yourworkHQBack to home

Privacy Policy

Last updated: July 17, 2026

This Privacy Policy explains how Cyntheion Consulting Corp. ("Cyntheion", "we", "us", or "our") collects, uses, shares, and protects information in connection with YourWorkHQ Portal (the "Service"). It applies to the agencies and enterprise teams who register an Organization on the Service ("Customers"), the clients they invite into their Organization's portal, and visitors to our marketing site. This Policy should be read alongside our Terms of Service.

1. Overview

YourWorkHQ Portal is a multi-tenant, branded client-portal platform. Most of the content in the Service — projects, messages, deliverables, invoices — is Customer Data that an Organization and its clients enter themselves; we process it on the Organization's behalf, not for our own purposes. Separately, we collect a smaller set of information directly — account details, billing information, and usage data — to operate, secure, and improve the Service, described below.

2. Information We Collect

  • Account information: name, work email, organization name and subdomain, password (stored hashed), and role.
  • Customer Data: projects, milestones, messages, deliverables, invoices, and any other content an Organization or its clients enter into the portal.
  • Billing information: plan, billing cycle, and subscription status. Card details are collected and stored by our payment processor, not by us directly.
  • Usage & log data: IP address, browser and device information, pages viewed, and actions taken, collected for security, debugging, and product-improvement purposes.
  • Communications: messages you send us for support, sales, or demo requests, and your preferences for receiving marketing communications.

3. Cookies & Tracking

Our marketing site uses cookies and similar technologies. You can choose which categories to allow through the cookie banner shown on your first visit, or update your choice at any time by clearing your browser's local storage for our site:

  • Essential: required for the site to function (e.g. remembering your cookie preference). Cannot be disabled.
  • Analytics: Vercel Analytics, used to understand aggregate traffic and site performance. Only loaded if you accept analytics cookies.
  • Marketing: HubSpot, used to track form submissions and, where enabled, to personalize content and follow up on inquiries. Only loaded if you accept marketing cookies.

The Service itself (the logged-in portal) uses only essential, strictly-necessary cookies for authentication and session management — these aren't subject to the marketing-site cookie banner.

4. How We Use Information

  • To provide, maintain, and secure the Service, including authenticating you and routing you to the correct Organization;
  • To process subscription billing and send related transactional notifications;
  • To respond to support requests and communicate about the Service;
  • To monitor, debug, and improve the Service's performance and features;
  • To detect, prevent, and investigate fraud, abuse, or security incidents;
  • To send marketing communications where you've consented, as described in Section 11;
  • To comply with legal obligations.

We don't use Customer Data to train any general-purpose or third-party AI/ML models, and we don't sell personal information.

5. How We Share Information

We share information with the following categories of service providers ("subprocessors"), each bound by their own data-protection obligations to us:

  • Vercel — application hosting and analytics.
  • Supabase — Postgres database hosting for Service data.
  • HubSpot — marketing form tracking and, where you've consented, marketing communications.
  • Stripe, Resend, Cal.com — only where an Organization connects its own account for invoicing, email delivery, or scheduling; that data flows directly between the Organization, its clients, and the connected provider, under that provider's own terms.

We may also disclose information where required by law, to enforce our Terms of Service, to protect the rights, property, or safety of Cyntheion, our Customers, or others, or in connection with a merger, acquisition, or sale of assets (with notice to affected Customers where required).

6. Data Isolation Between Organizations

Each Organization's Customer Data is logically isolated from every other Organization on the platform. Organization staff and invited clients can only access data scoped to their own Organization; data is never shared or pooled across tenants.

7. International Data Transfers

Cyntheion is based in Ontario, Canada, and our subprocessors host infrastructure in various regions. Where personal information is transferred outside your country (including to Canada or the United States), we rely on our subprocessors' contractual and technical safeguards to protect it consistent with this Policy and applicable law, including Canada's PIPEDA and, for EU/UK personal data, appropriate transfer mechanisms such as Standard Contractual Clauses where applicable.

8. Data Retention

We retain account and Customer Data for as long as your Organization's account is active. If you cancel your subscription, your data remains available for export for 30 days, after which it may be permanently deleted. If you close your Organization entirely, its data is deleted immediately and cannot be recovered. We may retain limited information after account closure where required for legal, tax, or security purposes.

9. Security

We use industry-standard technical and organizational measures — including encryption in transit, hashed credentials, and per-Organization data isolation — to protect information against unauthorized access, alteration, or loss. No method of transmission or storage is completely secure, and we can't guarantee absolute security.

10. Your Privacy Rights

Depending on where you live, you may have rights over your personal information under applicable law, including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the EU/UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA). These can include the right to:

  • Access the personal information we hold about you;
  • Correct inaccurate or incomplete information;
  • Delete your personal information, subject to legal or contractual exceptions;
  • Receive a portable copy of your information in a common format;
  • Object to or restrict certain processing, including for marketing;
  • Withdraw consent at any time, where processing is based on consent.

We don't sell personal information, so there's nothing to opt out of a sale of. If you're a client invited into an Organization's portal, the Organization controls that Customer Data — please contact them directly for requests related to it; we'll support them in fulfilling it. Otherwise, contact us at hello@yourworkhq.com to exercise any of these rights, and we'll respond within the time required by applicable law.

11. Marketing Communications

If you provide your email as a prospect or lead (for example by booking a demo or requesting information), we may send you marketing communications about the Service using HubSpot. Every marketing email includes an unsubscribe link, and you can opt out at any time by using that link or emailing hello@yourworkhq.com. Transactional emails (e.g. billing receipts, security notices) aren't affected by a marketing opt-out, since they're necessary to operate the Service.

12. Children's Privacy

The Service is intended for business use and isn't directed at children. We don't knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us and we'll delete it.

14. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we'll notify you by email or an in-product notice at least 14 days before they take effect. The "Last updated" date above reflects the most recent revision.

15. Contact

Questions about this Policy, or requests to exercise your privacy rights: hello@yourworkhq.com