Privacy policy
Last updated: 30 October 2026
WORK³ is a work and project tool made by NOD³ Solutions AB, org. no. 559596-1706, Sweden (“NOD³”, “we”). This policy explains how we handle personal data when you use WORK³, its documentation and its integrations.
Two roles
Section titled “Two roles”- Content in a workspace (projects, items, comments, files, chats): the organisation that owns the workspace decides what goes in and why. It is the controller, and NOD³ is its processor. Our data processing agreement governs this. Questions about that data go to the organisation first.
- Your account and our service (sign-in, security, support, invoicing): NOD³ is the controller. The rest of this policy is about this part.
What we collect
Section titled “What we collect”| Data | Why | Legal basis |
|---|---|---|
| Name, email address, profile picture if you add one, language, time zone | Your account, so you can sign in and colleagues can recognise you | Contract |
| Sign-in data: Google account id, sign-in codes (stored as hashes), passkeys (public keys only) | Signing you in safely | Contract |
| Signed-in devices: a device label such as “Chrome on Windows”, when created and last used (to the day) | So you can see and sign out your devices | Legitimate interest (security) |
| Network address (IP), stored only as a hash and kept for at most a day | Limiting abuse of the sign-in form and of new accounts | Legitimate interest (security) |
| When you accepted the terms, and which version | Showing that the agreement was accepted | Contract |
| Audit log of actions in a workspace | Security and traceability for the workspace | Processed for the workspace owner (see above) |
| Support conversations and billing contacts | Helping you and invoicing | Contract, legal obligation (bookkeeping) |
We do not use analytics, advertising or tracking tools, and we do not sell personal data. Your clients’ contacts stay in your CRM; WORK³ keeps only a reference to them.
How long we keep it
Section titled “How long we keep it”- Your account: as long as you have one. Ask us to delete it and we do, except what the law makes us keep.
- Sessions: they end after 30 days without use, and at the latest 90 days after you signed in.
- Sign-in codes: valid for 10 minutes; the request records are removed after a day.
- Audit log: 90 days, 1 year or 2 years, as the workspace owner chooses.
- Deleted workspaces: closed at once and kept for 30 days so an owner can restore them, then removed for good, and from our backups within 14 days after that. On request we remove one sooner.
- Bookkeeping records: 7 years, as Swedish law requires.
Where it is stored and who helps us
Section titled “Where it is stored and who helps us”WORK³ is hosted in the EU (Hetzner, Helsinki). A small number of providers help us run the service; they are listed under subprocessors. If a provider is outside the EU/EEA, the transfer relies on the EU–US Data Privacy Framework or the EU standard contractual clauses.
Integrations and AI assistants
Section titled “Integrations and AI assistants”Integrations such as Slack, Google Drive, Attio, HubSpot, Pipedrive, Claude and ChatGPT are off until someone in your workspace connects them. When they are connected, WORK³ sends the data that the integration needs to that service, as described on its page in the docs. These services are not our subprocessors: your organisation (or you, for an AI assistant) chose them and uses them under its own agreement with them. Read more under Integrations and AI.
The built-in AI assistant is part of WORK³. When it runs on WORK³ AI credits, your question, any files you attach to it, and what the assistant looks up for it are sent to Anthropic, our subprocessor, to produce the answer. Conversations and their attached files are kept for 30 days, encrypted, and only the person who had them can see them. Usage figures (credits, not content) are kept for the workspace’s records. Admins can turn the assistant off.
Cookies
Section titled “Cookies”WORK³ uses only cookies needed for the service to work, such as keeping you signed in. See cookies.
Your rights
Section titled “Your rights”You can ask for a copy of your data, have it corrected or deleted, object to or restrict processing, and get your data in a portable format. Much of this you can do yourself under Profile and Passkeys and devices. For anything else, write to privacy@nod3.se. We answer within a month.
If your data is in a workspace that belongs to an organisation, we pass your request to that organisation, since it decides over that data.
You may also complain to the Swedish Authority for Privacy Protection (IMY), imy.se.
Changes
Section titled “Changes”We tell workspace owners in advance about changes that matter. The date at the top shows the latest version.
WORK³ · powered by NOD³