Privacy policy

1. Data controller

The WorkOS platform is operated by SAL DIGITAL SKILLS, S.L., tax ID B39855788, registered at Plaza María Blanchard 2, 3F, 39600 Maliaño (Cantabria), España. You can reach us at eduardo@befocusy.com for anything regarding this policy, and at soporte@befocusy.com for product support.

2. Our role

Our role changes depending on where you are, and the distinction matters. On befocusy.com and the campus we are the data controller: we decide what data we ask for and why. On the WorkOS platform it is different: each customer company uses it with its own accounts and databases, so with regard to the content it enters or connects we act as a data processor on its behalf, under article 28 GDPR, and the controller is the customer company. We are the controller for that company own contact and billing details.

3. What data we process

• Account data: name, email address, company and interface preferences.
• Connection credentials (OAuth): the access tokens for the third-party services the user explicitly authorizes. They are stored encrypted and never shared between customers.
• Working content: the content of the services the user connects — messages, calendar events, documents, files — displayed and organized inside the platform.
• Technical data: IP address, device identifiers and activity logs, for security and troubleshooting.
• Billing data of the customer company. Full payment card details are held by the payment provider; we do not store them.
• Newsletter subscription data: your email address and, if you give it, your name.
• Training data: if you enrol in the campus, your enrolment and your progress through the courses.

4. What we use them for

Only to provide the features the user has requested: displaying and organizing their work in the interface, synchronizing it with their Notion workspace, sending the messages they compose, managing their calendar events and keeping their files organized. Also to bill the service, meet our legal obligations and keep the platform secure. We do not build advertising profiles.

4b. Support form

If you write to us through the support form on our public page, we process the name, email address and message you provide for the sole purpose of handling your enquiry and replying to you. The legal basis is your own consent when submitting it. We keep that correspondence for as long as necessary to resolve the matter and, afterwards, for the period during which liabilities may arise. We do not use it to send you marketing communications.

4c. Newsletter

If you subscribe to our newsletter on befocusy.com, we process your email address (and your name, if you give it) for the sole purpose of sending it to you. The legal basis is your consent, given when you sign up; if you are already a customer, we may inform you about services similar to those you have contracted, under article 21 of the Spanish LSSI. Delivery is handled by Substack, acting as a data processor, which does not use your address for anything else. We keep your data until you unsubscribe, which you can do with the link at the bottom of every newsletter or by writing to us. Newsletters may include open markers and tracking links that tell us, in aggregate, whether the message was read.

5. Google API data

WorkOS only accesses the Google accounts the user explicitly connects, and only the services authorized on the consent screen: Gmail, Google Calendar and Google Drive. Access can be revoked at any time from the Google account settings, and also by disconnecting the account inside WorkOS.

• Gmail. We read the messages of the connected account to display them in the WorkOS inbox and link them to the matching contact. We mirror back to Gmail the actions the user performs here: marking as read, archiving, labelling or moving to trash. We only send messages the user composes and confirms; we never send email automatically or in bulk.
• Google Calendar. We display the calendars the user selects and create, reschedule or cancel events at their request, including attendees and video-call links.
• Google Drive. We work inside the folder the user designates: we create its structure, upload attachments there, read the documents they choose to import, and move or rename folders when they reorganize their notes. Files that already existed in their Drive are neither moved nor deleted when imported. If the user deletes an attachment from WorkOS, that file is also permanently deleted from their Drive, without going through the trash.

6. Providers involved

To deliver the service we rely on the following providers, each under its own data processing agreement:

• Hostinger — platform hosting, within the European Union.
• Google LLC — the user Gmail, Calendar and Drive, when they connect their account.
• Microsoft — email and calendar, as an alternative to Google.
• Notion Labs — destination of the customer working content.
• OpenAI and Google (Gemini) — text generation, summarization and audio transcription for the AI features. They do not train their models on data sent through their APIs.
• Zernio — WhatsApp Business and Instagram messaging, and social media publishing.
• Slack — channels and direct messages, when the user connects their account.
• Stripe — subscription billing.
• Kit.com — newsletter delivery, when the customer uses that feature.
• Substack — delivery of our newsletter.

We never sell data to third parties under any circumstances. Some of these providers are located outside the European Economic Area; in those cases the transfer relies on the European Commission standard contractual clauses or on an adequacy decision.

7. How long we keep them

• Connection credentials are deleted automatically as soon as the user disconnects the tool or revokes access from their Google account.
• Working content is kept while the account is active. When the relationship ends it is deleted or returned to the customer, as they instruct.
• Technical logs are temporary, with automatic rotation and deletion, typically between 30 and 90 days.
• Billing data is kept for the periods required by commercial and tax regulations.

8. Security

Each customer company is isolated from the rest: its credentials and content are never shared or mixed with those of any other customer. Connection credentials are stored encrypted, access to the platform always uses a secure connection, and internal access is limited to the staff strictly necessary to provide support.

9. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to eduardo@befocusy.com. If the data was provided by the company you work for, address them as the controller; we will assist them. You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es).

10. Changes to this policy

If we change this policy, we will publish the updated version here and change the date above. If the change significantly affects how data is processed, we will also notify customers by email.