WRKROOT Privacy Policy

Last updated: May 3, 2026

1. WRKROOT Contact Details

Controller / business entity:

WRKROOT HR SOLUTIONS LLC, 30 N Gould St Ste N, Sheridan, SHERIDAN COUNTY, WY 82801 USA

Privacy contact: info@wrkroothr.com Legal notices: info@wrkroothr.com Support: info@wrkroothr.com Billing: info@wrkroothr.com

2. Scope Of This Policy

This Privacy Policy applies to personal information we process through:

• wrkroot.com and related WRKROOT web pages.
• WRKROOT platform accounts.
• Talent, client, and admin/recruiter workflows.
• Marketplace, hiring, interview, engagement, contract, billing, attendance, KPI, assessment, credential, support, notification, and email functions.
• Communications with WRKROOT.
• Future website tools such as analytics, contact forms, newsletter forms, chat widgets, tracking pixels, cookies, or similar technologies.

This Privacy Policy does not apply to:

• Third-party websites or services that are not controlled by WRKROOT.
• Client systems, applications, records, or environments that talent may access while performing services for a client.
• Protected health information governed by a separate Business Associate Agreement, except as described in the HIPAA and healthcare customer section below.

3. Information We Collect

The information we collect depends on your role and how you use WRKROOT.

3.1 Website Visitor Information

The public website currently does not intentionally collect extensive visitor information. However, we may collect or later add:

• Basic device and usage information, such as IP address, browser type, device type, pages viewed, referring URLs, session data, and timestamps.
• Information submitted through contact forms, demo requests, newsletter forms, chat widgets, support forms, or similar tools.
• Cookie, analytics, advertising, and tracking information if those technologies are enabled.

3.2 Account And Contact Information

For platform users, we may collect:

• Name.
• Username.
• Email address.
• Password hash and authentication information.
• Role, such as talent, client, admin, or recruiter.
• Display name.
• Phone country code and phone number.
• Country.
• Timezone.
• Notification preferences.
• Account status, such as active, blocked, or blacklisted.
• Account notes, status timestamps, and admin update records.

3.3 Talent Profile And Marketplace Information

For talent users, we may collect:

• Professional headline, biography, introduction, job title, industry, and sub-industry.
• Skills and skill descriptions.
• Work experience, education, credentials, certifications, licenses, transcripts, and work proof.
• Profile photo, pitch video, uploaded documents, and file metadata.
• Work preferences, preferred work hours, work days, work mode, preferred client country, and availability information.
• Profile review status, admin comments, approval records, marketplace readiness, featured status, and marketplace visibility data.
• Marketplace profile views, including viewer role, viewer user where applicable, session key, and viewed timestamp.

3.4 Client And Company Information

For client users and client representatives, we may collect:

• Company name.
• Contact title.
• Industry and sub-industry.
• Company country.
• Hiring requests, role requirements, shift and timezone preferences, required skills, experience preferences, degree preferences, gender preferences, location preferences, work arrangement preferences, and additional hiring details.
• Pipeline status, placement readiness, commercial notes, recommendations, selected talent, progress logs, and engagement records.

3.5 Interview And Engagement Information

We may collect:

• Interview requests, proposed slots, preferred date/time, confirmed date/time, participant responses, notes, coordination summaries, interview status, decision logs, and updates.
• Engagement records linking clients and talent, including joining date, billing cadence, engagement status, paused/completed timestamps, engagement notes, and role-appropriate lifecycle updates.

3.6 Contract And Electronic Signature Information

We may collect:

• Contract templates, rendered contract bodies, merge fields, contract titles, party type, recipient legal name, recipient email, and admin notes.
• Contract status, sent/viewed/signed/declined/expired timestamps.
• Typed signature records, signer name, signer title, signer email, signature attestation, signature hash, IP address, user agent, signed timestamp, signed PDF artifacts, PDF hashes, signature certificates, and contract audit events.

3.7 Billing And Payment Information

For client billing, we may collect:

• Legal business name.
• Billing email.
• Billing contact name.
• Billing address.
• Tax ID label and last four digits, where applicable.
• Billing status and autopay preference.
• Invoice schedules, invoices, line items, currency, taxes, amounts, payment history, transaction records, provider references, payment status, and billing notes.
• Payment method metadata, such as card brand, last four digits, expiry month/year, bank name, account holder name, account type, provider name, provider token placeholder, default status, active status, and autopay authorization status.

