How we collect, use, and protect your information.

Last updated: October 9, 2026

1. Information We Collect

When you use workshelter.co, we may collect the following information:

  • Account information: Name, email address, and password when you create an account.
  • Order information: Shipping address, billing details, and purchase history when you place an order.
  • Contact information: Name, email, company name, and message content when you use our contact or quote request forms.
  • Newsletter: Email address when you subscribe to our newsletter.
  • Usage data: Pages visited, time spent, browser type, device type, and IP address collected through analytics.
  • Cookies: We use cookies for essential site functionality, analytics, and preferences. See Section 6 for details.

2. How We Use Your Information

We use your information to:

  • Process and fulfill your orders
  • Send order confirmations and shipping updates
  • Respond to your inquiries and quote requests
  • Send newsletter updates (only with your consent)
  • Improve our website and services through analytics
  • Prevent fraud and ensure security

3. Third-Party Services

We share your information with the following services, only as necessary to operate our business:

  • Stripe: Payment processing. Stripe handles your payment card data directly and is PCI-DSS compliant. We never store your full card number. Stripe Privacy Policy
  • Supabase: Database and authentication services. Your account data and order history are stored securely. Supabase Privacy Policy
  • Resend: Transactional email delivery (order confirmations, contact form replies). Resend Privacy Policy
  • Vercel: Website hosting and analytics. Vercel Privacy Policy
  • Google Analytics: Website usage analytics (when enabled and consented to). Google Privacy Policy
  • Google Workspace: Business email and workbook connections, only after an authorized operator approves the applicable Google account permissions. See the connected account details below.
  • Xero: Read-only accounting data from the US company ledger explicitly selected by an owner.
  • AI service providers: Configured providers, such as Anthropic or OpenRouter and its model providers, process content for features such as email classification and business evidence summaries. Email subjects, message text and relevant headers may be included in those requests.
  • Sanity: Content management for our website. Newsletter subscriber emails are stored in Sanity. Sanity Privacy Policy
  • Sentry: Error tracking to improve site reliability. May collect anonymized error context. Sentry Privacy Policy

Connected Business Accounts

Our admin tools can connect an authorized business Gmail account for customer conversations, or separately connect business mailboxes and selected Google Sheets workbooks for read-only business evidence. Google asks the account holder to approve the requested permissions. Connecting one account does not authorize access to another.

Email connections access account identity, labels, conversation identifiers, message dates, sender and recipient details, subjects and message content. The shared Inbox caches matching conversations and supports replies explicitly sent by an authorized operator. Separate business mailbox connections only read messages. Workbook connections read the configured business workbooks to show order, production and shipping evidence.

Connected information is stored in our database and shown according to staff permissions. Raw business mailbox evidence is restricted to owners; operational teams receive authorized structured updates. AI summaries and proposed business facts require owner review and do not themselves approve specifications, release production or send replies.

Xero connections read invoices, payments, contacts, company settings and permitted cash and profit reports from the selected US ledger. Financial evidence is restricted to owner views. The connection does not change accounting records or make payments.

Disconnecting in admin Settings stops future synchronization. You can also revoke access in your Google Account. Previously cached conversations, source evidence and review history remain available for business records; disconnecting does not delete them. To request access, correction or deletion of retained data, contact hello@workshelter.co.

Information received through Google APIs is used for the connected features described here, subject to the Google API Services User Data Policy, including its Limited Use requirements.

4. Data Retention

We retain your personal information for as long as necessary to provide our services:

  • Account data: Retained while your account is active. You can request deletion at any time.
  • Order data: Retained for 7 years for tax and legal compliance.
  • Contact form submissions: Retained for 2 years.
  • Newsletter subscriptions: Retained until you unsubscribe.
  • Analytics data: Aggregated and anonymized after 26 months.

5. Your Rights

You have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate personal data
  • Delete your personal data (subject to legal retention requirements)
  • Withdraw consent for marketing communications at any time
  • Export your data in a portable format
  • Object to processing of your personal data

To exercise any of these rights, contact us at hello@workshelter.co.

6. Cookies

We use the following types of cookies:

  • Essential cookies: Required for authentication, cart functionality, and site security. These cannot be disabled.
  • Analytics cookies: Used by Vercel Analytics and Google Analytics to understand how visitors use our site. These are only set with your consent.
  • Preference cookies: Remember your settings such as theme preferences.

You can manage your cookie preferences using the cookie consent banner that appears when you first visit our site, or through your browser settings.

7. Security

We implement industry-standard security measures including:

  • HTTPS encryption for all data in transit
  • Secure payment processing through Stripe (PCI-DSS Level 1)
  • Row-level security on our database
  • Regular security audits of our codebase
  • Content Security Policy headers to prevent XSS attacks

8. International Transfers

Work+Shelter operates from Delhi, India and Chicago, USA. Your data may be processed in either location. We ensure appropriate safeguards are in place for any international data transfers.

9. Children

Our services are not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our website. Your continued use of our services after changes are posted constitutes acceptance of the updated policy.

11. Contact Us

If you have questions about this Privacy Policy or your personal data, contact us at: