WorkstoaPrivacy policy
Effective: on the general availability date
BUKCS.com Co., Ltd. (벅스닷컴㈜) (“the Company”) complies with the Personal Information Protection Act of Korea and related laws when providing Workstoa, and processes users' personal information as follows.
In the app stores (App Store · Google Play · Microsoft Store), our affiliate BUKCS PTE. LTD. (Singapore) is shown as the publisher. The publisher only lists the apps; the controller of personal information processed in Workstoa is BUKCS.com Co., Ltd. (벅스닷컴㈜). App purchases and subscriptions are handled by each store, and the Company does not receive card details.
1. What we process and why
| Category | Items | Purpose |
|---|---|---|
| Account | Name, email address, password (stored irreversibly), language setting, linked Google · Microsoft account identifier | Identifying members, sign-in, notices and security alerts |
| Device | Device identifier, operating system, app version, last used time | Per-device sign-in management, remote sign-out, updates |
| Work data | Mail in connected mailboxes, messenger conversations, calendars, docs, notes, tasks, attendance and approval records, attachments | Providing the service (data users create or connect themselves) |
| Customer requests | Requests arriving through channels the workspace connected (mail · messenger · app reviews) and sender details | Helping the workspace handle its customer requests |
| Collected automatically | IP address, access time, error logs | Security (blocking abusive sign-ins and excessive requests), incident response |
Rhythm (focus and activity) keeps only app names and time used, visible only to you. Window titles, screenshots and keystrokes are never collected.
2. Retention
We delete data without delay when you leave or a workspace is deleted, except records that laws require us to keep for a set period. Access logs are kept for up to one year for security.
3. Workspace data
Work data and customer requests in a workspace are processed for that workspace (the customer) and only within its instructions. Workspaces are isolated and cannot see one another.
4. Sharing with third parties
We do not provide personal information to third parties unless the law requires it or you consent. With external services you connect yourself (Google · Microsoft sign-in, messenger and app-store integrations), only the information needed for the connection is exchanged.
5. Google user data
When you sign in with Google or connect Google Calendar, the Company accesses Google user data only within the permissions you grant.
- Sign-in (openid · email · profile): your email address, name and Google account identifier, used to create your account and sign you in.
- Google Calendar connection (calendar.events): we read events in your primary calendar to show them in the Workstoa calendar, and — only if you turn it on — create, update and delete the events you make in Workstoa in that calendar. We do not touch other calendars or send mail to event attendees.
- Storage: a copy of the events and the connection tokens are stored on the Company's servers; tokens are encrypted. When you disconnect or delete your account, the event copy and tokens are deleted at once and we ask Google to revoke access. You can also revoke access at any time in your Google Account settings.
- Sharing: we do not sell Google user data, use it for advertising, or transfer it to third parties, except showing your events to members of your workspace where you choose to share them.
- Human access: Company staff do not read this data unless you agree, or it is needed for security (investigating abuse) or to comply with the law.
- AI: Google user data is not used to develop, improve or train generalized AI or machine-learning models.
Workstoa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Processors · transfers abroad
Processors (server hosting, mail delivery and others) and any transfers abroad will be listed in a table here before public launch.
7. Your rights
You may access, correct or delete your personal information, or ask us to stop processing it, at any time — in the app's settings or by contacting the privacy officer below.
8. Security measures
- Passwords stored with an irreversible hash
- All traffic encrypted (HTTPS · TLS)
- Access control per workspace, checked regularly
- Per-device sessions and remote sign-out
- App updates verified by code signature
9. Cookies
This website uses no advertising or analytics cookies. The sign-in page stores only a device identifier and sign-in data that disappears when you close the tab, plus your language choice.
10. Privacy officer
To be designated and listed here before public launch.
11. Changes
We will announce changes to this policy on the website and in the app 7 days before they take effect.