Privacy Policy

Depending on how you use WorkSell, we may process the following categories of data:

• Account data (email, user ID) when you sign up or sign in (Firebase Auth).
• Usage and security data (e.g., IP/header-derived identifiers) for abuse prevention (rate limiting).
• Stripe Connect account data (e.g., Stripe account ID) when you connect Stripe to accept payments.
• Terms and privacy acceptance records: which version you accepted, when, and the IP address and browser user agent used at the time.
• Seller content: the products, files and cover images you upload, the invoices you issue, and the client records you create or import from a CSV (name, email, company).
• Data your own customers give you, which we process on your behalf so that your storefront and invoices work: buyer email addresses on orders and started checkouts, invoice recipient details, download and refund records, and messages sent to you through a contact form. You decide what goes in here; we process it to operate the service for you.
• Messages you send us through our own contact form (name, email, subject and message).
• Aggregate referral counts: a daily tally of visits arriving from AI answer engines, per source and page. Stored as totals only — no identifier, no profile, and no record of an individual visit — and kept for two years.

• Provide and operate the service.
• Security, abuse prevention, and rate limiting.
• Account and subscription management.
• Sending transactional email (login codes, invoices, download links, contact requests).
• Debugging and service improvement.

• Art. 6(1)(b) – performance of a contract (providing the service).
• Art. 6(1)(f) – legitimate interests (security, abuse prevention, reliability).
• Art. 6(1)(f) – legitimate interests (aggregate, non-identifying measurement of which channels bring visitors).
• Art. 6(1)(c) – legal obligation (e.g., tax/accounting duties for payments).

We use the following providers (as applicable):

• Vercel – hosting/deployment and server functions.
• Firebase (Google) – authentication, database (Firestore) for user/subscription metadata, and file storage (Cloud Storage for Firebase) for product files, cover images and buyer downloads.
• Stripe – payment processing via Stripe Connect (we do not store full card details).
• Resend – delivery of all transactional email (login codes, invoices, download links, contact-form messages). Recipient names and email addresses pass through it, including those of your buyers and clients.

Depending on the provider, data may be processed outside the EU/EEA (e.g., in the United States). Where applicable, we rely on appropriate safeguards (e.g., Standard Contractual Clauses where available) and/or relevant certifications/frameworks of providers.

• Account data: until you delete your account.
• Stripe Connect data: as long as your Stripe account is connected, or until you disconnect.
• Payment, tax, consent, fraud-prevention, and paid-download entitlement records: only as long as required by law or our stated security purpose; account identifiers are pseudonymized after deletion.

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection (Art. 21 GDPR)

To exercise your rights, contact us using the details in Section 1.

WorkSell uses only necessary cookies where required. We set no analytics or marketing cookies and use no third-party analytics service. The aggregate referral counts described in Section 2 use your browser's sessionStorage rather than a cookie, and are discarded when you close the tab. See the Cookie Policy for detail.

We may update this Privacy Policy as our service or legal requirements change.