expires, your account is anonymised.
• Records you delete: kept in the trash for 30 days, then permanently deleted.
• Content in your workspace: you set the retention period. If you have not set one for channel messages, those messages are not deleted.
• Billing records: for the period required by tax legislation; kept for that purpose even if your account is closed.
• Change history (who changed what and when): 2 years.
• Security records (failed sign-in, account lockout, unauthorised access attempt): 2 years. Administrator action log: 3 years.
• Sent email records: 90 days.
• Cookie consent records: 2 years.
• Expired verification and password reset links: deleted within 24 hours.
• Data export packages you request: deleted after 7 days.
• Marketing preference records: until you withdraw your consent.

Under both KVKK Art. 11 and GDPR Art. 15–22, you have the right to:

• Learn whether your personal data is processed, and if so, request information about it.
• Access your data and obtain a copy (data portability).
• Request correction of incorrect or incomplete data.
• Request deletion under specific conditions ("right to be forgotten").
• Request restriction of or object to processing.
• Withdraw consent at any time for processing based on consent.
• Lodge a complaint (Turkey: KVKK Authority; EU: supervisory authority of your member state of residence).

Submit your request via Profile > Data & Privacy or email [email protected]. Requests are answered within 30 days.

The Workinno service is not designed for individuals under 16. We do not knowingly collect personal data from users under 16. If data belonging to someone under 16 has been transmitted to us, please notify [email protected] and we will delete it without delay.

When this policy is updated, we send a notification to your registered email address and publish the change on this page at least 30 days in advance. For significant changes, an in-app notification is also shown.