WRKROOT should not collect or store full card numbers, CVV codes, full raw bank account numbers, or other sensitive payment credentials. When real payment processing is enabled, those values should be handled by a PCI-compliant payment provider and WRKROOT should receive only provider-safe tokens and metadata.

3.8 Attendance, Time Off, Holidays, And Verification Information

We may collect:

• Work schedules, client timezone, talent timezone, expected start/end times, workdays, grace minutes, schedule exceptions, and schedule notes.
• Clock-in and clock-out events, work date, attendance status, timestamps, minutes worked, verification method, verification notes, optional proof uploads, IP address, user agent, review status, reviewer, review timestamp, review notes, and attendance audit records.
• Time off requests, request type, start/end dates, paid/unpaid flag, reason, status, decision user, decision timestamp, decision notes, and audit events.
• Holiday calendars, holiday selections, holiday names, dates, holiday type, paid flags, approval status, and notes.

3.9 KPI And Productivity Information

We may collect:

• KPI plans, instructions, metric names, target values, units, cadence, and status.
• Talent submissions, work dates, summaries, proof files, actual values, calculated achievement percentages, review status, reviewer, review timestamp, review notes, and period reports.

3.10 Assessment Information

We may collect:

• Assessment templates, packages, sections, questions, choices, correct answers, scoring rules, rubrics, metadata, and instructions.
• Assessment assignments, attempts, answers, answer JSON, score reports, file-upload answers, original file names, content types, file sizes, warning counts, started/submitted timestamps, submission reason, manual grades, section reviews, reviewer assignments, review notes, and audit events.
• Security or safeguard events during assessment attempts, such as tab switches, focus loss, refresh events, or similar integrity signals.

3.11 Support, Notification, And Email Information

We may collect:

• Support ticket subject, category, preferred channel, preferred call time, preferred contact window, priority, status, assigned admin, messages, attachments, internal notes, and support audit events.
• In-app notifications, notification recipients, actors, event type, title, body, action URL, read/unread state, and creation time.
• Email templates, email recipients, event keys, rendered subject/body, context data, provider metadata, status, error messages, queued timestamps, and sent timestamps.

3.12 Uploaded Files And Metadata

WRKROOT may process uploaded files, including:

• Talent profile photos.
• Talent pitch videos.
• Credential documents.
• Assessment file-upload answers.
• Attendance proof files.
• KPI proof files.
• Support attachments.
• Contract signed PDF artifacts.

File metadata may include stored file path, original file name, content type, file size, upload timestamp, uploading user, and related account or record.

3.13 Sensitive Information

Some information submitted to WRKROOT may be sensitive, including:

• Government or professional credential details contained in uploaded credentials.
• Financial or billing-related information.
• Account security and audit information.
• Health-related information if users voluntarily include it in time-off reasons, support tickets, proof files, uploaded documents, or client-related work.
• Protected health information in healthcare customer contexts, where governed by a separate Business Associate Agreement.

Users should not upload or submit sensitive information unless it is necessary, requested by WRKROOT, required for an authorized workflow, or permitted under an applicable client agreement or BAA.

4. How We Collect Information

We collect information:

• Directly from you when you create an account, complete a profile, submit a form, upload files, sign contracts, request support, submit assessments, clock in/out, submit KPIs, or communicate with us.
• From clients, talent, admins, recruiters, or authorized platform users as part of hiring, review, interview, engagement, support, billing, and operational workflows.
• Automatically through platform logs, cookies, session tools, analytics, device data, IP address, browser data, security records, and audit events.
• From service providers that support hosting, storage, payments, email, analytics, support, signatures, verification, or similar services.
• From future integrations where authorized by you, a client, or an applicable agreement.

