Privacy Policy

Last updated: 20 October 2026

WorkNinja ("WorkNinja", "we", "us", "our") respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store, share and protect personal information when you visit our website, contact us, use the WorkNinja platform, access our mobile applications or use our related services.

This policy also explains your rights under applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this Privacy Policy, please contact us at support@workninja.io.

1. Who we are

WorkNinja is operated by:

Heavyweight Group Ltd, trading as WorkNinja
Company number: 17188892
Portland House
Belmont Business Park
Durham
England
DH1 1TW

Email: support@workninja.io

For the purposes of applicable data protection legislation, Heavyweight Group Ltd acts as a data controller where we determine how and why personal information is processed. This includes information relating to our website visitors, account administration, subscriptions, billing, customer support and our own business operations.

Where businesses use WorkNinja to manage information relating to their customers, employees, contractors, properties and jobs, the business will normally act as the data controller and WorkNinja will act as a data processor on its behalf.

When acting as a data processor, WorkNinja processes personal information in accordance with the customer's documented instructions and the applicable Data Processing Agreement.

2. Scope

This Privacy Policy applies to personal information processed through:

• The WorkNinja website

• The WorkNinja web platform and dashboard

• WorkNinja mobile applications

• Customer portals and online booking features, where enabled

• Account registration and subscription management

• Customer support and communications

• Integrations and connected third-party services

• Other services provided by WorkNinja

Where WorkNinja processes personal information on behalf of a business customer, that customer's own privacy policy may also apply.

3. Collection and use of personal information

Personal information means information relating to an identified or identifiable individual.

We collect personal information directly from individuals, through their use of WorkNinja, from organisations that create or manage their accounts and, where applicable, from connected third-party services.

Information may be collected when you:

• Visit our website

• Register for a WorkNinja account

• Access the dashboard or mobile application

• Create or manage jobs, customers, properties or schedules

• Complete forms, reports or certificates

• Upload photographs, files or documents

• Make or receive payments through supported features

• Connect third-party integrations

• Contact our customer support team

• Receive service-related communications

Business customers may also upload or enter information about their own customers, employees, subcontractors and other contacts.

Where WorkNinja processes this information on behalf of a business customer, that customer is normally responsible for determining the purposes and lawful basis of the processing.

4. What personal information we collect

Depending on how WorkNinja is used, we may process the following categories of personal information.

Account and profile information

• Name

• Email address

• Telephone number

• Business name and account details

• User roles and permissions

• Authentication information

• Account preferences

• Subscription and billing information

Work and operational information

• Customer and contact information

• Property and job addresses

• Job descriptions and visit records

• Staff schedules and assignments

• Job statuses and recorded working times

• Quotes, invoices and payment records

• Job reports and certificates

• Customer and employee signatures

• Notes and communications

• Health and safety information

• Uploaded documents and attachments

• Other information entered into the platform by authorised users

Custom forms and reports

WorkNinja allows business customers to create and complete custom forms, reports and related documents.

These may contain personal information about employees, customers, contractors or other individuals.

Depending on the fields configured by the business customer, this may include sensitive personal information, including health-related information.

Business customers are responsible for ensuring that information collected through their forms is lawful, appropriate and limited to what is necessary for their purposes.

Where WorkNinja acts as a processor, we process this information on the customer's instructions and in accordance with the applicable Data Processing Agreement.

Photographs and files

WorkNinja may process photographs, images and documents selected or uploaded by users.

These may include:

• Job photographs

• Images captured using a device camera

• Profile photographs

• Documents selected from a device

• Completed reports and certificates

• Other uploaded files and attachments

These files may contain personal information depending on their contents.

Location information

WorkNinja may collect and process location information, including precise device location data, where location functionality is enabled and the relevant permissions have been granted.

Location information may be used to support:

• Job scheduling and workforce management

• Identifying job and property locations

• Maps and navigation

• Directions to customer properties

• Location-related workflows within the mobile application

• Other location-enabled features made available to business customers

Depending on the functionality being used, location information may be made available to authorised users within the relevant business account.

Location permissions can be managed through your device settings. Disabling location permissions may affect the availability or operation of certain WorkNinja features.

