Privacy policy
Your data, in plain terms.
How Outwerk collects, uses and protects personal data for site visitors, prospects, clients and their staff.
1. Who we are
Outwerk designs, builds and runs software and AI systems that do operational work inside growing companies. This policy explains how we handle personal data when you visit outwerk.ai, fill in a form, book a call, chat with us, receive email from us, or work for a company that is our client.
The controller for the personal data described in this policy is Vivek Yogesh Doshi, trading as Outwerk, Mumbai, Maharashtra, India ("Outwerk", "we", "us"). Once Outwerk's company is incorporated in India it will become the controller, and this policy will be updated to name it.
Contact for privacy matters: hello@outwerk.ai, or by post to the address above, marked "Privacy".
This policy applies to:
- visitors to outwerk.ai
- prospects who fill in the busywork audit form, book a call or chat with us
- clients and the staff of clients who work with us during an engagement
- people whose business contact details we receive from clients or public sources
It does not cover the end customers, patients, members or employees of our clients whose data sits inside the systems we build and run for those clients. We act as a processor for that data. Section 12 explains what that means.
2. The short version
- We collect business contact details and a description of your operations when you ask for an audit or book a call. We use them to run the audit and, if you proceed, to deliver the engagement.
- Our analytics tool (Plausible) does not use cookies and does not track you across sites.
- The chat widget and advertising pixels load only if you accept them in the consent banner.
- We do not sell personal data and we do not share it for cross-context behavioral advertising.
- Data is stored mainly in the United States and the European Union by our providers, and accessed from India where our team works. We use standard contractual clauses and the UK addendum for EU and UK data.
- You can ask us what we hold about you, correct it, delete it, or object to our use of it. Section 9 lists your rights by region and section 10 explains how to exercise them.
3. What we collect and where it comes from
3.1 Data you give us
Busywork audit form. Name, work email, company name, company website, what eats the week (a free-text description of the operational work you want to remove), team size and budget range. The form is hosted by Netlify Forms and the submission is emailed to our Google Workspace inbox. Please do not put personal details about other people, health information, financial account numbers or other sensitive data in the free-text field.
Call booking. When you book a call through the embedded Cal.com scheduler we receive your name, email, chosen time, time zone, any notes you add and, if you connect it, a calendar invitation. Cal.com also records technical data about your booking session under its own privacy policy.
Chat. If you accept the functional cookies category in our consent banner, the Crisp chat widget loads. Crisp collects the messages you send, your name and email if you give them, your approximate location derived from IP address, browser and device type, and the pages you viewed during the chat session.
Email and calls. When you email hello@outwerk.ai, reply to our messages or speak with us, we keep the correspondence and our notes.
Client engagement data. If your company becomes a client, we collect the names, roles, work emails, phone numbers and system credentials or access grants of the people we work with, plus the content of meetings, messages and documents exchanged during the engagement.
3.2 Data collected automatically
Analytics. We use Plausible Analytics, hosted in the European Union. Plausible does not use cookies, does not store IP addresses, and does not create a persistent identifier for you. It records aggregate page views, referrers, country, browser and device type using a daily-rotating hash that cannot be reversed to identify you. No consent banner is required for this and you cannot be identified from it.
Server logs. Our hosting provider, Netlify, keeps web server logs that include IP address, request time, requested page, referrer and user agent. We use them for security, debugging and abuse prevention.
Advertising pixels. Only if you accept the marketing category in our consent banner, we load the Google Ads tag (with Google Analytics 4 where enabled), the Meta Pixel and the LinkedIn Insight Tag. These set cookies and collect your device identifiers, pages viewed and conversion events (such as submitting the audit form) so that we can measure our advertising and show relevant advertising to you on those platforms. Google, Meta and LinkedIn also use this data for their own purposes as described in their privacy policies. Where you have not consented, we use Google Consent Mode v2 in its default denied state, which means no advertising cookies are set and no identifiable data is sent to Google.
3.3 Data from other sources
Business contacts from clients. A client may give us the details of their staff, vendors or partners so that we can set up a system or coordinate an engagement.
Public and professional sources. We may collect business contact details (name, title, company, work email, LinkedIn profile) from company websites, LinkedIn and business directories to contact people whose role suggests they would be interested in our services. We only do this for business roles and only for business-to-business communication.
Referrals. Someone may introduce you to us by sharing your business contact details.
4. What we do not collect
We do not knowingly collect special category data (health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation), criminal records data, protected health information, financial account numbers, payment card numbers or government identification numbers through the site. If you send any of these to us by mistake, we will delete them and tell you.
