What we hold, and what we do with it
Last updated 31 October 2026
Where things stand today
Legwork is in early access and not yet a registered company. Write to hello@uselegwork.io about your data. We aim to answer within a week. The law allows us up to a month.
This page covers the waitlist on this website, and the Legwork app as it runs today for the people using it in early access.
Who we are
The data controller is Legwork. For anything about your data, write to hello@uselegwork.io and a person will answer. There is no form and no ticket queue.
Under the UK GDPR and the EU GDPR we are the data controller for your account, and a data processor for the information you put into it about the companies and people you sell to.
The waitlist
| What | Why | How long |
|---|---|---|
| Your email address and your first name. Nothing else is asked. | To send one email confirming you joined, and to tell you when Legwork opens. Our legitimate interest in replying to somebody who asked to be told. | Until you ask us to remove it, or until twelve months after we open, whichever is first. |
We will not send you a newsletter, add you to a sequence, or pass your address to anybody. Reply to any message from us, or write to hello@uselegwork.io, and it is removed.
What the product holds, when you use it
- About you: your email address, your name if you give one, your settings, and what you have done in the product, for example which briefings you opened and what you cleared.
- About your company: what you sell, who buys it, the rules you write for a good customer, and the claims you allow it to make. All typed or uploaded by you.
- About the companies you sell to: their name, website, what it found about them publicly, and its scoring against your rules.
- About people at those companies: name, job title, work email address, and where that address came from. Business contact details only. Never a home address, never a personal account, never anything about somebody's private life.
- What it wrote for you: draft messages, morning briefings, and conversations with the assistant.
- What it cost: a record of every job it ran, so the spending is visible to you.
The people you sell to
Legwork holds work contact details for people at companies you are selling to, which those people did not give us. That is lawful in the UK and the EU as a legitimate interest, and it comes with duties we take seriously:
- Business contact details only, and only for a business purpose.
- Every address says where it came from, and an address that cannot be verified is marked unverified rather than guessed at.
- If somebody asks what we hold about them, or asks us to delete it, write to hello@uselegwork.io and we will do it. We will also tell you, our customer, so that it is removed from your account too.
Telling people we hold their details
The law says that when we get somebody's details from somewhere other than them, we should normally tell them within a month. Where a person asks, we always answer in full. Where contacting every person we hold a work address for would take more effort than it is worth to anybody, which the law recognises, this page does that job instead. That is why it is written plainly and is easy to find.
Either way: hello@uselegwork.io, and one person answers.
Decisions made by a computer
Legwork scores companies automatically against rules its customer wrote, and it drafts messages. Nothing it does makes a decision about a person that has a legal effect on them or anything similarly significant. It does not decide whether somebody gets a job, a loan, a price, or a service. Every score is about an organisation, every score shows its reasoning in plain words, and a person always decides what to do next.
Nothing here is profiling in the sense the law means it: we do not analyse individuals to predict their behaviour, performance, interests or movements.
Is there a data protection officer
No, and one is not required. That rule applies to organisations whose main work is monitoring people on a large scale, or handling sensitive categories of data on a large scale. Legwork does neither: it holds work contact details for a business purpose, and never health, political, religious, union, sexuality or biometric data.
Data protection questions go to hello@uselegwork.io. If that ever changes, this page will name whoever takes it on.
Google user data
If you use Legwork, you sign in with Google, and you may connect your Gmail so that the emails you approve go from your own mailbox.
- What we access. When you sign in: your name, email address and Google account identifier. When you connect Gmail: permission to send email (the gmail.send permission) and nothing else. Legwork cannot read, search, delete or change anything in your mailbox.
- How we use it. Your name and address to sign you in and to write to you. The send permission only to send each email you have approved in Legwork, at the time shown, and nothing else.
- How we store it. The send permission is kept encrypted in our database in Frankfurt, Germany. We keep a log of each email sent (who to, the subject, when) so you can see it in Settings.
- Who we share it with. Nobody. It is never sold, never used for advertising, and never read by a person except to fix a problem you ask us to fix.
- How to remove it. In Settings, "Stop sending from Gmail" deletes our copy of the permission at once. You can also remove Legwork at myaccount.google.com/permissions. To delete your account and everything in it, write to hello@uselegwork.io.
