Privacy Policy
Last updated: 9 October 2026
This Privacy Policy explains how ABIB EOOD (ABIB Ltd.) ("Workbranch", "we", "us") collects, uses and protects personal data when you visit workbranch.ai (the "Website") or use the Workbranch application at app.workbranch.ai (the "Service").
1. Who we are
The controller of your personal data is ABIB EOOD (ABIB Ltd.), a company registered in Bulgaria. You can contact us about privacy at hi [at] workbranch [dot] ai.
2. Data we collect
When you visit the Website
- Technical data: IP address, browser type, device information, pages requested and timestamps. This is processed by our hosting and security provider to deliver the Website and protect it from abuse.
- Analytics (only with your consent): if you accept cookies, Google Analytics collects pseudonymous usage data such as pages viewed, device and approximate location. See Cookies.
- The Website does not use advertising cookies and does not load third-party fonts.
When you use the Service
- Account data: name, email address, password hash, or the identifier from a sign-in provider you choose.
- Content: the prompts, chats, projects, folders, highlights, threads, due dates and files you create or upload ("Your Content").
- Usage data: feature usage, log data, device and browser information, used to run, secure and improve the Service. We use Mixpanel for product analytics and Sentry for error monitoring.
- Imported chats: conversations you choose to import from ChatGPT, Claude or Gemini become part of Your Content.
- Billing data: Stripe processes your payment details when you subscribe. We receive only limited information such as plan, billing country and the last four digits of your card.
- Communications: messages you send us, for example support requests.
3. How we use your data and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service, including sending your prompts to AI model providers to generate answers | Performance of a contract (Art. 6(1)(b)) |
| Account management, support and service emails | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud prevention and debugging | Legitimate interests (Art. 6(1)(f)) |
| Improving the product using aggregated or de-identified usage data (Mixpanel) and fixing errors (Sentry) | Legitimate interests (Art. 6(1)(f)) |
| Website analytics (Google Analytics) | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Product news and marketing emails | Consent (Art. 6(1)(a)), which you can withdraw at any time |
| Billing, tax and accounting records | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal data, and we do not use Your Content to train AI models. We also do not allow our AI model providers to use Your Content to train their models.
4. Who we share data with
We share personal data only with service providers ("processors") that help us run Workbranch, under written data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Cloudflare | Website hosting, delivery and security | Global / US |
| Heroku (Salesforce) | Application hosting and database | US / EU |
| Google (Gemini API) | Generating AI answers to your prompts | US |
| OpenAI, Anthropic | Generating AI answers, only when you choose their models | US |
| Stripe | Payments and subscriptions | US / EU |
| Resend | Sending account and service emails | US |
| Mixpanel | Product analytics in the app | US |
| Sentry | Error monitoring in the app | US |
| Google Analytics | Website analytics, only with your consent | US |
We may also disclose data if required by law, or as part of a merger or acquisition, in which case we will notify you.
5. International transfers
Some of our providers process data outside the European Economic Area, including in the United States. When they do, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses.
6. Cookies
Website (workbranch.ai): we only set analytics cookies if you click Accept in the cookie banner. Google Analytics then sets the _ga and _ga_* cookies, which last up to 2 years. If you decline, no analytics cookies are set. We store your choice in your browser's local storage. You can change it anytime via Cookie settings in the footer.
App (app.workbranch.ai): we use cookies and similar storage that are strictly necessary to keep you signed in and secure, plus Mixpanel and Sentry identifiers to understand product usage and fix errors.
7. How long we keep data
- Account data and Your Content: for as long as your account is active. When you delete content or your account, we permanently delete it, including from backups, within 30 days.
- Website and security logs: up to 30 days. Google Analytics data: 14 months.
- Billing records: as long as required by tax and accounting law.
8. Your rights
Under the GDPR and similar laws you have the right to access, correct, delete, export (portability), restrict or object to the processing of your personal data, and to withdraw consent at any time. You can export or delete Your Content from within the Service, or email hi [at] workbranch [dot] ai. We respond within one month.
You also have the right to complain to a data protection authority, in particular in the EU country where you live or work, or to our lead authority, the Commission for Personal Data Protection of Bulgaria (cpdp.bg).
9. Security
We use encryption in transit (TLS), access controls, and least-privilege access for staff. No system is perfectly secure; if a breach affects your personal data, we will notify you and the authorities as required by law.
10. Children
Workbranch is not intended for children under 16, and we do not knowingly collect their personal data.
11. Changes
We will post any changes on this page and update the date above. For material changes, we will notify account holders by email or in the app before they take effect.
12. Contact
ABIB EOOD (ABIB Ltd.), Bulgaria. Email: hi [at] workbranch [dot] ai.