Privacy Policy

This Privacy Policy explains what personal information we collect through worktables.io (the "Site"), why, where it goes and the choices you have. It applies to the Site only. Information we handle while delivering consulting, implementation or support work is governed by the written agreement for that work.

Who we are

Worktables is a monday.com Silver Solution Partner that designs and builds business systems on monday.com, with teams in New Jersey, USA and São Paulo, Brazil. In these pages "Worktables", "we", "us" and "our" mean Worktables, the operator of worktables.io. Worktables is the controller of the personal information described here. You can reach us through the contact page.

What we collect

Information you give us through our forms

The Site has a small number of forms: book a call, ask a question, request the monday.com Premium Free Trial, plan an app rollout, register for an event, request early access, and send yourself a readiness-check result. Depending on the form, we ask for:

• Your first and last name (or name), email address and phone number.

• Your company name, its size (a range) and, if you use monday.com, your monday.com URL or your number of monday.com seats.

• Your message: how we can help, what the rollout should cover, or anything we should know before an event.

• Your readiness-check answers and result, when you choose to send a result to yourself.

• Your consent: the box you tick, its wording and the time you ticked it.

Required fields are marked. We only collect what you type into a form; the Site has no accounts, logins or comments.

Information collected with a form

When you send a form, the Site records with it the page you sent it from, the campaign parameters your visit arrived with (utm_source, utm_medium, utm_campaign, utm_term and utm_content, kept for your browser tab so that a form sent later in the visit still carries them), and, if you came from our integrations directory, the app page you were on and up to ten app pages you looked at in that tab. Each record also carries a unique identifier and a timestamp, and the result of the spam check described below.

Technical data

Like every website, the Site is delivered by servers that process your IP address, browser type and version, device and operating system, the pages you request and the time of each request, in order to serve the pages and keep the Site secure. Our hosting provider, Cloudflare, keeps these server logs for a short period. Our spam check (Cloudflare Turnstile) receives your IP address and browser signals when you fill in a form. We do not combine server logs with form data.

Analytics and advertising data

Only if you accept them in the cookie banner, Google Analytics 4 (analytics) and our advertising partners' tags — Google Ads, the Meta Pixel and the LinkedIn Insight Tag (advertising) — collect information about your visit: pages viewed, clicks on our calls to action, forms completed, approximate location derived from your IP address, device and browser details, and the identifiers in their cookies. Until you accept, none of this is collected. The Cookie Policy lists what is set and how to change your choice.

Why we use it, and on what legal basis

• To answer your request — a call, a question, a trial, a rollout, an event place, a readiness result. Legal basis: taking steps at your request before entering a contract, and our legitimate interest in responding to enquiries.

• To follow up and send you relevant content, when you have ticked the consent box on a form. Legal basis: your consent, which you can withdraw at any time by using the unsubscribe link in any email or by contacting us.

• To know which pages, campaigns and ads bring enquiries, and to show our ads to people who have visited, so we can improve them. Legal basis: your consent, given in the cookie banner.

• To keep the Site secure and prevent spam and abuse. Legal basis: our legitimate interest in running a secure website.

• To keep business records and comply with legal obligations. Legal basis: legal obligation and legitimate interest.

We do not use your personal information for automated decisions that have legal or similarly significant effects on you.

Where your information goes

We share personal information only with the service providers that run the Site and our follow-up, each under a contract that limits what they may do with it:

• Cloudflare hosts and delivers the Site, protects it from attacks and runs the Turnstile spam check. A form you send is stored first in our own database at Cloudflare (D1), so that it is never lost.

• ActiveCampaign is our CRM and email system. Our server delivers each form submission to it as a contact record (name, email, phone, company and the monday.com details you gave), a list membership for that form and a note holding your message, the page, the campaign, your consent and the submission's identifier. ActiveCampaign is where our follow-up emails are sent from.

• monday.com is where our team manages its work. Contact and enquiry details are synced from ActiveCampaign into our monday.com account so the right person can follow up.

• Google (Google Analytics 4 and Google Ads), Meta (the Meta Pixel, for Facebook and Instagram ads) and LinkedIn (the Insight Tag, for LinkedIn ads), all loaded through Google Tag Manager, receive analytics and advertising data only after you accept those cookies. Each is an independent controller of what it receives, under its own privacy policy: Google, Meta, LinkedIn. An enquiry you send is reported to them as an event with a random identifier, never with your name, email or message.