5. How We Use Information

We use personal information to:

• Provide, operate, maintain, and improve the WRKROOT website and platform.
• Create and manage user accounts.
• Verify user roles and provide role-based access.
• Build, review, approve, lock, publish, delist, or relist talent profiles.
• Support client hiring requests, talent recommendations, interview coordination, and engagement activation.
• Manage contracts, electronic signatures, signed artifacts, and contract audit trails.
• Manage billing accounts, invoices, invoice schedules, payment method metadata, transactions, and billing disputes.
• Administer credentials, assessments, assessment scoring, manual review, integrity safeguards, and retake eligibility.
• Track attendance, schedules, verification records, time off, holidays, KPIs, productivity proof, and review workflows.
• Provide client, talent, and admin visibility into relevant engagement records.
• Send transactional emails, in-app notifications, account alerts, billing notices, contract notices, support communications, and service updates.
• Respond to support requests and operational inquiries.
• Detect, prevent, investigate, and respond to fraud, misuse, security incidents, policy violations, disputes, and unlawful activity.
• Maintain audit logs, enforce contracts and policies, and satisfy legal, tax, accounting, regulatory, security, and compliance obligations.
• Develop new features, integrations, reporting tools, analytics, and platform improvements.

6. Legal Bases For Processing

Where applicable law requires a legal basis for processing, we may process personal information based on:

• Performance of a contract or steps taken before entering a contract.
• Our legitimate interests in operating, securing, improving, and administering WRKROOT.
• Compliance with legal, tax, accounting, regulatory, employment, contractor, billing, audit, and dispute obligations.
• Consent, where required, such as for certain communications, cookies, optional uploads, electronic signatures, or specific integrations.
• Protection of rights, safety, security, and legal claims.

7. How We Disclose Information

We may disclose personal information to:

• Talent users, client users, admins, recruiters, and other authorized platform users according to role-based permissions.
• Clients, where information relates to hiring requests, interviews, talent profiles, engagements, attendance, time off, KPIs, contracts, invoices, support, or operational visibility.
• Talent users, where information relates to their profile, assessments, credentials, interviews, engagement, attendance, KPIs, time off, contracts, support, and notifications.
• Admins and recruiters, who may access operational records needed to review, coordinate, configure, audit, support, and administer the platform.
• Service providers and subprocessors that provide hosting, storage, database, email, payment, analytics, support, electronic signature, SMS/OTP, security, or similar services.
• Professional advisors, such as lawyers, accountants, auditors, insurers, and consultants.
• Government, law enforcement, regulators, courts, or other parties where required by law, legal process, security needs, or to protect rights.
• Counterparties or successors in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction.

We do not sell personal information for money. If future analytics, advertising, or tracking technologies are considered a "sale" or "sharing" under applicable privacy laws, we will provide required notices and choices.

8. Role-Based Visibility

WRKROOT is a role-based platform. This means information may be visible to different users depending on their relationship to a workflow.

Talent users may generally see their own profile, credentials, assessment records and outcomes, contracts, approved holidays, time off requests, attendance records, KPI targets/submissions/reports, support tickets, notifications, interviews, marketplace status, settings, and connected engagement information.

Client users may generally see their own company profile, hiring requests, recommended or marketplace talent, interviews, connected engagements, client contracts, invoices, payment history, payment method metadata, holidays/time off for their engagements, attendance activity for connected talent, KPI targets/submissions/reports for connected talent, support tickets, notifications, and settings.

Admins and recruiters may access platform-wide operational records needed to review, coordinate, configure, audit, support, and administer WRKROOT workflows.

9. Cookies, Analytics, And Similar Technologies

WRKROOT may use cookies, pixels, local storage, session technologies, analytics tools, advertising tools, chat widgets, newsletter tools, and similar technologies to:

• Keep users signed in.
• Secure accounts and sessions.
• Remember preferences.
• Understand website and platform usage.
• Improve features and performance.
• Measure marketing campaigns.
• Support customer communications.

Some cookies may be essential for the website or platform to work. Others may be optional or used for analytics, marketing, or personalization. Where required, WRKROOT will provide a cookie notice, consent tool, or opt-out mechanism.

Specific cookie and analytics tools are not finalized. Current placeholders include:

• Analytics provider: to be finalized
• Advertising / pixel provider: to be finalized
• Chat widget provider: to be finalized
• Newsletter / marketing email provider: to be finalized

10. HIPAA, PHI, And Healthcare Customers

WRKROOT is not intended to be used as a public medical record system, patient portal, clinical documentation platform, or direct provider of healthcare services.

