Privacy Policy

workro desk is operated by Infinity Automated Solutions Pvt. Ltd. (“we”, “us”). This policy explains how we handle personal data under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”).

Two roles apply. For the data you and your team enter into your workspace (tickets, assets, vendors and similar records), your organization is the Data Fiduciary and we act as a Data Processor handling that data on your instructions. For your account details (name, work email, organization name) and billing, we are the Data Fiduciary.

What we collect

• Account information you provide (name, work email, organization name).
• Workspace data you enter (tickets and their descriptions and attachments, assets, vendors, and similar records).
• Details a person includes when they submit a request through your public portal (their name, email, and what they write).
• Usage telemetry (login times, feature usage) to operate and secure the Service.

How we use it

• To deliver the Service to you and your workspace.
• To send transactional emails (verification, password reset, invitations, ticket receipts).
• To respond to your support requests.
• We do not sell your data, and we do not use it to train our own AI models. Some optional, admin-triggered features send text to the AI processors listed under “Where your data is processed” to produce a result for you.

Legal basis

We process personal data on the basis of your consent — given when you create an account or submit a request — and, where applicable, the legitimate uses permitted under Section 7 of the DPDP Act, including data you provide voluntarily and data processed by your organization for employment purposes. You can withdraw consent at any time (see Your rights).

Where your data is processed

Your data is hosted in India (Mumbai region). We rely on a small number of processors to run the Service:

• Supabase — database, file storage, and authentication, hosted in the India region.
• ZeptoMail — delivery of transactional email.
• Anthropic (Claude) — used only in back-office asset import, to structure spreadsheet data an Owner/Admin uploads. Admin-triggered, processed outside India; powers no customer-facing feature.
• Xiaomi MiMo — powers the optional AI assist available to Owners/Admins on the Pro plan: ticket summary, suggested fixes, ticket triage, and AI knowledge-base answers. When an admin runs one of these, the relevant ticket text and linked asset details are sent to the MiMo API and processed on infrastructure in China. These features are admin-triggered only and are never used on the public submission or tracking pages. Review Xiaomi’s MiMo platform terms for how it handles data sent to its API.

Storage and security

Data is stored on Supabase infrastructure (Postgres + Storage) in India and encrypted in transit. Row-level security isolates each workspace from every other workspace on the platform, and access is limited to authorized Owner and Admin accounts.

Data retention

We keep personal data for as long as your workspace is active and the purpose it was collected for is still being served. When you delete your workspace, or when that purpose is complete, we erase the associated personal data — including attachments — unless we are required to retain certain records by law. You can request erasure at any time.

Your rights

As a Data Principal under the DPDP Act, you can:

• Access a summary of the personal data we hold about you and how it is processed.
• Correct, complete, or update your personal data.
• Erase your personal data, including export or deletion of your workspace.
• Nominate another person to exercise these rights on your behalf in the event of death or incapacity.
• Withdraw consent at any time — as easily as it was given.

To exercise any of these, email support@workro.in. We will respond within 30 days. Workspace owners can also erase an individual requester's data, or delete the entire workspace, from Settings → Danger zone.

Grievance Officer

For any privacy question, request, or complaint, contact our Grievance Officer at support@workro.in. We aim to respond within 30 days.

Complaints

If you are not satisfied with how we handle your request, you have the right to complain to the Data Protection Board of India.

Sensitive information

Please do not enter sensitive personal information — or any personal data of children — into free-text fields or attachments unless it is necessary for the request. If your workspace operates in a school, healthcare, or similar setting, your organization is responsible for obtaining any consents required before such data is entered.