Privacy Policy
How Worktends collects, uses and protects personal data across AI, web, marketing, design and media production services.
Version 2.0 | Effective October 4, 2026
Privacy Policy, NDAs & Data Protection Agreements
Worktends provides AI, web development, digital marketing, social media, design & branding, and media production services (animation, videography and sound) to clients worldwide. We protect client trade secrets, source code, user data and creative work under a clear legal and privacy framework.
Source code, product architecture, proprietary prompts, branding concepts and trade secrets are covered by NDA terms that continue for as long as the information stays confidential.
When we process personal data for a client, we act as processor or service provider under GDPR Art. 28, UK GDPR, CCPA/CPRA and the India DPDP Act 2023, with clear instructions and SLAs.
How we handle data across our services
Our practices are built around AI data isolation, PCI-DSS compliant payment providers, secure data deletion, and compliance with GDPR, UK GDPR, CCPA/CPRA and the India DPDP Act 2023.
AI Data Isolation
Client inputs, source code and prompts are not used to train public models. We choose zero-retention or private deployments where providers offer them and document each provider.
PCI-DSS Payment Providers
We never store full card numbers. Payments go through PCI-DSS certified providers such as Stripe, Razorpay and PayPal.
Web Dev & Access Control
Least-privilege access, MFA, masked or synthetic test data, and source code ownership transferred as set out in your contract.
Marketing Account Access
We use delegated agency roles and OAuth on Meta, Google, LinkedIn and TikTok. We never ask for your account passwords, and you keep ownership of your accounts and audiences.
Design & Brand Identity
Unreleased brand files, guidelines and concepts stay confidential under NDA until your launch.
Video, Sound & Talent Rights
Signed releases for talent and voice artists, explicit consent for voice cloning or synthetic media, and parental consent for minors.
Children’s Protection
Our website is for adults. Productions featuring minors need guardian consent, and children’s data collected by mistake is deleted.
GPC Signal Support
We detect the Global Privacy Control signal and keep analytics and marketing scripts off when your browser sends it.
Secure Data Deletion
At the end of a contract, project data is sanitized in line with NIST SP 800-88 and we provide a Certificate of Destruction on request.
International Transfers
Standard Contractual Clauses, the UK addendum and the EU-US Data Privacy Framework where available, plus DPDP Act compliance for India.
Safeguards, legal terms and your rights
Client engagements are protected by encryption, access controls, non-disclosure agreements, data protection addendums and clear data ownership terms.
Control over your information
You own your data, source code and creative deliverables as set out in your contract, and you can ask to access, export, correct or delete your personal data.
GPC signals, third-party services and sub-processors
We honor browser Global Privacy Control (GPC) signals on this site and use Standard Contractual Clauses or equivalent safeguards with our sub-processors.
Prompt breach notice and a named Grievance Officer
We notify enterprise clients without undue delay, targeting 48 hours from confirmation, so they can meet their own legal deadlines. A designated DPO and Grievance Officer handle requests under the India DPDP Act 2023.
Make a privacy request
Ask to access, correct, delete or export your data, opt out of sale or sharing, withdraw consent, or raise a grievance.