Legal
Last updated: March 27, 2026
Data Workers, Inc. ("we", "us", "our") operates the dataworkers.io website, publishes the Data Workers open-source software, and offers paid and Enterprise services (collectively, the "Services"). This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information.
This policy describes what our software and our website actually do. Where a control is not implemented, we say so rather than describing the version we would prefer.
Most of what follows depends on where the software runs, so it is worth stating up front:
Sections 5, 6, 7 and 10 describe the behavior of the software itself. They apply wherever it runs, including on your own infrastructure, because you need them to assess the software before you deploy it.
This is the distinction that matters most, so we state it plainly rather than burying it.
The software does store the content of results, not only metadata about them. Anyone evaluating it should plan for that. Specifically, when the relevant features are used, the software writes the following to the storage you have configured:
Operational metadata - which tool ran, its parameters, success or failure, duration, and timestamps - is recorded separately from the above.
Because this storage is on infrastructure you configure and control when you self-host, retention and deletion of that content are governed by your configuration and your own retention policy, not by ours. If you need result content not to be retained, review the caching and profiling behavior before you enable those features.
We do not use customer data content to train models, and we do not use it to improve the product beyond serving the immediate request that produced it. We have no model-training pipeline that ingests customer data. Section 6 describes what is sent to third-party model providers to serve a request, and what those providers may do with it.
We use Google Analytics 4 on dataworkers.io. It loads on every page. It records pages visited, referral source, device type, browser and operating system, approximate country and city level location, and a small number of events we define: page views, scroll depth on articles, and submission of the demo request form. Google Analytics 4 does not log or store IP addresses in the way earlier versions did, but IP address is processed transiently by Google to derive approximate location. Google's own privacy terms govern what Google does with this data.
There is currently no cookie consent banner on this website, and analytics load before any consent is collected. We state this rather than implying a consent mechanism that does not exist. See Section 12 for what this means for our legal basis under GDPR.
If you submit a demo request, contact form, Design Partner application, or the deletion request form below, we collect what you type into it: typically your name, email address, company, and any message or reason you provide. Submissions are delivered to our internal email inbox through our email delivery provider. We use them to respond to you.
Our form endpoint applies a per-IP submission throttle. To do this it stores your IP address for ten minutes and then discards it. If a submission trips an abuse guard, we log the IP address, network operator, and browser user agent so that we can identify and block abusive traffic. We do not use this information for any other purpose, and we do not use it to build a profile of you.
The software does not manage secrets for your external systems, and we do not receive your warehouse credentials. Connectors read credentials from the environment of the machine the software runs on. Data Workers does not store or transmit them to us.
This means you are responsible for securing those credentials using your own secrets management, and for the scopes and permissions you grant. Our setup tool, if you use it, writes the credentials you supply to a plaintext environment file on your own machine, which you should protect accordingly. Grant the narrowest permissions that let the agents do the job you want done.
On logging: we found no code path that writes credential values to logs. Logs record whether a credential is present, not what it is. One internal development harness logs the first eight characters of a webhook signing secret; that harness is not part of a normal deployment. We describe this precisely rather than claiming a blanket guarantee.
On encryption: because warehouse credentials are never persisted by the software, there is no credential store for us to encrypt, and we make no encryption-at-rest claim about them. The software does not itself enforce TLS or other network-level controls; transport security is a property of your deployment and of the connections your infrastructure makes. Where you deploy it, terminate TLS and apply network controls using standard practice.
Data Workers agents call large language models. This is the point at which your data can leave your own infrastructure, so read this section carefully.
Which provider is used is determined by which API key is configured in the environment where the software runs. Anthropic is selected first when an Anthropic key is present; OpenAI is used when only an OpenAI key is present. If no model provider key is configured, no external model call is made at all. That choice is yours, not ours, when you self-host.
Content of your data, not only schema, is sent to the model provider. Depending on which features you use, this can include: up to fifty rows of query results, serialized, in order to generate an explanation of those results; up to five actual values from a column being classified for personal information; extracts of record text; your table and column names, row counts, the generated SQL, and the question you asked. There is no redaction or masking layer between your data and the model request. If a column contains personal information and a feature sends sample values from it, that personal information is in the request.
The software includes a mode that blocks external model calls entirely and keeps processing local. It is off by default and must be turned on deliberately.
Once data reaches a model provider, that provider's terms govern it, not ours. The distinction that matters:
If you connect Data Workers to an AI client such as an assistant or coding tool, that client sends tool results to its own model provider, and which of the two categories above applies depends on the plan you are on with that provider. We do not control it and cannot change it from our side. Review OpenAI's privacy policy, OpenAI's terms of use, and Anthropic's privacy policy for the provider you use.
Open question - founder decision required
Zero-retention configuration. An internal subprocessor list asserts that zero data retention is enabled on the OpenAI account. Nothing in the code sets a zero-retention or no-training flag, header, or endpoint on any model request. If that setting exists it exists as an account or contract term that cannot be seen from the code. It must be confirmed at the provider account level before any statement about it is published here, and the internal list should be corrected if it is not in fact enabled.