5. Why we use your data and our lawful bases
Where EU or UK GDPR applies, we need a lawful basis for each use. The table below shows the purpose, the data involved and the basis we rely on. Where we rely on legitimate interests, we have balanced our interests against your rights and concluded the processing is proportionate; you can ask for a copy of that assessment.
| Purpose | Data | Lawful basis (GDPR Article 6) |
|---|---|---|
| Responding to your audit request, running the audit and sending you the result | Audit form fields, booking data, correspondence | Contract (Art 6(1)(b)): taking steps at your request before entering a contract; where you act for a company, legitimate interests (Art 6(1)(f)) in responding to a business inquiry |
| Scheduling and holding calls | Booking data | Contract or legitimate interests, as above |
| Chatting with you through the widget | Chat data | Consent (Art 6(1)(a)) for loading the widget; legitimate interests in answering your questions once loaded |
| Delivering and managing a client engagement, including support, invoicing and account management | Client engagement data | Contract (Art 6(1)(b)) with the client; legitimate interests in dealing with the client's staff |
| Sending you information about our services where you have inquired or are a client | Name, work email, company, interaction history | Legitimate interests (Art 6(1)(f)) in business-to-business marketing to relevant roles; consent where required by local law (for example Germany and Canada) |
| Measuring site traffic in aggregate | Plausible analytics data (anonymous) | Legitimate interests (Art 6(1)(f)); no personal data is retained |
| Measuring and improving our advertising | Pixel data | Consent (Art 6(1)(a)) via the consent banner |
| Keeping the site secure and preventing abuse | Server logs | Legitimate interests (Art 6(1)(f)) in security and fraud prevention |
| Keeping accounting, tax and export records | Client contact and invoicing data | Legal obligation (Art 6(1)(c)) under Indian company, tax and foreign exchange law |
| Establishing, exercising or defending legal claims | Any of the above as relevant | Legitimate interests (Art 6(1)(f)) |
| Complying with lawful requests from authorities | Any of the above as relevant | Legal obligation (Art 6(1)(c)) |
We do not use your personal data to make automated decisions that have legal or similarly significant effects on you. See section 13.
6. How long we keep your data
| Data | Retention period | Reason |
|---|---|---|
| Audit form submissions and booking data (no engagement follows) | 24 months from your last interaction with us, then deleted | Enough time to follow up on a business conversation that may take time to mature |
| Audit form submissions and booking data (engagement follows) | Duration of the client relationship plus 8 years | Contract and accounting records |
| Chat transcripts | 12 months from the chat, then deleted from Crisp | Service quality and continuity |
| Email correspondence with prospects | 24 months from last contact | As above |
| Email correspondence with clients | Duration of the client relationship plus 8 years | Contract and accounting records; Indian Companies Act and tax law |
| Client engagement data (contacts, credentials, documents) | Duration of the engagement; credentials revoked within 7 days of termination; documents returned or deleted within 30 days of termination unless the client asks us to keep them or law requires it | Exit obligations under the services agreement |
| Invoices, payment records, FIRC/FIRA documents | 8 years from the end of the financial year | Indian Companies Act 2013, Income Tax Act 1961, GST law, FEMA |
| Server logs | 30 days | Security |
| Plausible analytics | Aggregate only; no personal data retained | Not applicable |
| Advertising pixel data held by Google, Meta and LinkedIn | Per their policies; our own consent record is kept for 24 months | Consent evidence |
| Consent records (banner choices) | 24 months from the choice | Evidence of consent |
| Marketing suppression list (people who opted out) | Indefinitely, as email address only | So that we do not contact you again |
When a period ends we delete the data or anonymize it so it can no longer be linked to you.
7. Who we share your data with
We do not sell personal data and we do not share it for cross-context behavioral advertising, as those terms are defined in California law. We share personal data with the following categories of recipients.
7.1 Service providers (sub-processors)
| Provider | What they do for us | Location of processing |
|---|---|---|
| Netlify, Inc. | Website hosting, content delivery, form handling and server logs | United States, with a global content delivery network |
| Google LLC (Google Workspace) | Email, calendar, documents and file storage | United States and other Google data center regions |
| Cal.com, Inc. | Call booking | United States |
| Plausible Insights OÜ | Website analytics (cookieless, anonymous) | European Union (Germany) |
| Crisp IM SAS | Chat widget (loads only with your consent) | European Union (France); verify sub-processor locations |
| OpenAI, L.L.C. | Large language model services used inside systems we build and in internal tooling | United States |
| Anthropic, PBC | Large language model services used inside systems we build and in internal tooling | United States |
| Google LLC (Google Ads, Google Analytics 4) | Advertising measurement (loads only with your consent) | United States and other regions |
| Meta Platforms, Inc. and Meta Platforms Ireland Limited | Advertising measurement (loads only with your consent) | United States and Ireland |
| LinkedIn Corporation and LinkedIn Ireland Unlimited Company | Advertising measurement (loads only with your consent) | United States and Ireland |
| The client's own software stack | When we work inside a client's systems at their instruction | Wherever the client's providers host |
We may add or replace providers. The current list is kept at outwerk.ai/dpa/ and clients receive notice of changes under the data processing addendum.
