Privacy Policy
Last updated: 30 September 2026 · v1.3
1. Introduction
This Privacy Policy explains how Web rješenja d.o.o. ("Workspace Sync", "we", "our", "us") collects, uses and protects personal data when you or your organization use Workspace Sync: the website at workspace-sync.com, the admin dashboard at app.workspace-sync.com, and the Workspace Sync apps for iPhone and Android.
Workspace Sync is a business service. It reads your organization's Google Workspace directory and makes it available to your team in the mobile app and, if your team turns it on, in each phone's own Contacts app.
We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the GDPR. This is the only valid version of our Privacy Policy; the admin dashboard and the apps link to this page.
2. Who We Are
Workspace Sync is operated by:
Web rješenja d.o.o.
Markuševečka cesta 115
10040 Zagreb
Croatia
Tax identification number (OIB): 97669668809
For privacy questions or to exercise your rights under this policy, contact us at hello@ws.agency.
3. Who This Policy Applies To
Administrators: people who sign in to the admin dashboard to connect their organization's Google Workspace and manage Workspace Sync.
Team members: people whose details are read from their organization's Google Workspace directory, and who may use the mobile app to see their colleagues.
Website visitors: anyone who visits workspace-sync.com.
Who decides what happens to your data
- For the directory and the accounts of your team, your organization is the data controller: it decides whose details are shared, which fields are shown and who gets the app. We are its data processor and process that data only on its instructions, under our Data Processing Agreement, which forms part of our Terms of Service.
- For our own purposes (the website, billing, support, the security of our service and our legal obligations) we are the data controller.
If you are a team member and have a question about how your organization uses Workspace Sync, ask your organization's administrator first. We will help them answer it.
4. Information We Collect
4.1 Administrators
When you sign in with Google, we receive your email address, name, profile photo and your organization's Google Workspace domain. Sign-in is available with Google only.
When you sign in, our authentication provider records the time of each sign-in, your IP address and your browser's user agent, to keep your account secure.
We keep a record of changes that affect billing and the connection to Google Workspace (for example app access and seat changes, and connecting or disconnecting Google Workspace), including who made them and when.
Billing. If you pay by card, our payment processor Stripe handles your card details directly; we never receive or store them. We store a Stripe customer reference, your billing email, your country (for VAT), the card brand and last four digits, and your subscription status and history. If we invoice you directly, we also store the company name, address and VAT number you give us for the invoice.
4.2 Team members (read from Google Workspace)
When an administrator connects Google Workspace, we read the organization's directory through Google's Directory API every hour. For each person we store: first name, last name, email address, phone numbers, job title, department, organization (company name), addresses, profile photo, Google's identifier for the person and their organizational unit. The exact data depends on what your organization keeps in Google Workspace. Your administrators choose which of these fields the app shows; fields that are switched off are not sent to the app.
We also store what the service needs to run: whether each person has app access and appears in the directory, their group memberships, the number they chose to use by default for each colleague, and the time and result of each sync.
When someone is removed from your Google Workspace, they leave the directory and the app at the next hourly sync. We keep their details hidden for 30 days, so that they come back as they were if they were removed by mistake, and then delete them for good, together with their photo and, unless they are an administrator, their sign-in account. Records of billing changes keep the event but no longer name them.
4.3 The mobile app
Sign-in. You sign in with Google. We receive your email address, name and profile photo from Google.
The directory in the app. The app loads the directory from our servers while you use it. It does not keep its own copy of the directory on the phone. Your favourites, your light/dark setting and your choices in the app are stored only on your phone.
Company contacts in your phone's Contacts app. If your organization allows it and you turn it on, the app adds your colleagues to your phone's own Contacts app and keeps them up to date. On iPhone they are saved in a group called "Workspace Sync" in your iCloud contacts (or on the iPhone if it has no iCloud contacts); iCloud is your own service with Apple, and the contacts are then stored by Apple under your account. On Android they are kept in a separate "Workspace Sync" account on the phone. The app never changes or reads the details of contacts you saved yourself; on iPhone it looks through your contacts only to find the ones it added. The app removes the colleagues it added when you turn this off, sign out, lose access or your organization stops using Workspace Sync. On iPhone, colleagues stay in your Contacts if you delete the app without turning this off first.
