Privacy Policy
Last updated: 18 August 2026 · Effective: 18 August 2026
Your privacy matters to us. This policy explains what data Work2U collects, why we collect it, and what rights you have over your information. We've written it in plain language — no legal jargon traps.
1. Who We Are
Work2U is a customer relationship management (CRM) platform operated by Saga X Ventures (NS0246319-H), a company registered in Malaysia.
Our principal place of business and the data controller for your information is:
2. Information We Collect
We collect three categories of information. Each is treated with the minimum access principle — only team members who need the data to do their work can see it.
2.1 What you give us directly
- Account information — name, email address, password (hashed with bcrypt), profile photo when you sign up
- Billing information — payment card details (processed by our payment provider, never stored on our servers)
- Workspace content — tasks, projects, contacts, notes, files, calendar events you create inside Work2U
- Communications — messages you send through our in-app chat, WhatsApp integration, or email tools
- Support messages — when you contact our team by email, chat, or social media
2.2 What we collect automatically
- Device data — IP address, browser type, operating system, device identifiers
- Usage data — pages you visit, features you use, time spent, click patterns
- Log data — error reports, performance metrics, crash dumps
- Cookies & similar — necessary cookies for login, optional analytics cookies (you can opt out)
2.3 What we get from third parties (only when you authorize)
- Google — When you connect Google: name, email, profile photo, calendar events, Gmail messages, contacts (we request only scopes needed for the feature)
- WhatsApp — When you scan the QR: phone number, message history, contact list (stored only on your session)
- Stripe / payment providers — billing address and subscription status (card details never touch our servers)
3. How We Use Your Information
We use the data we collect for six specific purposes, and you can object to any of them by emailing us:
- To provide the service — run your CRM, sync data, send notifications you request
- To improve the product — aggregate usage patterns help us find bugs and build better features
- To handle billing — process subscriptions, send invoices, prevent fraud
- To communicate with you — service announcements, security alerts, replies to your support requests
- To comply with the law — tax records, anti-money-laundering checks, lawful government requests
- To protect our users — detect abuse, investigate violations of our terms
We never sell your personal data. We never use your CRM content to train AI models. We never share your files with advertisers.
4. Legal Bases for Processing (GDPR/PDPA)
Under Malaysian PDPA and EU GDPR, we rely on these bases:
- Contract — processing needed to deliver the service you signed up for
- Legitimate interests — analytics, security, product improvement (you can object)
- Consent — optional integrations like Google or WhatsApp (you can revoke anytime)
- Legal obligation — tax, accounting, lawful requests
5. Where Your Data Lives
Your data is primarily stored in Singapore (Supabase region) with backups in Frankfurt, Germany. We chose these regions because they offer strong data-residency protections and low latency for our Asian and European users.
By using Work2U, you understand your data may be transferred to and processed in these countries. We use Standard Contractual Clauses for any transfers outside your home jurisdiction.
6. Who Else Sees Your Data
We share your data only with carefully selected processors who help us run Work2U. Each is bound by a data-processing agreement:
- Supabase — database & authentication infrastructure (Singapore & US)
- Vercel — web hosting & edge functions (US/global edge)
- Cloudflare — DNS & security (US/global)
- Resend — transactional email delivery (US)
- Google Cloud — AI features (Gemini, Groq, OAuth login) (US)
- Stripe — payment processing (US)
- WhatsApp (via Railway) — messaging service
We may also disclose information when required by law, to protect our rights, or in the event of a merger or acquisition (with notice to you).
7. How Long We Keep Your Data
- Active account data — kept while your account is active
- Deleted account data — purged within 30 days, except where retention is required by law (e.g. tax records: 7 years)
- Backups — rotated and deleted within 90 days
- Analytics data — aggregated and anonymized after 24 months
8. Your Rights
You have these rights over your data at any time:
- Access — request a copy of everything we hold about you
- Rectification — correct anything that's wrong
- Erasure — request deletion of your account and data
- Restriction — pause processing while we investigate a complaint
- Portability — get your data in a machine-readable format (JSON/CSV)
- Objection — opt out of analytics, marketing, or legitimate-interest processing
- Withdraw consent — revoke Google/WhatsApp integrations from your account settings
To exercise any right, email privacy@sagaxventures.com. We respond within 30 days.
9. Cookies
We use cookies in three categories:
- Strictly necessary — login tokens, security CSRF tokens (always on)
- Functional — preferences like theme (dark/light), language (always on)
- Analytics — aggregate usage to improve the product (opt-in only)
You can disable analytics in Settings → Privacy at any time.
10. Security
We protect your data with industry-standard measures:
- All data in transit is encrypted with TLS 1.2+
- Data at rest is encrypted with AES-256
- Authentication uses bcrypt-hashed passwords with optional 2FA
- Access to production is restricted to named engineers with hardware keys
- Third-party penetration tests run annually
- Bug bounty programme available at security@sagaxventures.com
No system is 100% secure. If we ever discover a breach affecting your data, we will notify you within 72 hours as required by GDPR.
11. Children
Work2U is not directed at children under 16. We do not knowingly collect data from children. If we learn we have, we delete it. Parents can contact privacy@sagaxventures.com to remove a child's data.
12. International Transfers
When we transfer data outside your country, we use safeguards: Standard Contractual Clauses, adequacy decisions, and binding corporate rules. Our processor list above shows where data flows.
13. Changes to This Policy
When we update this policy, we change the "Last updated" date at the top. For material changes, we send an email at least 30 days before they take effect, and we'll show a notice in the app.
14. Complaints
If you have a complaint, first contact us at privacy@sagaxventures.com. You can also complain to your local data protection authority — for Malaysia, this is the Personal Data Protection Commissioner (JPDP).