7.2 Other recipients
- Professional advisers. Lawyers, accountants, auditors and insurers, under confidentiality obligations.
- Banks and payment providers. To receive payments and comply with foreign exchange rules in India.
- Authorities. Courts, regulators, tax and law enforcement bodies where we are legally required or where disclosure is necessary to protect our rights.
- A buyer or successor. If Outwerk is reorganized, incorporated as a new entity, merged or sold, personal data may be transferred to the new entity under the same protections.
We do not share personal data with data brokers.
8. International transfers
Outwerk is based in India. Our team accesses data from India, and our providers store it mainly in the United States and the European Union.
From the EU and UK to India. India does not have an adequacy decision from the European Commission or the UK government. When we receive personal data from EU or UK clients or individuals, we rely on the European Commission's 2021 standard contractual clauses (Module 1 for controller-to-controller transfers, Module 2 for controller-to-processor transfers, Module 3 for processor-to-processor transfers) and, for UK data, the UK Information Commissioner's International Data Transfer Addendum to those clauses or the UK International Data Transfer Agreement. We have carried out a transfer impact assessment for India and apply supplementary measures including encryption in transit and at rest, access controls and a policy of challenging any government request for data that is not legally binding. For site visitors, we also rely on your consent to the chat and advertising transfers where you give it in the banner.
To the United States. Several of our providers are in the United States. Where a provider is certified under the EU-US Data Privacy Framework and its UK Extension, we may rely on that certification for EU and UK data flowing to that provider; otherwise the standard contractual clauses apply. The Data Privacy Framework was upheld by the EU General Court in September 2025 and is under appeal to the Court of Justice. We check our providers' certification status periodically and will update our transfer mechanisms if the framework changes.
From Canada. We handle Canadian personal information under contractual protections that are comparable to those required by PIPEDA, and we support Quebec clients with the documentation needed for transfers outside Quebec.
From India. Transfers of Indian personal data outside India are permitted under the DPDP Act except to countries the Indian government may restrict by notification. We will keep this policy current as the rules develop.
You can ask us for a copy of the transfer safeguards we use.
9. Your rights by region
Your rights depend on where you are. Section 10 explains how to exercise them.
9.1 European Economic Area, United Kingdom and Switzerland
Under the GDPR and UK GDPR you have the right to:
- access your personal data and receive a copy
- rectify inaccurate or incomplete data
- erase your data in certain circumstances
- restrict processing in certain circumstances
- data portability, receiving data you provided to us in a structured, commonly used, machine-readable format
- object to processing based on legitimate interests, and to direct marketing at any time
- withdraw consent at any time, without affecting processing already carried out
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects
We respond within one month, extendable by two months for complex requests with notice. You have the right to complain to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk); in France, the CNIL (cnil.fr); in Ireland, the Data Protection Commission (dataprotection.ie); or the authority in the member state where you live or work. We would appreciate the chance to resolve your concern first.
9.2 California
If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you the right to:
- know what categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we share it
- delete personal information we collected from you, subject to exceptions
- correct inaccurate personal information
- opt out of the sale or sharing of personal information
- limit the use and disclosure of sensitive personal information
- non-discrimination for exercising your rights
Notice at collection. In the preceding 12 months we have collected these categories of personal information: identifiers (name, email, IP address, company), professional information (title, company, team size), commercial information (budget range, engagement details), internet activity (pages viewed, pixel data where consented) and inferences drawn from the above for the purpose of responding to your inquiry. We use them for the purposes in section 5 and keep them for the periods in section 6.
We do not sell personal information and we do not share it for cross-context behavioral advertising. Advertising pixels load only after you opt in through the consent banner. Because of this, no "Do Not Sell or Share My Personal Information" link is required. We provide a "Your privacy choices" link in the site footer anyway, which opens the consent preferences, and we treat a Global Privacy Control signal from your browser as a request to opt out: when we detect it, the marketing category is set to rejected automatically.
Sensitive personal information. We do not collect sensitive personal information through the site and we do not use any sensitive personal information for purposes other than those permitted by Section 7027 of the CCPA regulations.
Response times. We confirm receipt of a verifiable request within 10 business days and respond within 45 calendar days, extendable once by 45 days with notice. You may use an authorized agent, who must provide written permission from you.
Outwerk may not currently meet the revenue or volume thresholds that make a company a "business" under the CCPA. We honor these rights regardless.