Updates. When the app starts, it asks our update service (Expo) whether a newer version of its code is available. That request carries technical details (platform, app version and an installation identifier), not your directory.
Notifications. The app does not send push notifications. The Android app contains Google's Firebase Cloud Messaging library, which may register the phone with Google; we do not use it and we do not store push tokens.
No analytics. The app contains no analytics or advertising tools. We do not track which screens you open or how long you spend in the app.
4.4 Website visitors
The website is delivered by Cloudflare. To deliver and protect it, Cloudflare processes the technical data every web request carries: your IP address, browser and device type, the page you asked for, the time and the referring page.
We use Cloudflare Web Analytics to count page views. It does not use cookies or store anything in your browser, and it does not identify you: we see totals per page, referrer, country and device type.
The website remembers a few choices you make in your browser's local storage, such as the currency you picked on the pricing section and your progress through the setup guide in Help. These never leave your browser.
Chat. The chat loads only when you click the chat button. From then on, our self-hosted helpdesk (Chatwoot) receives your messages, anything you choose to tell us (such as your name and email address), your browser and device type, your IP address and the page you were on, and it stores an identifier in your browser so the conversation continues on your next visit.
4.5 The admin dashboard
The admin dashboard keeps your signed-in session in your browser's storage, and remembers your progress through the setup guide there. On the dashboard's admin pages, the chat described in 4.4 is available so you can reach support.
4.6 Email and support
When you contact us by email or chat, we receive your name, email address, the content of your messages and any attachments.
We send transactional emails (for example when your directory is live, when a sync keeps failing, about payments, and about important changes to the service). They are part of the service and cannot be turned off while your organization uses it.
5. How We Use the Information
- Providing the service: reading your directory, showing it to the people your administrators allow, keeping the phone's Contacts up to date where it is turned on.
- Managing accounts: signing you in and applying your organization's settings.
- Billing: subscriptions, invoices and payment-related messages.
- Security: protecting the service and investigating incidents.
- Support: answering your questions and fixing problems.
- Understanding website use: aggregated page-view counts.
- Legal obligations: under Croatian and EU law, for example tax and accounting.
We do not sell personal data, use it for advertising, or build marketing profiles.
6. Legal Basis for Processing
- Performance of a contract: to provide the service your organization signed up for, and the chat you ask for.
- Legitimate interests: security, abuse prevention, support, understanding how the website is used, and managing customer relationships. You can object to this at any time (see section 10).
- Legal obligation: for example keeping invoices under Croatian law.
For the directory and your team's accounts, your organization is the controller and determines the legal basis; we process that data on its behalf.
7. Subprocessors and Other Recipients
We do not sell personal data. We share it only with the service providers ("subprocessors") that help us run Workspace Sync:
| Subprocessor | What they do for us | Where |
|---|---|---|
| Supabase, Inc. | Database, file storage (contact photos), sign-in and server functions for the admin dashboard and the apps | Database and files in the EU (Ireland); server functions may run in the region closest to the request; photos are delivered through a content delivery network |
| Hetzner Online GmbH | Servers for the admin dashboard and for our self-hosted helpdesk (Chatwoot) | EU (Finland and Germany) |
| Cloudflare, Inc. | Delivery and protection of the website, cookieless website analytics, and DNS | Global network; United States company |
| Google LLC | Google Sign-In, the Google Workspace Directory API, and the Firebase library in the Android app | United States and EU |
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Card payments, subscriptions, invoices and tax calculation | EU (Ireland) and United States |
| Mailgun Technologies, Inc. (Sinch) | Sending our transactional emails | United States |
| 650 Industries, Inc. (Expo) | Delivering app updates to the mobile apps | United States |
Each subprocessor processes personal data on our instructions under a contract with data protection terms. We keep this list current and announce changes to it here; customers who have signed our Data Processing Agreement are told in advance, as it describes.
Apple and Google also distribute the apps through their app stores, and Apple stores iPhone contacts in iCloud for users who use iCloud. Those are your own relationships with Apple and Google, under their terms.
We may disclose personal data when the law requires it, to protect our rights, property or safety, or as part of a merger or sale of our business, in which case this policy continues to apply.
