Privacy Policy

WorkClan (“we”, “us”, “our”) is a Software-as-a-Service people management platform operated at workclan.site. We act as a data processor on behalf of the companies (SMEs) that use our platform. Each company that registers on WorkClan is the data controller for their employees’ data.

Contact: support@workclan.site

Account & identity data: Full name, work email address, password (hashed — we never store it in plain text).

Employment data: Job title, department, start date, employment type, manager name, employee ID.

Personal data: Date of birth, gender, phone number, location. These are optional and only collected with the employee’s knowledge.

Usage data: Weekly reports, announcements, notifications generated within the platform.

Technical data: IP address (for rate limiting and security), browser type, login timestamps.

Under the Nigeria Data Protection Regulation (NDPR) and GDPR (where applicable), we collect and process data on the following legal bases:

• Contract: Processing necessary to perform the employment relationship between you and your employer.
• Legitimate interest: Security logging, fraud prevention, platform performance.
• Consent: Optional personal data (date of birth, gender, location) — you may remove this at any time.

• Data is stored on Supabase (PostgreSQL), hosted in secure data centres with encryption at rest and in transit (TLS 1.3).
• Row Level Security (RLS) ensures each company’s data is completely isolated — no company can access another’s data.
• Passwords are never stored — authentication is managed by Supabase Auth using bcrypt hashing.
• Access to production systems is restricted to authorised personnel only.
• Sessions auto-expire after 30 minutes of inactivity.

We do not sell your data. We share data only with the following sub-processors, each bound by their own data protection terms:

• Supabase — database and authentication
• Vercel — application hosting
• Resend — transactional email delivery

No data is shared with advertisers, brokers, or third parties for marketing purposes.

Employee data is retained for as long as the company account is active. When a company closes their workspace:

• All employee profiles and associated data are deleted within 30 days.
• Backups are purged within 90 days.
• An individual employee may request deletion of their account at any time via Settings.

Under NDPR and GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data via Edit Profile
• Erasure — delete your account via Settings → Security → Delete Account
• Portability — request your data in a machine-readable format
• Objection — object to processing based on legitimate interest

To exercise any right, contact us at support@workclan.site. We will respond within 30 days.

We use only essential cookies required for authentication (session tokens). We do not use tracking, advertising, or analytics cookies.

In the event of a data breach that poses a risk to your rights, we will notify affected companies and individuals within 72 hours of becoming aware, in compliance with NDPR requirements.

We may update this policy periodically. When we do, we will update the “Last updated” date at the top and, where changes are material, notify you by email or in-app notification.