The collection and use of employee location information for workforce management purposes will normally be determined by the business customer, which is responsible for providing appropriate information to its employees and establishing a lawful basis for that processing.

Technical and usage information

We may collect:

• IP addresses

• Device type

• Browser and operating system

• Application version

• Login and access information

• Features used

• Platform activity

• Error and diagnostic information

• Security and authentication logs

We use this information to operate, secure, troubleshoot and improve WorkNinja.

Payment and transaction information

Where payments are made or processed through WorkNinja, we may process:

• Billing names and addresses

• Payment references

• Transaction amounts and dates

• Payment and invoice statuses

• Card brand and last four digits, where made available by the payment provider

• Subscription information

WorkNinja uses Stripe to process supported payment transactions.

We do not normally receive or store complete payment card numbers or security codes.

5. Mobile app permissions

The WorkNinja mobile application may request access to device features where required for supported functionality.

These may include:

Camera: To capture photographs and images for job records, reports and other features.

Photos, media and files: To select, upload, download or save documents, photographs and related files.

Location: To provide location-enabled features including job locations, maps, navigation and workforce-related functionality.

Network access: To communicate with WorkNinja servers and connected services.

Users can manage applicable permissions through their device settings.

Certain functionality may be unavailable or restricted where required permissions are disabled.

WorkNinja only intends to request device permissions that are appropriate for the functionality being provided.

6. How we use personal information

We process personal information for purposes including:

• Creating and managing WorkNinja accounts

• Providing the WorkNinja platform and mobile applications

• Authenticating users and managing access permissions

• Managing subscriptions, invoices and payments

• Delivering job management and scheduling functionality

• Enabling customer and property management

• Supporting quotations, reports, forms and invoicing

• Sending service-related notifications and communications

• Supporting authorised integrations

• Responding to customer support requests

• Investigating technical problems

• Maintaining platform security and reliability

• Preventing fraud and misuse

• Understanding and improving our services

• Complying with legal and regulatory obligations

We may also send information about WorkNinja products, features, promotions and service developments where permitted under applicable marketing and privacy legislation.

Users may opt out of promotional marketing communications through the unsubscribe options provided or by contacting support@workninja.io.

Essential service communications, including account, billing and security notifications, may still be sent where necessary.

7. Legal bases for processing

Where WorkNinja acts as a data controller, we rely on an appropriate lawful basis under applicable data protection legislation.

The lawful basis depends on the purpose and circumstances of the processing.

Where we rely on legitimate interests, we assess those interests against the rights, freedoms and interests of the individuals concerned.

Where we rely on consent, individuals may withdraw that consent at any time. Withdrawal will not affect processing lawfully carried out before consent was withdrawn.

Where WorkNinja processes information on behalf of a business customer acting as a data controller, the customer is normally responsible for identifying the appropriate lawful basis for the processing.

Where special category data is processed, the relevant controller must also identify an applicable additional condition under data protection legislation.

8. Account access for customer support

Authorised WorkNinja team members may access customer accounts, including through account impersonation functionality, where reasonably necessary to:

• Investigate technical issues

• Respond to customer support requests

• Assist with account configuration

• Diagnose platform errors

• Perform authorised maintenance

• Investigate suspected security incidents

• Protect the integrity of WorkNinja

Access must be restricted to legitimate business purposes and limited to the information reasonably necessary to perform the relevant task.

WorkNinja takes steps to restrict support access to authorised personnel and expects team members to maintain the confidentiality of customer information.

Support access to customer data is subject to applicable contractual, confidentiality and data protection obligations.

9. Cookies and similar technologies

WorkNinja uses cookies and similar technologies to operate its website and platform, maintain sessions, provide security, remember preferences and understand how its services are used.

These technologies may include:

• Essential session and authentication cookies

• Security-related cookies

• Preference and functionality cookies

• Analytics and performance technologies

• Other website tracking technologies

WorkNinja uses Google Analytics 4 and Google Tag Manager in connection with website analytics and tag management.

Some cookies and similar technologies are necessary for the operation of the service. Other technologies may require user consent or another applicable legal exception before they can be used.

