Privacy Policy
MyDataWork, LLC, a Delaware limited liability company based in Illinois, United States (“we,” “us,” or “our”), is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and your rights regarding that information. By using MyDataWork, you agree to this policy.
What information we collect
Information you provide directly
- Name and email address when you register
- Workspace name and organizational details
- Content you enter into the Service, including asset names, file paths, use case descriptions, notes, and stakeholder information
- Communications you send us for support or feedback
Information collected automatically
- Log data such as IP addresses, browser type, pages visited, and timestamps
- Usage patterns within the application to help us understand how the Service is used and improve it
The Windows Connector does not transmit source files from your computer. It opens supported files locally to extract metadata such as names, paths, sizes, modification dates, tool types, schema references and content hashes. It sends the extracted metadata, not source file contents, cell values or query results.
Manual uploads and cloud connections are different processing paths. An uploaded file is processed by the service; cloud connectors fetch catalog metadata or source definitions according to the connector. Some, including GitHub, fetch source files for parsing. Source material is processed to extract metadata rather than retained as file contents. Descriptions, objectives, notes and value figures you enter are stored as authored work context.
AI processing
AI features send relevant stored metadata and authored work context to the model. Names and email addresses recorded in dedicated stakeholder fields are excluded. Text you write yourself, including titles, descriptions and objectives, is sent as written and may contain names or figures. Source file contents are not included in these AI requests.
How we use your information
- Create and manage your account
- Provide, maintain, and improve the Service
- Respond to support requests and communications
- Send transactional emails such as account confirmations and password resets
- Send product updates and announcements (opt-out available)
- Detect and prevent fraud, abuse, or security incidents
- Meet legal obligations
We do not use your information for advertising and we do not build advertising profiles.
Information sharing and disclosure
We do not sell your personal information. We do not share your information with third parties for their own marketing purposes.
Service providers. AWS supplies hosting and Marketplace services. Transactional emails are processed by email delivery services and recipients’ mail providers outside the GovCloud workspace boundary. Stripe processes direct-plan payments; AWS handles Marketplace billing. Commercial AI uses OpenAI; GovCloud AI uses Amazon Bedrock in AWS GovCloud (US-West). Source providers, optional Jira and external agents process the information you authorize them to receive. Jira exports can include authored summaries, stakeholder names and asset names.
Legal requirements: Disclosure if required by law, court order, or to protect rights, property, or safety.
Business transfers: Information may transfer upon acquisition or merger, with notification.
Data storage and security
The commercial service stores workspace information on AWS infrastructure in the United States. The GovCloud service stores workspace content and account records in AWS GovCloud (US-West). These are separate environments, and database location does not describe every processing path.
- Workspace databases are encrypted at rest.
- Browser and connector connections to the service use HTTPS; GovCloud requests to Amazon Bedrock use HTTPS.
- Passwords are hashed using PBKDF2-SHA256; sign-in sessions are valid for seven days.
- Access to production systems is restricted.
Data retention
Direct subscriptions. The current policy retains live workspace data for 30 days after cancellation. It does not mean that the service automatically deletes all content on day 30. Contact contact@mydatawork.com to request retrieval or deletion.
Explorer. Following its 90-day trial, the workspace becomes read-only for 30 days. Export or subscribe during that period. Trial workspace content is then scheduled for deletion; the personal account remains.
For an AWS purchase, the accepted agreement governs retrieval and deletion. Where the agreement incorporates the Standard Contract for AWS Marketplace retrieval provision, the retrieval period is 45 days after termination, or another period agreed in writing; this includes the GovCloud agreement. An administrator should contact contact@mydatawork.com to arrange retrieval or deletion after access ends. Data is then deleted within a reasonable time under the applicable agreement through a reviewed process. Other agreements retain their own terms; a website update does not change them.
Accounts and shared workspaces. Self-service deletion removes the personal account from the live service where available. Contributions to a shared workspace may remain with that workspace. A workspace deletion does not delete members’ accounts in other workspaces. Multi-workspace account deletion may require support. Deleting either does not end an AWS agreement.
Backups. Automated database backups have seven-day retention. Manual recovery snapshots may be retained longer. Deleted data can remain in encrypted backups or retained snapshots until those copies expire or are deleted. Recorded deletions must be reapplied if a backup is restored; backup retention is not a promise that every copy disappears within seven days.
Eligibility records. Explorer’s one-trial-per-email restriction uses a one-way hash and the date claimed, retained after account deletion. A separate hashed eligibility record supports the free Assessment limit. These records are separate from workspace content.
Security, agreement and deletion records. Security events, agreement and accounting records, and deletion evidence are retained separately from live workspace content for security, billing reconciliation, legal obligations and evidence of completed requests. Internal identifiers may be pseudonymous rather than anonymous. Contact us about the records associated with your account and applicable retention requirements.
MyDataWork for AWS GovCloud (US)
The GovCloud application, workspace database and built-in AI processing run in AWS GovCloud (US-West). Marketplace registration and agreement events pass through a relay in commercial AWS. Transactional email delivery and recipients’ mail systems are outside the GovCloud workspace boundary. Optional cloud connections, Jira and external agents communicate with the destinations you authorize. GovCloud hosting therefore does not mean every processing path stays within GovCloud.
AI context and personal information
GovCloud AI runs through Amazon Bedrock in AWS GovCloud (US-West), without a separate customer AI-provider account. Requests use relevant stored asset metadata and authored context, including titles, paths, descriptions, objectives, roles, notes and chat messages. Dedicated user and stakeholder name/email fields are excluded from model requests. Information typed or pasted into other fields is not automatically anonymized and can reach the model. Building an AI request does not require the application to reopen your source files.
AWS states that Bedrock inputs and outputs are not used to train AWS or third-party foundation models. This statement is not a claim of zero retention or no abuse monitoring. AWS Bedrock privacy information.
Connections and boundaries
The local Windows connector reads supported files locally to extract structure. Cloud-source connectors can fetch metadata, definitions or source files for parsing according to the integration; they are not all identical metadata-only network requests. Contact support to confirm the supported GovCloud connector setup before deployment.
AWS GovCloud hosting does not confer a government authorization on MyDataWork. MyDataWork does not claim FedRAMP or StateRAMP authorization, CMMC certification or ITAR compliance, and no agency ATO is implied. The service is not intended for classified information or Controlled Unclassified Information (CUI). Do not paste CUI, source data rows, credentials or file contents into workspace text fields.
Requests and payment
GovCloud is billed through AWS Marketplace; MyDataWork does not receive card details for that purchase. Contact contact@mydatawork.com to access, correct, export or delete personal information, or to arrange workspace retrieval through a validated administrator. Your accepted agreement governs applicable obligations.
External agents and exports
If you enable Agent Access, an authorized external agent can receive the selected metadata and authored context within its permitted scope. Information received by that agent is also subject to its operator’s handling and privacy terms. Workspace and Portfolio exports create copies outside MyDataWork when you download or share them; deleting the workspace does not recall those copies.
Cookies and tracking
The MyDataWork application uses session-based authentication tokens stored in your browser. The application does not use third-party advertising cookies or tracking pixels, and we do not participate in cross-site tracking or build advertising profiles.
Your rights and choices
- Access personal information
- Correction of inaccurate information
- Deletion of account and data
- Export workspace as a JSON file
- Opt-out from non-transactional emails
To exercise any of these rights, contact us at contact@mydatawork.com. For commercial-service privacy requests, we will respond within 30 days. GovCloud requests follow the applicable agreement and legal requirements.
Children's privacy
MyDataWork is a professional tool intended for business use and is not directed to anyone under 18.