WRKROOT does not directly handle protected health information ("PHI") as a healthcare provider in its ordinary website or platform operations. However, WRKROOT may support healthcare customers, and WRKROOT-provided talent may access or handle PHI within a customer's systems or workflows.

Where required, WRKROOT may enter into a Business Associate Agreement ("BAA") with a healthcare customer. Any PHI processing under a BAA will be governed by that BAA and applicable HIPAA obligations, not only by this Privacy Policy.

Users should not upload PHI into the WRKROOT platform unless:

• The upload is expressly authorized by WRKROOT and the applicable customer.
• A valid BAA or other required agreement is in place.
• The upload occurs through an approved workflow.
• The user is authorized to handle that information.

Healthcare customers are responsible for confirming their HIPAA obligations, determining whether a BAA is required, and ensuring their workforce members and assigned talent follow applicable privacy and security requirements.

11. International Users And Data Transfers

WRKROOT is based in the United States and has a global launch intent with a US focus. If you access WRKROOT from outside the United States, your information may be processed in the United States and other countries where WRKROOT or its service providers operate.

Privacy laws in those countries may differ from the laws where you live. Where required, WRKROOT will use appropriate safeguards for international transfers, such as contractual protections, data processing terms, standard contractual clauses, or other lawful mechanisms.

12. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

• Provide the website and platform.
• Maintain user accounts and role-based records.
• Support engagements, contracts, billing, invoices, support, attendance, KPIs, assessments, credentials, and marketplace workflows.
• Maintain audit trails and security records.
• Resolve disputes.
• Enforce agreements and policies.
• Comply with legal, tax, accounting, regulatory, reporting, and compliance obligations.

Users may request deletion of their accounts or personal information. However, WRKROOT may retain certain records where required or permitted for legal, billing, contract, invoice, tax, accounting, audit, dispute, fraud prevention, security, compliance, or legitimate business reasons.

Examples of records that may be retained include:

• Contracts, signatures, certificates, signed PDF artifacts, and contract audit records.
• Invoices, billing records, payment transaction metadata, and tax/accounting records.
• Attendance, KPI, assessment, credential, support, and audit records where needed for disputes, compliance, or operational accountability.
• Security logs, account status records, admin notes, and anti-abuse records.

Specific retention periods will be defined in WRKROOT's Data Retention and Deletion Policy.

13. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These may include access controls, authentication, role-based permissions, audit logs, secure storage practices, password hashing, provider security controls, and internal operating procedures.

No system can be guaranteed to be completely secure. Users are responsible for maintaining the confidentiality of their account credentials and promptly notifying WRKROOT of suspected unauthorized access.

Likely infrastructure provider: AWS, subject to final vendor confirmation.

14. Your Privacy Rights And Choices

Depending on where you live, you may have rights to:

• Access personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of personal information.
• Request a copy or portability of certain information.
• Object to or restrict certain processing.
• Withdraw consent where processing is based on consent.
• Opt out of certain marketing communications.
• Opt out of certain sale, sharing, targeted advertising, or profiling activities where applicable.
• Limit certain uses or disclosures of sensitive personal information where applicable.
• Appeal certain privacy request decisions where applicable law provides that right.

To exercise privacy rights, contact us at info@wrkroothr.com.

We may need to verify your identity before responding to a request. We may decline or limit requests where permitted by law, including where information must be retained for legal, billing, contract, tax, audit, security, fraud prevention, dispute, or compliance reasons.

Authorized agents may submit requests where permitted by applicable law. We may require proof of authorization and may also require the user to verify their identity directly.

15. California Privacy Notice

This section applies to California residents where the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), applies to WRKROOT.