Legwork's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. Google Workspace APIs are not used to develop, improve or train generalised or non-personalised AI or machine learning models.
Who else sees it
Legwork uses other companies to do specific jobs. Each one sees only what that job needs.
| Who | What for | What they see | May they train AI on it? |
|---|---|---|---|
| Anthropic (United States) | Writing and research | The text of each job: your company context, what was found about a company, and the draft being written. | No. Their commercial terms forbid it. |
| OpenAI (United States) | Reading the morning briefing aloud, and turning what you say into text | The words of the briefing, or the recording you made. | No. Their terms say data sent to their API is not used for training. |
| Simli (Norway) | Sam's moving face, when you watch a briefing or review with it | The spoken audio of what Sam says. People's names are never spoken in audio sent to Simli: Sam says their job and company instead, and the names stay as text on your screen. | Yes. Simli may keep the recording to improve their service, and there is no setting to stop this. If you would rather not, choose "just voice": then nothing goes to Simli. |
| Findymail (EU), Dropcontact (EU) | Finding and checking a work email address | A person's name and their employer's website. | Not mentioned in their terms. Dropcontact says it discards contact data after each job. |
| Google (United States) | Signing you in, and sending the emails you say yes to from your own Gmail | Your name and email address when you sign in; each email you send, as it goes from your mailbox. | No, under Google's rules for these services. |
| Render (United States company, servers in Frankfurt) | Hosting: running the service and the database | Everything, as any host does. | No. Their terms allow them to process data only to run the service. |
| Cloudflare (United States company, storage held in the EU) | Storing uploaded files and the nightly backups | Those files and backups. | No. Their terms forbid it without your consent. |
| Resend (United States) | Sending Legwork's own emails (the waitlist confirmation, your morning email) and receiving replies you forward | Those emails, and replies you forward to your Legwork address. Resend keeps forwarded replies for 30 days, in the United States. | Not mentioned in their terms, which allow them to use it only to run the service. |
If you connect an assistant. You can connect Legwork to Claude, ChatGPT, Gemini or Copilot. When you do, what Legwork shows you there (your emails waiting, your accounts, the people at them) is sent to that assistant, under your own account with its company and that company's terms. It is your choice, it is off until you connect it, and you can disconnect it at any time.
We do not train or fine-tune any model on customer data ourselves, and we never will.
Some of these companies are in the United States, so your data is transferred there under the standard contractual clauses approved for that purpose. Legwork itself keeps everything in the European Union: the database is in Frankfurt, Germany, and uploaded files and backups are stored in the EU.
To stop robots filling in the waitlist form, we keep a scrambled code made from the internet address a sign-up came from, for one hour, and then delete it. We never keep the address itself.
What never leaves your account
What Legwork learns about your market, your accounts and how you write stays inside your account. It is never pooled, never shown to another customer, and never used to improve anyone else's results.
Separately, there is a setting called improve Legwork with anonymised patterns. When it is on, we count shapes across accounts: how many rules somebody wrote, how the verdicts fell, how many drafts were sent or binned, what each job cost. It contains no company name, no contact, no draft, no voice note, and not a single sentence anybody typed. It carries no account number and no code standing in for one. The settings page shows you the actual record rather than describing it.
It is on by default for individual plans and off by default for team plans, because the work on a team account belongs to an employer and one person cannot agree to it for colleagues.
Your rights
Under the UK and EU GDPR you can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to how we are using it, or ask us to stop entirely. Write to hello@uselegwork.io. We aim to answer within a week. The law allows us up to a month. It is free.
Being straight about this: today these requests are handled by a person, by email, not by a button in the product. Self-serve export and deletion are being built and this page will say so when they work. The request itself is honoured either way.
If you think we have handled your data badly you can complain to the Information Commissioner's Office at ico.org.uk, or to the supervisory authority where you live.
How long we keep things
- Your account and its contents: while your account is open, and for 30 days after you close it, so an account closed by mistake can be recovered. Then deleted.
- Waitlist address: as above.
- Billing records: six years, because tax law requires it.
Cookies
This website sets no cookies and has no analytics, no tracking pixel and no advertising tag. Nothing here follows you anywhere. The product itself will use one cookie to keep you signed in, which is necessary for it to work at all.
Changes
If we change this page we will change the date at the top, and if the change matters we will email anybody with an account rather than quietly updating it.