9.3 Canada
Under PIPEDA and comparable provincial laws you have the right to access the personal information we hold about you, to challenge its accuracy and completeness and have it amended, and to withdraw consent to its use subject to legal and contractual restrictions. We respond within 30 days. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or to your provincial commissioner.
9.4 India
Under the Digital Personal Data Protection Act 2023 and the DPDP Rules 2025, as they come into force, you have the right to access a summary of the personal data we process about you and the identities of those we have shared it with, to correct, complete, update and erase your data, to nominate a person to exercise your rights if you die or become incapacitated, and to a readily available grievance redressal mechanism. Our grievance officer is Vivek Yogesh Doshi, reachable at hello@outwerk.ai with "Grievance" in the subject line, or at Mumbai, Maharashtra, India. We respond within the period prescribed by the Rules. If you are not satisfied, you may complain to the Data Protection Board of India.
9.5 Everyone
Wherever you are, you can ask us to stop sending you marketing, ask what we hold about you and ask us to delete it. We will do so unless we have a legal reason to keep it, and we will tell you if that is the case.
10. How to exercise your rights
Email hello@outwerk.ai with "Privacy request" in the subject line, or write to Outwerk (Vivek Yogesh Doshi), Mumbai, Maharashtra, India (full postal address on request). Tell us which right you want to exercise and which region's law you are relying on if you know it.
Verification. We need to be sure a request comes from you. We will usually verify by replying to the email address we hold for you or by asking you to confirm two details we already have. We will not ask for government identification unless the request involves sensitive data or we have specific reason to doubt identity. If an authorized agent makes the request we will ask for evidence of their authority.
No fee. We do not charge for requests unless they are clearly unfounded, repetitive or excessive, in which case we may charge a reasonable fee or refuse, and we will explain why.
Marketing opt-out. Every marketing email has an unsubscribe link. You can also reply "unsubscribe" to any message. We action opt-outs within 10 business days and usually sooner.
11. EU and UK representatives
Where the GDPR or UK GDPR requires it, we will appoint a representative in the EU and the UK to act as a point of contact for individuals and supervisory authorities.
EU representative: not yet appointed. One will be appointed before we onboard clients established in the EU, where Article 27 of the GDPR requires it. UK representative: not yet appointed. One will be appointed before we onboard clients established in the UK, where Article 27 of the UK GDPR requires it.
Until an appointment is published here, contact hello@outwerk.ai.
12. When we act as a processor for our clients
The systems we build and run hold data about our clients' customers, patients, members, suppliers and staff. For that data the client is the controller (or "business" under California law) and Outwerk is the processor (or "service provider"). We process it only on the client's documented instructions, under a data processing addendum that implements GDPR Article 28, UK GDPR, the CCPA service provider requirements and PIPEDA's accountability principle.
If you are a customer or employee of one of our clients and you want to exercise your rights over data held in a system we run, please contact that client. Their privacy notice explains how. If you contact us directly we will pass your request to the client and help them respond. We do not use client end-customer data for our own purposes, we do not sell or share it, and we do not use it to train general-purpose AI models.
13. Cookies and similar technologies
Our cookie policy at outwerk.ai/cookies/ lists the cookies and scripts used on the site by category, what they do, how long they last and how to change your choices. You can reopen the consent preferences at any time from the "Cookie preferences" link in the footer.
14. Children
The site and our services are directed at businesses and are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
15. Security
We protect personal data with measures appropriate to its sensitivity and the risk, including: encryption in transit (TLS 1.2 or higher) and at rest with our providers; multi-factor authentication on every account that holds client or prospect data; least-privilege access with named accounts, no shared logins and prompt removal of access when someone leaves; a password manager for all credentials; logging of access to client systems; backups with tested restore; written vendor due diligence before a new provider is added; and an incident response plan that includes notifying affected clients within 48 hours of confirming a personal data breach that affects their data.
No system is completely secure. If you believe your data with us has been compromised, tell us immediately at hello@outwerk.ai.
16. Automated decision-making
We do not make decisions about you on the site or in our marketing by solely automated means that have legal or similarly significant effects. The AI systems we build for clients operate on the client's data under the client's control; where any such system interacts with you as a customer of a client, the client's privacy notice governs and the system will identify itself as automated.
17. Changes to this policy
We will update this policy when our practices, providers or the law change. The effective date and version number at the top will change, and for material changes we will post a notice on the site for at least 14 days. If a change requires fresh consent, the consent banner will ask again.
18. Contact
Vivek Yogesh Doshi, trading as Outwerk Mumbai, Maharashtra, India hello@outwerk.ai
Grievance officer (India): Vivek Yogesh Doshi, hello@outwerk.ai EU representative: to be appointed if required (see section 11) UK representative: to be appointed if required (see section 11)