Further information about the technologies used, their purposes and available choices may be provided through our Cookie Policy and website cookie controls.

10. Disclosure and sharing of personal information

WorkNinja does not sell personal information.

We may disclose personal information to third parties where necessary to provide our services, operate our business, fulfil contractual obligations, comply with the law or protect legitimate interests.

Recipients may include:

• Hosting and infrastructure providers

• Cloud storage providers

• Payment processors

• Email and SMS communications providers

• Analytics and monitoring providers

• Mapping and location service providers

• Customer support providers

• Accounting and integration providers

• Professional advisers

• Regulatory authorities

• Law-enforcement authorities where required or permitted by law

• Purchasers or successors in connection with a business sale, merger or reorganisation

We seek to limit disclosures to information reasonably necessary for the relevant purpose.

Where third parties act as processors on our behalf, we use appropriate contractual arrangements as required by applicable data protection legislation.

11. Service providers and integrations

WorkNinja uses third-party services to operate and support its platform.

These include, where applicable:

Amazon Web Services (AWS): Hosting, infrastructure and data storage.

Ploi: Server deployment and infrastructure management.

Stripe: Subscription billing, supported payment processing and related payment services.

Twilio: Supported communications functionality, including SMS services.

Google Analytics 4: Website analytics.

Google Tag Manager: Website tag management.

WorkNinja also supports integrations with external accounting services, including:

• Xero

• QuickBooks

Where a business customer enables an integration, relevant information may be transferred between WorkNinja and the connected provider to perform the requested functionality.

This may include customer details, contact information, invoices, financial records and related transaction information.

Business customers are responsible for authorising integrations and ensuring that their use of connected services is appropriate.

Third-party providers may process information in accordance with their own applicable privacy policies and contractual arrangements.

12. Payments

WorkNinja uses Stripe for supported payment processing.

Stripe may be used for:

• WorkNinja subscription payments

• Subscription renewals

• Billing management

• Supported customer invoice payments

• Other enabled payment functionality

Where a business customer uses WorkNinja to collect payments from its own customers, the business customer remains responsible for the underlying transaction and its relationship with the paying customer.

We may transmit information to Stripe where necessary to process payments, reconcile transactions, prevent fraud and maintain appropriate financial records.

Payment credentials are generally processed directly by Stripe rather than stored by WorkNinja.

Stripe's Privacy Policy is available at:

https://stripe.com/privacy

13. Protection and security of personal information

WorkNinja uses technical and organisational measures designed to protect personal information against:

• Unauthorised access

• Accidental loss

• Misuse

• Unauthorised disclosure

• Alteration

• Destruction

These measures include appropriate controls relating to application access, user authentication, infrastructure management and platform security.

Access to information is restricted according to applicable roles, permissions and operational requirements.

Business customers are responsible for appropriately managing their own users, permissions and access credentials.

Users should protect their login information and notify WorkNinja promptly if they suspect unauthorised access.

Although we take reasonable precautions to protect information, no online service or data storage system can guarantee absolute security.

14. Accuracy and retention of personal information

WorkNinja seeks to ensure that personal information is accurate, appropriate and retained only for as long as necessary for the purposes for which it is processed.

Retention periods depend on factors including:

• The nature and purpose of the information

• Whether an account or subscription remains active

• Contractual obligations

• Customer instructions

• Applicable legal and regulatory requirements

• Security and fraud prevention needs

• The need to resolve disputes

• Technical backup and recovery requirements

Information relating to active business accounts is generally retained while required to provide the WorkNinja service.

Following cancellation or termination, certain information may be retained temporarily for account closure, data recovery, export, dispute resolution or other legitimate purposes.

Certain financial, accounting and transaction records may be retained for longer where required by applicable law.

Information stored within backup systems may remain until the relevant backup reaches the end of its retention cycle.

Where WorkNinja processes customer-controlled information as a data processor, retention and deletion arrangements are governed by the applicable Data Processing Agreement and contractual terms.

When personal information is no longer required, we take appropriate steps to delete or anonymise it, subject to applicable legal and technical requirements.

