Last updated: 22 August 2026
This policy explains how Ovanth Systems LTD ("Werkea", "we") handles personal data. As a UK company serving contractors in the EU, both the UK GDPR and the EU GDPR apply to us.
This matters, because your rights differ depending on which applies.
For your own account — your name, email address, company details and billing — we are the controller. We decide why and how that data is used.
For the data you enter about your customers — their names, addresses, phone numbers, the quotes and photos you create for them — you are the controller and we are only your processor. The same applies to anything you record about the people who work for you: if you name a worker and their hours in a site diary entry, that is your data about your own staff, and we hold it for you on the same terms. We store and process all of it on your instructions and do not use it for our own purposes. This is governed by our data processing agreement, which you can read in full at /legal/dpa and which applies automatically to every account. Write to hello@werkea.com if you need a signed copy.
Ovanth Systems LTD 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom hello@werkea.com
Werkea has not appointed a Data Protection Officer because, based on its current processing activities, it does not consider a formal DPO appointment to be required under applicable data protection law. We reassess this as our processing changes.
Ovanth Systems LTD is established in the United Kingdom, so the UK GDPR applies to us. Because we offer Werkea to contractors in the EU, the EU GDPR applies to that processing as well, and because we offer it to contractors in Switzerland, the Swiss Federal Act on Data Protection (revFADP) applies to that processing.
[ASSESS BEFORE LAUNCH — EU representative. A controller outside the EU that is caught by Art. 3(2) GDPR must appoint a representative in the EU under Art. 27 unless an exemption applies. Werkea deliberately targets German and Austrian contractors and processes their data regularly, so the exemption should not simply be assumed. If a representative is required, name them and their EU address here.]
[ASSESS BEFORE LAUNCH — Swiss representative. Art. 14 revFADP requires a representative in Switzerland only where all of its conditions are met together (offering services in Switzerland, regular processing, large scale, and high risk). Selling into Switzerland does not on its own trigger it. If a representative is required, name them and their Swiss address here.]
Account data (name, email, company name and address, chosen language). To create and run your account. Legal basis: performance of a contract, Art. 6(1)(b) GDPR.
Authentication data (email address and a password hash, held by Supabase). To sign you in securely. Legal basis: Art. 6(1)(b) GDPR.
Billing data (subscription plan, status, billing period). Card details are entered directly with Stripe and never reach our servers. Legal basis: Art. 6(1)(b) GDPR, and Art. 6(1)(c) for statutory retention of invoices.
Content you create (customers, quotes, price book items, projects, photos, site diary entries). Stored so the app works. You are the controller of this data.
Site diary entries about your workers. If you name someone who worked on a job and record their hours, we store that name and those hours for you, and keep the original dictation the entry was made from so the record stands up as a contemporaneous account. You are the controller of this data: it is your record about your own staff, and telling them you keep it is your responsibility, not ours. Nobody outside your company account can see it.
Voice recordings and job photos. When you dictate a job note or generate a render, the audio or photo is sent to an AI provider to be turned into text, quote line items or an image. Audio is not retained by us after transcription. Legal basis: Art. 6(1)(b) GDPR.
Error reports. When something goes wrong, technical details of the failure are sent to our monitoring provider. These are stripped of personal data before transmission: no request bodies, no cookies, no customer information. Legal basis: legitimate interest in a working service, Art. 6(1)(f) GDPR.
Push notifications, if you enable them. We store the notification address your browser issues, so we can tell you when a customer responds to a quote. Legal basis: consent, Art. 6(1)(a) GDPR — withdrawn by turning them off.
Supabase — database, authentication and file storage. Hosted in the EU (Stockholm).
Vercel — application hosting. Server functions run in the EU (Stockholm); static content is delivered from a global network.
Anthropic — turning dictated job notes into quote line items. United States.
OpenAI — transcribing voice recordings. United States.
Google — generating renders from job site photos (Gemini). United States.
Resend — sending email (quotes, invitations, notifications). United States.
Stripe — payments and subscriptions. Ireland and the United States.
Sentry — error monitoring. EU region, error data retained for 30 days.
Google Analytics — only if you connect your own Analytics account under Company → Website. We then read that account's traffic statistics on your behalf, and store the access tokens Google issues (encrypted) so the connection keeps working. Disconnecting deletes them. United States.
Meta and Google Ads — advertising measurement on our public marketing site only (werkea.com), never inside the app. These load only after you accept cookies on that site; decline and they are never loaded at all. United States.
Several of these process data in the United States. Where that is the case, the transfer is covered by appropriate safeguards under UK and EU data protection law — either the processor's certification under the EU-US Data Privacy Framework, or standard contractual clauses together with the UK International Data Transfer Addendum.
Active accounts: we keep your account and its content for as long as the account exists, because that content is the service.
Cancelled subscriptions: cancelling does not delete anything. Your account and its content stay as they are, without paid access, so you can come back to them. [DECIDE AND BUILD: whether dormant cancelled accounts are deleted after a set period. Storage limitation argues for one; there is no such automatic deletion in the product today, so this must not claim one until it exists.]
Deleting your account yourself: deletion runs immediately and removes your company's records and files — customers, quotes, price book, projects, photos, renders and site diary entries — from our live systems. Our hosting provider does not currently take automated backups of this data on the plan we use, so once you delete your account, that data cannot be recovered by us or by our hosting provider.
Invoices and billing records: kept for 6 years, as UK tax law (HMRC) requires.
Error reports: retained for 30 days.
You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you may withdraw that consent at any time. Write to hello@werkea.com.
You also have the right to complain to a supervisory authority — in the UK the Information Commissioner's Office (ICO), in the EU the authority for your country, and in Switzerland the Federal Data Protection and Information Commissioner (FDPIC).
We will update this page if our processing changes, and note the date at the top.
We use cookies to measure how visitors reach werkea.com and to show relevant ads. Nothing loads until you say yes. Privacy policy