8. International Data Transfers
Our database, file storage, admin dashboard and helpdesk are in the European Union. Some subprocessors are United States companies or work on a global network, so personal data can be processed outside the European Economic Area: by Cloudflare, Google, Stripe, Mailgun and Expo, and by Supabase's server functions. Your directory itself comes from Google, and email we send passes through Mailgun in the United States.
Each of these transfers is protected by the EU-US Data Privacy Framework, where the provider is certified under it, or by the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards at hello@ws.agency.
9. Data Retention
| Data | How long we keep it |
|---|---|
| Administrator and team member accounts | While the organization uses Workspace Sync. When an organization is deleted, its data is kept for 30 days so the deletion can be undone, and is then permanently deleted. We delete it straight away if the organization asks us to. |
| The directory | As for accounts. A person removed from Google Workspace leaves the directory and the app within an hour, and their details are deleted 30 days later (section 4.2). |
| Company contacts in a phone's Contacts app | Until they are removed from the phone as described in section 4.3. |
| Sync results and the record of changes described in section 4.1 | While the organization uses Workspace Sync; deleted with it. |
| Sign-in records | While the account exists; deleted with it. |
| Chat and email conversations with support | As a record of the help we gave, so we can follow up on earlier questions. Deleted on request. |
| Invoices and billing records | 11 years, as Croatian accounting and tax law requires. |
| Website request data (Cloudflare) | For the short period Cloudflare keeps request logs; we keep no copy. |
Cancelling a paid subscription deletes nothing: the organization moves to the free plan and keeps its directory. Deleting an organization is a separate step that an administrator asks us for (see Delete your account and data). Deleted data can remain in our providers' encrypted backups until those backups expire in their normal cycle.
10. Your Rights
Under the GDPR, you have the right:
- of access: to get a copy of the personal data we hold about you;
- to rectification: to have inaccurate data corrected;
- to erasure: to have your data deleted, subject to legal obligations;
- to restriction of processing;
- to data portability: to receive data you gave us in a machine-readable format;
- to object to processing based on legitimate interests.
Most details in the directory come from your organization's Google Workspace, so your organization's administrator can usually correct or remove them fastest. You can also email hello@ws.agency. We answer within 30 days, free of charge unless a request is manifestly unfounded or excessive. Where we process your data for your organization, we pass your request to it and help it respond.
You can also complain to the Croatian data protection authority:
Agencija za zaštitu osobnih podataka (AZOP)
Selska cesta 136, 10000 Zagreb
Email: azop@azop.hr
Web: azop.hr
11. Security
- Encryption in transit: every connection uses TLS (HTTPS).
- Encryption at rest: our database and file storage are encrypted at rest, and the Google Workspace key you upload is stored encrypted in a separate secrets vault.
- Access control: team members see only the directory their organization shares with them, with the fields their administrators allow. Only our staff who need it to run the service can reach customer data.
- Records: changes that affect billing and the Google Workspace connection are recorded, as described in section 4.1.
No system is completely secure. If a personal data breach affects you, we will notify the affected organizations and the supervisory authority as the GDPR requires.
12. Cookies and Browser Storage
Website. Nothing is stored in your browser for tracking, and we set no cookies until you use the chat. Cloudflare may set a strictly necessary security cookie to protect the site from automated abuse. The currency and setup-guide choices described in 4.4 are kept in your browser's local storage only because you made them. When you open the chat, Chatwoot stores an identifier so the conversation can continue.
Admin dashboard. Your signed-in session and setup-guide progress are kept in your browser's storage; the chat works as on the website.
All of this is strictly necessary for something you asked for, so it does not need your consent under the ePrivacy rules. We use no advertising or analytics cookies and no tracking pixels. If that ever changes, we will ask for your consent first.
13. Children
Workspace Sync is a business service for organizations and their adult staff. It is not directed at children, and we do not knowingly collect personal data from anyone under 16. If an organization gives access to someone under 16, that is its responsibility. If we learn that we hold a child's data without a valid legal basis, we delete it.
14. Changes to This Policy
When we change this policy we update the date and version at the top of this page. Before a material change to how we handle personal data takes effect, we tell the administrators of every organization using Workspace Sync by email at least 30 days in advance.
15. Contact
Web rješenja d.o.o.
Markuševečka cesta 115, 10040 Zagreb, Croatia
Email: hello@ws.agency