• Storyblok is the content management system the Site's pages are written in. It serves page content to our servers and receives no visitor data.

• Vimeo and YouTube host the videos on the Site. A player loads only when you press play, and only then does the provider receive data about you; see the Cookie Policy.

We may also disclose information when the law requires it, to protect our rights or safety or those of others, or as part of a merger, acquisition or sale of our business, in which case this policy will continue to apply to it.

We do not sell your personal information, and we never have. We do not share form data with advertisers.

How long we keep it

• Form submissions are kept in our database and in ActiveCampaign and monday.com for as long as we are in contact with you or your company and for a reasonable period afterwards, so that we can answer later questions and keep business records; then they are deleted or anonymised. You can ask us to delete them sooner at any time.

• Follow-up email consent is kept until you withdraw it, and a record that you withdrew it is kept so that we respect it.

• Server and security logs at Cloudflare are kept for a short period and then discarded.

• Analytics data in Google Analytics is kept for the event-level retention period set in our account (Google Analytics 4 allows at most fourteen months) and then deleted; advertising data is kept according to Google Ads', Meta's and LinkedIn's own retention rules.

• Your cookie choice is kept in your browser for 180 days, and asked for again when it expires or when this policy changes materially.

International transfers

Worktables is based in the United States and Brazil, and our service providers run their services in the United States and the European Union. If you visit from the European Economic Area, the United Kingdom, Switzerland or another country with data-transfer rules, your information will be transferred to and processed in the United States. Our providers rely on recognised transfer mechanisms such as the European Commission's standard contractual clauses and, where certified, the EU-US Data Privacy Framework. Contact us if you would like more detail.

Your rights

Depending on where you live you have some or all of the following rights, and we honour them for everyone who asks:

• Access — ask what personal information we hold about you and receive a copy.

• Correction — ask us to correct information that is wrong or incomplete.

• Deletion — ask us to delete your information. We will do so unless we need to keep it for a legal reason, and we will tell you if that is the case.

• Objection and restriction — object to processing based on our legitimate interests, or ask us to restrict it.

• Portability — receive the information you gave us in a machine-readable format.

• Withdraw consent — at any time, without affecting what was done before. For email, use the unsubscribe link or contact us; for cookies, use the Cookie settings link in the footer.

• Complain — to your data-protection authority. In the EEA that is the authority of your country; in the United Kingdom it is the Information Commissioner's Office.

If you are in California

Under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the categories we collect are identifiers (name, email, phone, company, monday.com URL), professional information (company size, your message), internet activity (pages viewed, campaign parameters, and, with your consent, analytics and advertising data) and inferences drawn for marketing (which services you may be interested in). We collect them from you and from your device, for the purposes above, and disclose them to the service providers above.

We do not sell personal information. Allowing Google Ads, the Meta Pixel and the LinkedIn Insight Tag to set cookies on this Site for advertising measurement and remarketing can count as "sharing" for cross-context behavioural advertising under the CPRA. It happens only if you accept advertising cookies in our banner, so the banner is your opt-out: choose "Reject all", or untick Advertising under "Choose cookies" or the footer's Cookie settings link. We also honour the Global Privacy Control signal from your browser as an opt-out of sharing. We do not knowingly share the personal information of anyone under sixteen. You have the right to know, delete, correct and limit the use of your information, and the right not to be discriminated against for exercising these rights. You may use an authorised agent to make a request; we will verify the request before acting on it.

How to make a request

Use the contact page or call +1 862 206 6266. We will confirm your identity to the extent needed to protect your information, and answer within the time the law allows (one month in the EEA and UK, forty-five days in California), extendable once if the request is complex.

Children

The Site is for businesses and is not directed to children. We do not knowingly collect personal information from anyone under sixteen. If you believe a child has given us information, contact us and we will delete it.

Security

Every connection to the Site is encrypted (HTTPS). Form data travels from your browser to our own server and from there to our providers over encrypted connections; the browser never talks to ActiveCampaign or monday.com directly, and no provider credential is ever present in the pages you load. Access to our database and to our ActiveCampaign and monday.com accounts is limited to the team members who need it. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we take the measures a careful business would.

Changes to this policy

We may update this policy from time to time. The new version is published on this page with a new "last updated" date. If a change materially affects what we collect or how we use it, we will also ask for your cookie choice again and, where the law requires, seek your consent.

Contact

Privacy questions and requests: the contact page, or +1 862 206 6266.