We do not sell your personal information. We do not use your data for advertising. We do not use customer data content to train models.
The following third parties process data in connection with the website and our own operations. We list only those we can evidence:
Where you self-host, you choose your own infrastructure and model providers, and they are your subprocessors rather than ours.
We state the last item explicitly because it is the one most likely to surprise you. If indefinite retention of profiled sample values or cached result sets is not acceptable in your environment, configure or disable those features accordingly.
Measures that are in place, described accurately:
Limitations we are not going to leave out. The software is pre-release. Its default in-memory and local implementations are intended for development and evaluation and do not provide durability, encryption at rest, or access controls. The software does not itself enforce TLS or network-level controls. Substantial portions of it were developed with the assistance of generative AI tools and it should be treated as experimental. Configure production infrastructure, transport security, and access controls yourself before relying on it.
We hold no security certification and make no certification claim. We have not published an independent audit, and we do not carry a compliance attestation. Do not infer one from anything on this page.
Our own website code does not set cookies. Google Analytics sets its own cookies to distinguish visitors and sessions. We do not run advertising pixels or third-party ad trackers on this site.
You can block or delete cookies in your browser settings, and you can install the Google Analytics opt-out browser add-on. Blocking analytics cookies does not affect how the site works.
Depending on where you live, you may have the right to access the personal data we hold about you, to have it corrected or deleted, to receive it in a portable format, to object to or restrict processing, and to withdraw consent where we rely on it.
For users in the European Economic Area and the United Kingdom, we process personal data on these bases:
Open question - founder decision required
Analytics consent for EEA and UK visitors. The previous policy named consent as the legal basis for analytics. There is no consent banner on the site and analytics load unconditionally, so that basis was not available and has been removed rather than restated. Two ways to close this, and the choice is commercial: add a consent banner that gates analytics for EEA and UK visitors, or geo-restrict analytics so it does not run for them at all. Until one of them ships, this policy should not claim a consent basis for analytics. A privacy lawyer should confirm whether legitimate interests can carry any part of it in the interim.
To exercise any of these rights, use the form in Section 17 or contact us using the address in Section 15. We will respond within 30 days. You also have the right to complain to your local data protection authority.
This section applies to California residents under the CCPA as amended by the CPRA. In the preceding twelve months we have collected the following categories of personal information:
We do not sell personal information, and we have not sold personal information in the preceding twelve months. We do not knowingly collect or process sensitive personal information through this website, and we do not use personal information for cross-context behavioral advertising.
You have the right to know what we collect, to delete it, to correct it, to obtain a portable copy, and not to be discriminated against for exercising those rights. Use the form in Section 17 or the address in Section 15.
Open question - founder decision required
Whether analytics counts as "sharing", and therefore whether a Do Not Sell or Share link and Global Privacy Control support are required. This turns on a setting that cannot be read from the code: whether Google Signals or advertising features are enabled on the Google Analytics property, and whether Google is engaged as a service provider under contract terms that restrict its use of the data. If advertising features are on, analytics may constitute "sharing" for cross-context behavioral advertising, which would require a Do Not Sell or Share mechanism and honoring Global Privacy Control signals. Neither exists today. Check the analytics property settings, then have counsel confirm the conclusion before this section is finalized.
International transfers. We are based in the United States and the third parties listed in Section 8 process data in the United States and other countries. If you access the Services from the European Economic Area or the United Kingdom, your personal information will be transferred outside your home jurisdiction. Where a transfer requires a safeguard, we rely on the mechanisms our providers make available, including standard contractual clauses where they offer them.
Children. The Services are not directed to children, are intended for business use, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us personal information, contact us and we will delete it.
Separate agreements. Paid customers and organizations enrolled in the Enterprise Design Partner program may be covered by a separate written agreement, which may include a data processing agreement. Where such an agreement exists and conflicts with this policy, that agreement governs. Nothing in this paragraph should be read as confirming that any particular agreement is already in place; ask us and we will tell you what applies to you.
Open question - founder decision required
Whether a data processing agreement and standard contractual clauses actually exist, and which contact address is real. Two things could not be verified. First, no executed DPA or SCC set could be confirmed, so this page says only that one "may" apply; if none exists, an enterprise buyer will ask for it on day one, and if one does exist it should be named and offered here. Second, this page directs privacy requests to an address that has not been confirmed to be monitored, while the Terms of Use direct legal questions elsewhere and the security policy uses a third address. Confirm which mailboxes exist and are read, then make the contact points consistent across the Terms, this policy, and the security policy.
For privacy questions or to exercise your rights, contact us at hello@dataworkers.io. For legal and partnership matters, contact partners@dataworkers.io, which is the address used in our Terms of Use.
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Continued use of the Services after changes constitutes acceptance of the revised policy.
To unsubscribe from our emails or request deletion of your personal information (GDPR / CCPA), submit your address below. We remove it from every outreach list and enrichment cache and confirm within 45 days.
© 2026 Data Workers, Inc. All rights reserved.