Privacy

Who is responsible

workrr llc, Phoenix, Arizona, USA, is the controller for trust.workrr.ai, skills.workrr.ai, the public ledger and the Ask Ava assistant. Contact: info@workrr.ai or 855-605-3399. This page covers workrr trust. The workrr.ai policy covers consulting and SMS, and the skills directory page adds what signing in and submitting a skill keep.

What is collected, why, and for how long

Browsing this site

No cookies, no analytics and no advertising. Cloudflare, which hosts the site, processes your IP address and browser details to deliver pages and block attacks, and keeps its own short-lived security logs. Legal basis (GDPR): legitimate interest in running a secure website (Art. 6(1)(f)).

The briefing form

If you send it: your work email, and optionally your company and role, plus the page or campaign you came from and your country (from Cloudflare). They are used only to reply about workrr trust, and they are deleted automatically 24 months after you send them. Basis: steps you asked for before a possible contract (Art. 6(1)(b)), or legitimate interest in replying (Art. 6(1)(f)).

Ask Ava (AI assistant)

Ava is an AI assistant, not a person, unless it says it has handed you to one. When a page loads, Ava asks workrr's server for its settings, sending the page address and a random visitor id that lives only in that page's memory. Nothing is stored in your browser until you open the chat. After that, Ava keeps the visitor id and conversation id in your browser's local storage so the conversation can continue on another page. What you type is processed by workrr and an AI model provider to answer you, and it is kept as long as needed to follow up. Ask, and it will be deleted. Cloudflare Turnstile may check that a new chat isn't a bot. Basis: legitimate interest in answering your questions (Art. 6(1)(f)), and your request when you book a briefing (Art. 6(1)(b)).

Booking a briefing

Bookings go through Cal.com, which receives the name, email and time you enter.

The certifier

@workrr-trust/certify runs in your own CI or on your own machine and sends workrr nothing. When it signs, it uses Sigstore, a public service run by the OpenSSF. The signing certificate and its entry in the public Rekor log name the repository, commit and workflow that signed, and they are public and permanent by design.

The public ledger, findings and the skills directory

The ledger and skills.workrr.ai index public repositories: owner, repository name, commit, file and line, and the result of each check, including signed findings (Flagged). When a repository owner is a person, their GitHub username is personal data. workrr processes it on the basis of a legitimate interest in public, checkable information about software that people run with their AI agents (Art. 6(1)(f)), and only from what is already public. workrr never copies the artifacts themselves.

Object: email info@workrr.ai. workrr weighs every objection and replies with reasons within one month (Art. 21).
Correct: if a finding is wrong, tell us. Findings are reproducible, so anyone can check them, and corrections are published.
Limits: workrr can remove or correct entries in skills.workrr.ai and its own database. Entries in Sigstore's Rekor log and the ledger's git history (and its GitLab, Codeberg, Software Heritage and Bitcoin witnesses) are append-only public records that workrr can't edit. They hold only the public repository facts listed above.

Only service providers that run these services for workrr: Cloudflare (hosting, database, email), Cal.com (bookings), GitHub (the public ledger, and skills sign-in) and the AI model provider behind Ava. They process data under contract and only for this purpose. workrr does not sell or share personal information, for money or for cross-context behavioural advertising, and it does not use it to train AI models.

Transfers outside the EU and UK

workrr is in the United States, so information you send is processed there. Where workrr's providers move personal data from the EU or UK, they rely on the EU–US Data Privacy Framework (and its UK extension) or Standard Contractual Clauses.

Your rights

EU, EEA and UK. You can ask for access, correction, deletion, restriction or a copy of your data, object to processing, and complain to your data protection authority.

California (CCPA/CPRA) and other US states (including Colorado, Connecticut, Virginia, Texas, Oregon and others with privacy laws).

What is collected. In the last 12 months workrr collected these categories: identifiers (email, IP address, a random visitor id), professional information (company, role), internet activity (pages where you used Ava) and what you wrote to Ava. No sensitive personal information. The sources are you, your browser, and public GitHub data. The purposes are the ones listed above.
Your rights. You can ask to know, get a copy of, correct or delete your personal information, and you won't be treated differently for asking. workrr doesn't sell or share personal information, so there's nothing to opt out of. A Global Privacy Control signal is honoured as an opt-out anyway.
Do Not Track. workrr does not track you across other sites, so Do Not Track changes nothing here.
Agents and appeals. An authorised agent can make a request for you. If workrr declines a request, you can appeal by replying to that decision.

How to ask. Email info@workrr.ai or call 855-605-3399. workrr will confirm it's you, usually by replying to the email address involved, and answer within one month (EU/UK) or 45 days (US).

Children

workrr trust is for developers and businesses. It is not directed at children, and workrr does not knowingly collect personal information from anyone under 16.

Changes

When this page changes, the effective date at the top changes too. The page's history is kept in workrr's repository.