Introduction
This Privacy Policy explains how Reva Labs, an Ontario-registered business (“Reva Labs,” “Worktable,” “we,” or “us”), handles personal information when you visit worktable.dev or worktable.cloud, use Worktable Cloud, or contact us.
Worktable can also run locally or on infrastructure you control. In those modes, your workspace stays in the location you choose and is not sent to Reva Labs through ordinary product operation. This Policy covers information that Reva Labs actually receives.
Information we collect
Account information
When you create or use a Worktable Cloud account, we process identifiers and profile information supplied through WorkOS. This may include your name, email address, profile image, WorkOS user ID, sign-in method, session information, and authentication events.
Workspace information
Worktable Cloud stores the content you choose to put in your hosted workspace, including documents, HTML docs, records, annotations, threads, version history, files, widget state, and related metadata. Your workspace runs in a dedicated hosted runtime.
Service and agent information
We process workspace identifiers, membership and entitlement state, provisioning state, connected-agent registrations, authorization scopes, audit events, request metadata, errors, and security events needed to operate and protect the service.
Billing and support
Polar, our Merchant of Record, collects payment and tax information during checkout. We receive customer, order, subscription, refund, and receipt identifiers needed to provide access and support you. We do not receive or store full payment-card numbers. We also keep the information you send when you ask for support or make a legal, privacy, or security request.
How we use information
We use personal information only as needed to:
- create, authenticate, and secure your account;
- provision, route, synchronize, and export your workspace;
- authorize the agents and applications you connect;
- process subscriptions, refunds, taxes, and access decisions;
- provide support and service-related communications;
- maintain reliability, prevent abuse, and investigate incidents;
- enforce our Terms and comply with law; and
- understand the service using aggregate or de-identified operational information that cannot reasonably identify you.
No training, sale, or advertising
Reva Labs does not use customer content or personal information to train artificial-intelligence or machine-learning models. We do not sell customer content or personal information. We do not use it for advertising or ad targeting.
Agents and providers you choose
When you connect an agent or application, you direct Worktable to let it read or change workspace information within the permissions you approve. The agent, model provider, and client you choose may process that information under their own terms and privacy policies.
Reva Labs does not use or permit its service providers to use Worktable customer content for model training. This promise does not change the separate terms of a third-party service you deliberately connect and direct to process your content. Review those terms before sending confidential, regulated, or personal information.
Service providers
We use a small set of providers to operate Worktable Cloud. They process information for the purposes below and under their own contractual and legal obligations:
- WorkOS for account authentication and agent authorization. Privacy policy.
- Convex for account, workspace, provisioning, entitlement, and audit records. Privacy policy.
- Cloudflare for the public gateway, networking, DNS, security, and email routing. Privacy policy.
- Fly.io Sprites for dedicated workspace compute, filesystem storage, and recovery checkpoints. Privacy policy.
- Polar for checkout, payment processing, tax, receipts, subscription management, and refunds. Privacy policy.
- Vercel for the public marketing and legal website. Privacy notice.
We may also disclose information to professional advisors, comply with a lawful request, protect users or the service, or complete a sale or reorganization of the business. Any successor must take on the commitments in this Policy for information it receives.
Retention and deletion
We keep active account and workspace information while you use Worktable Cloud. When paid access ends, your workspace becomes export-only for 30 days and is then deleted. You may request earlier deletion. Exporting a workspace does not delete it.
- Temporary workspace transfer files are deleted after 24 hours.
- Operational logs and diagnostic metadata are normally deleted within 30 days.
- Closed-account audit and security records are deleted or de-identified within 90 days unless needed for an active incident, fraud investigation, or legal claim.
- Support correspondence is normally kept for up to 12 months after the request is resolved.
- Necessary billing and tax records may be kept for up to six years.
- Records of privacy breaches are kept for at least two years as required by Canadian law.
Deletion removes or irreversibly de-identifies the related account, control-plane, workspace, membership, and agent-registration data unless a record must be retained for one of the limited reasons above. Provider recovery copies age out through their normal rotation and are not restored except for disaster recovery.
Your choices and privacy rights
You can export your complete workspace, disconnect agents, manage or cancel billing, and ask us to access, correct, or delete personal information we hold about you. You may also raise a privacy complaint or ask how your information has been used or disclosed.
Email legal@worktable.dev from the address associated with your account. We may need to verify your identity before acting. We aim to respond within 30 calendar days and will explain if applicable law permits more time.
You may also complain to the Office of the Privacy Commissioner of Canada or another privacy regulator with jurisdiction where you live.
Security and international processing
We use administrative, technical, and organizational safeguards designed for the information Worktable processes. These include encrypted transport, separated human and agent credentials, workspace-scoped authorization, short-lived request-bound browser assertions, request-forgery protection, provider webhook verification, access controls, and data-minimized logging.
Worktable is operated from Canada. Our providers process information in Canada, the United States, and other countries where they operate. Information in another country may be subject to lawful access by authorities there. We remain responsible for personal information processed for us.
No service can guarantee absolute security. Protect your identity account, devices, connected agents, and exported files, and report suspected vulnerabilities under our Security Policy.
Children
Worktable Cloud is for adults. You must be at least 18 years old and able to enter into a binding agreement to create an account or purchase a subscription. We do not knowingly provide Worktable Cloud accounts to children. Contact us if you believe a minor has provided personal information through the service.
Changes and contact
We may update this Policy as Worktable or the law changes. We will post the revised Policy here, update the dates above, and give additional notice before a material change takes effect when reasonably practicable or required by law.
Questions, privacy requests, and complaints can be sent to legal@worktable.dev.
Reva Labsan Ontario-registered business