15. Your privacy rights

Depending on applicable data protection legislation and the circumstances of processing, you may have the right to:

• Request access to personal information held about you

• Request correction of inaccurate information

• Request deletion of personal information

• Request restriction of certain processing activities

• Object to certain processing

• Request portability of eligible personal information

• Withdraw consent where processing is based on consent

• Make a complaint to a data protection authority

Your right to object

You may object to processing based on legitimate interests in circumstances permitted by applicable law. You also have the right to object to the processing of your personal information for direct marketing purposes at any time.

To exercise your rights, contact:

support@workninja.io

We may request information reasonably necessary to verify your identity before processing a request.

We aim to respond to valid data protection rights requests within the timeframes required by applicable law.

Where personal information is controlled by a business using WorkNinja, that business may be responsible for responding to the request.

In these cases, we may direct the individual to the relevant business or assist the business in responding, as appropriate.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator.

Website: https://ico.org.uk

16. Account and data deletion

Users may request deletion of their WorkNinja account or personal information by contacting:

support@workninja.io

Please use the subject line Delete WorkNinja Account and include the email address associated with your account.

We may request additional verification before processing the request.

Individual user accounts

Where a user belongs to a business account, the business may control the user's access and certain information associated with their activity.

Deletion of an individual user account does not automatically require deletion of business records, including job histories, invoices, reports, customer records or other information the business is entitled or required to retain.

WorkNinja may coordinate with the relevant business account administrator where appropriate.

Business accounts

Deletion of an entire business account may require verification of the account owner's authority and consideration of applicable contractual obligations.

Where appropriate, customers may be given the opportunity to retrieve or export information before account data is deleted, subject to available functionality and contractual arrangements.

Information that may be retained

Certain information may continue to be retained where necessary for:

• Legal compliance

• Financial and accounting records

• Security and fraud prevention

• Dispute resolution

• Legitimate contractual obligations

• Backup and disaster recovery processes

Deletion requests are assessed and handled in accordance with applicable data protection legislation and contractual obligations.

We will explain any applicable limitations or reasons for retaining information where required by law.

17. Children's privacy

WorkNinja is intended for business and professional use and is not designed for independent use by individuals under 18.

We do not knowingly permit children to create independent WorkNinja accounts.

However, business customers may enter information relating to children where relevant to their legitimate business activities, such as property management or service delivery.

Where this occurs, the business customer is responsible for ensuring that the information is collected and processed lawfully.

If you believe information relating to a child has been processed inappropriately, please contact support@workninja.io.

18. International data transfers

WorkNinja uses third-party service providers, some of which may operate or process personal information outside the United Kingdom.

Information may therefore be transferred to, stored in or accessed from other countries where necessary to provide our services.

Where international transfers are subject to applicable data protection restrictions, we take steps to ensure that an appropriate transfer mechanism or safeguard is in place.

Depending on the destination and circumstances, this may include:

• Applicable adequacy regulations or recognised adequacy arrangements

• The UK International Data Transfer Agreement

• The UK Addendum to the EU Standard Contractual Clauses

• Other legally recognised transfer mechanisms

The appropriate mechanism depends on the service provider and the nature of the transfer.

Further information about applicable international data transfer safeguards may be requested by contacting support@workninja.io.

19. Third-party sites and services

WorkNinja may contain links to external websites, applications and third-party services.

Business customers may also choose to connect WorkNinja to external accounting, payment and communication platforms.

These third parties may operate under their own privacy policies, contractual terms and data protection responsibilities.

WorkNinja is not responsible for the independent privacy practices of third-party services outside our control.

Users should review the relevant privacy policies before using or authorising external services.

20. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to:

• WorkNinja functionality

• Our website and applications

• Service providers and integrations

• Business operations

• Applicable laws and regulations

• Our personal information processing activities

The latest version will be published on our website, together with an updated revision date.

Where changes are material, we may provide additional notice through email, the WorkNinja platform or other appropriate channels.

21. Contact us

For questions, privacy requests, complaints or concerns about this Privacy Policy, please contact:

Heavyweight Group Ltd, trading as WorkNinja
Company number: 17188892
Portland House
Belmont Business Park
Durham
England
DH1 1TW

Email: support@workninja.io

Website: https://workninja.io