Categories Of Personal Information Collected

In the preceding 12 months, WRKROOT may have collected the following categories of personal information:

• Identifiers, such as name, username, email, phone number, IP address, user ID, and account identifiers.
• Customer records information, such as billing address, billing contact details, and partial tax/payment metadata.
• Protected classification information where voluntarily provided or included in hiring preferences or uploaded materials, subject to applicable law and policy restrictions.
• Commercial information, such as invoices, transaction records, billing status, payment method metadata, and service history.
• Internet or electronic network activity, such as device data, browser data, log data, session data, marketplace views, assessment safeguard events, IP address, and user agent.
• Professional or employment-related information, such as job title, work history, education, skills, credentials, work preferences, assessment records, KPI records, attendance records, and engagement records.
• Education information, such as degrees, field of study, institute name, transcripts, certifications, or uploaded education documents.
• Audio, electronic, visual, or similar information, such as profile photos, pitch videos, uploaded files, signed PDFs, support attachments, and proof files.
• Sensitive personal information, such as account login credentials, partial financial or tax-related metadata, precise information in uploaded documents, and health-related information voluntarily submitted in limited contexts.
• Inferences or profile-related information, such as marketplace readiness, assessment outcomes, KPI achievement percentages, recommendation records, and operational status classifications.

Purposes For Collection And Use

We collect and use these categories for the purposes described in this Privacy Policy, including account management, platform operation, marketplace visibility, hiring, interviews, engagements, contracts, billing, attendance, KPIs, assessments, credentials, support, communications, security, compliance, audit, legal obligations, and service improvement.

Sale Or Sharing

WRKROOT does not sell personal information for money. If future analytics, advertising, pixels, or tracking tools are considered "selling" or "sharing" personal information under California law, WRKROOT will provide required notices and opt-out mechanisms.

Retention

WRKROOT retains personal information for the periods described in the Data Retention section above and in its Data Retention and Deletion Policy once finalized.

California Rights

California residents may have the right to:

• Know what personal information we collect, use, disclose, sell, or share.
• Access personal information.
• Delete personal information, subject to exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing, where applicable.
• Limit the use or disclosure of sensitive personal information, where applicable.
• Not be discriminated against for exercising privacy rights.

To submit a California privacy request, contact info@wrkroothr.com.

16. EU, UK, And Other International Privacy Rights

Where the EU GDPR, UK GDPR, or similar laws apply, users may have rights to:

• Access personal data.
• Rectify inaccurate personal data.
• Erase personal data.
• Restrict processing.
• Object to processing.
• Receive data portability.
• Withdraw consent.
• Lodge a complaint with a supervisory authority.

WRKROOT's role as controller, processor, business, service provider, or contractor may vary depending on the workflow and applicable agreement. For example, WRKROOT may act as a service provider or processor for certain client-controlled data and as an independent controller/business for account administration, billing, security, legal compliance, and platform operations.

EU/UK representative details, if required: to be finalized

17. Communications Preferences

You may receive transactional, operational, legal, security, contract, billing, support, and service-related communications from WRKROOT. These communications may be necessary to provide the platform and may not be fully optional.

You may be able to manage certain notification preferences in your account settings, including email notifications, in-app notifications, security alerts, and product updates.

Marketing communications, if enabled, will include any legally required unsubscribe or opt-out mechanism.

18. Children's Privacy

WRKROOT is intended for business, professional, talent, client, and administrative use. It is not directed to children. Users should not create an account or submit personal information if they are under the minimum age required by applicable law or under any eligibility age stated in WRKROOT's Terms of Service.

We do not knowingly sell or share personal information of children.

19. Third-Party Services

WRKROOT may link to or integrate with third-party services. Third-party services may have their own privacy policies and practices. WRKROOT is not responsible for third-party privacy practices unless required by applicable law or a written agreement.

Vendor and subprocessor details are not finalized. Current likely or possible provider categories include:

• Hosting/infrastructure: AWS or another cloud provider.
• Email delivery: to be finalized
• Payment processing: to be finalized
• Electronic signature: to be finalized
• Analytics: to be finalized
• SMS/OTP: to be finalized
• Support/chat: to be finalized
• File storage: to be finalized

WRKROOT will maintain a Vendor/Subprocessor List as providers are finalized.

20. Changes To This Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by the "Last updated" date above. If changes are material, we may provide additional notice through the website, platform, email, in-app notification, or other appropriate means.

21. How To Contact Us

For privacy questions or requests, contact:

WRKROOT HR SOLUTIONS LLC
Address: 30 N Gould St Ste N, Sheridan, SHERIDAN COUNTY, WY 82801 USA
Email: info@wrkroothr.com