PRIVACY POLICY

1. Introduction & Scope

Workerz.org operates custom software systems, enterprise business ERPs, lead generation automation tools (including Switcher, VoiceX, Megaform, and the Number Revealer Chrome Extension), as well as bespoke client web platforms and mobile applications.

We are committed to maintaining the trust of our users, customers, and partners by adhering to rigorous global data protection standards, including the EU General Data Protection Regulation (GDPR), UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), the California Online Privacy Protection Act (CalOPPA), and the Children's Online Privacy Protection Act (COPPA).

2. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information from authorized third-party integrations.

A. Information You Provide Directly

• Account & Profile Information: Full name, business email address, phone number, company/organization name, physical billing address, job title, and login credentials (usernames and cryptographically hashed passwords).
• Inquiries & Project Requirements: Information submitted via our contact forms, project request builders, support emails, or live chat.
• Payment & Billing Data: Transaction records, invoice identifiers, and payment method tokens processed securely via PCI-DSS compliant third-party gateways (e.g., Stripe, PayPal, JazzCash/Easypaisa). We never store raw credit card numbers on our servers.
• Lead & Campaign Data: Data you import or process through our tools (e.g., lead contact lists, proxy configurations, or voice scripts), which you retain full ownership and control over as the Data Controller.

B. Information Collected Automatically

• Device & Hardware Telemetry: Device model, operating system version, browser type, unique device identifiers (UUID/IDFA/GAID), screen resolution, and system language.
• Network & Usage Logs: Internet Protocol (IP) address, approximate geographic location (city/country level), timestamps of visits, pages viewed, API endpoint latency, and referring URLs.
• Crash Diagnostics: Stack traces, error logs, and performance metrics collected to resolve system anomalies.
• Cookies & Local Storage: Essential session cookies, security tokens, and analytics identifiers (see our Cookie Policy).

3. How We Use Your Information & Legal Basis

Under GDPR and international privacy statutes, we process personal data based on the following legal bases:

Processing Purpose	Data Types Involved	Legal Basis (GDPR Art. 6)
Service Delivery & Account Provisioning: Authenticating users, providing software license keys, routing proxy traffic in Switcher, and dispatching VoiceX telephony.	Account credentials, IP address, device telemetry.	Performance of a Contract (Art. 6(1)(b))
Billing & Tax Compliance: Generating invoices, processing payments, collecting applicable taxes, and financial bookkeeping.	Billing name, email, company, transaction records.	Legal Obligation (Art. 6(1)(c))
Customer Support & Technical Maintenance: Answering support tickets, diagnosing bugs, optimizing server uptime, and deploying software updates.	Support emails, chat logs, crash reports.	Legitimate Interests (Art. 6(1)(f))
Security & Fraud Prevention: Detecting unauthorized access, preventing malicious bot activity, and enforcing our Terms of Service.	IP logs, request signatures, session tokens.	Legitimate Interests & Legal Compliance

4. Third-Party Services, SDKs & Processors

We work with trusted third-party service providers and sub-processors who adhere to strict data security and confidentiality standards:

• Google Play Services & Firebase: Used for authentication, app distribution, crash reporting, and device analytics in Android applications.
• Apple App Store & CloudKit: Used for distribution and in-app subscription verification on iOS platforms.
• Payment Processors: Stripe, PayPal, and regional gateways (Easypaisa/JazzCash) for encrypted transaction billing.
• Google Analytics 4 & Google AdSense: Aggregated, anonymized website traffic analytics and contextual advertising. Users can manage ad personalization via Google Ads Settings.
• Cloud Hosting & Infrastructure: Hostinger, Cloudflare (DDoS mitigation & CDN caching), and AWS.
• Telephony & Voice Providers: Twilio and SIP trunk carriers for VoiceX automated telephony routing.

5. Your Privacy Rights (GDPR, UK GDPR & CCPA/CPRA)

Depending on your jurisdiction, you possess the following legally enforceable privacy rights:

• Right of Access / Know: Request a full copy of the personal information we hold about you.
• Right to Rectification: Request correction of inaccurate, outdated, or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request immediate and permanent deletion of your personal data and account records.
• Right to Restrict or Object to Processing: Object to processing based on legitimate interests or direct marketing.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format (JSON/CSV).
• Non-Discrimination: We will never deny services, charge different prices, or degrade service quality for exercising your privacy rights.

To exercise any of these rights, email us at support@workerz.org or visit our dedicated Data Deletion Request Page.

6. User Data Deletion & Data Retention

In full compliance with Google Play Store Developer Policies and Apple App Store Guidelines, any user can permanently delete their account and associated data at any time without restriction.

Data Retention Policy: We retain personal data only for as long as your account remains active or as needed to provide our services. Following account termination, data is permanently scrubbed from production databases within 30 days, except where retention is legally mandated for tax, accounting, or fraud prevention records (which are retained in cold storage for statutory periods).

7. Children's Privacy (COPPA & GDPR Article 8)

Our products, software solutions, and services are exclusively designed for enterprise organizations, lead generation agencies, call centers, and adults aged 18 and older.

We do not knowingly collect or solicit personal information from children under the age of 13 (or under 16 in the European Union). If we become aware that we have inadvertently received personal information from a child, we will permanently purge such data immediately. If you believe a minor has provided us with personal information, please alert us at privacy@workerz.org.

8. Data Security Safeguards

We implement industry-standard technical and organizational security controls to protect your data from unauthorized access, loss, or alteration:

• Encryption in Transit & At Rest: All data transmitted to and from Workerz.org is secured with 256-bit TLS/HTTPS encryption. Stored credentials and sensitive tokens are encrypted using robust hashing algorithms (Bcrypt/Argon2).
• Network Isolation: Multi-tenant isolation, automated firewall rules, DDoS mitigation, and intrusion monitoring via Cloudflare.
• Access Controls: Role-based access control (RBAC) restricting server access exclusively to authorized engineering personnel.

9. International Data Transfers

Workerz.org is based in Islamabad, Pakistan, and utilizes cloud infrastructure located in Europe, North America, and Asia. When transferring personal data outside the European Economic Area (EEA) or the UK, we ensure adequate protections are in place through Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent contractual guarantees.

10. Contact Us & Data Protection Officer

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our dedicated Data Protection Officer and Privacy Team: