Privacy Policy

WorkpaperOS is operated by ETIENDEM CPA in Cameroon. For account, billing, support, and platform administration data, we act as the data controller.

When an employer or accounting firm enters employee, client, payroll, tax, audit, or accounting data, that organization normally controls the business data and WorkpaperOS processes it on the organization's instructions. Employees should first contact their employer or HR team about records controlled by the employer.

Depending on the products used, we may process:

• Account and identity data, such as name, email, phone number, role, authentication events, and company membership.
• Company and professional data, including addresses, contacts, registrations, permissions, and subscription details.
• Accounting, payroll, tax, audit, and employee data, including transactions, documents, salaries, deductions, tax identifiers, bank-payment details, attendance, requests, and payslips.
• Support messages, feedback, screenshots, and records needed to resolve a request.
• Device, browser, IP address, logs, security events, diagnostics, and usage information.
• Location when an employee chooses to record attendance or a home workstation location for HR approval.
• Prompts, selected business context, tool calls, and results when AI or MCP features are used.

We use data to create and secure accounts; provide the contracted products; calculate and report accounting or payroll results; process attendance and employee requests; deliver support; bill customers; prevent abuse; keep audit and security records; improve reliability; meet legal obligations; and operate optional AI, MCP, and integration features selected by authorized users.

We process data where needed to perform a contract, comply with law, protect legitimate security and operational interests, follow a customer's documented instructions, or act on valid consent where consent is required. An employer must have a lawful basis and give any required notice before entering employee or client data.

WorkpaperOS Employee may request coarse or precise location only when the employee starts or ends an attendance event or submits a home workstation location. Location is not required for unrelated features such as viewing a published payslip. The app explains the purpose before permission is requested, and permission can be changed in device settings.

When an authorized user invokes AI or a connected tool, the prompt and necessary context may be sent to the provider configured for that company. Provider terms and retention practices may differ. WorkpaperOS limits access by company and user permissions, but customers must avoid submitting unnecessary secrets or unrelated personal data. Read our AI Policy for human-review and tool-use rules.

We may disclose data to authorized users of the same company, the employer responsible for an employee record, and service providers that help us deliver hosting, database, authentication, email, payments, monitoring, support, AI, and integrations. Payment processors generally provide us with status and reference information rather than complete card details.

We may also disclose information when required by law, to protect users and the service, or as part of a business reorganization subject to appropriate safeguards. We do not sell personal data.

Some service providers may process data outside Cameroon. Where this occurs, we use contractual, technical, and organizational safeguards appropriate to the data and applicable law.

We use measures such as encrypted network transport, authentication, role and tenant authorization, secret management, logging, backups, and monitoring. No system is completely secure. Customers must protect credentials, use appropriate permissions, review unusual activity, and notify us promptly of suspected compromise.

We retain data while an account or customer relationship is active and as needed for service delivery, audit history, security, backups, dispute resolution, and legal or professional recordkeeping. Retention can vary by record and customer instruction. Approved payroll and accounting history may be retained longer than an ordinary user profile. See Account deletion to make a request.

Subject to applicable law and the identity of the data controller, you may request access, correction, export, deletion, restriction, objection, or withdrawal of consent. Send a request from your registered email. We may verify identity and may retain records that must legally or operationally be preserved.

WorkpaperOS is a business service and is not directed to children under 18. Customers must not create accounts for children unless a lawful employment or training context permits it and all required safeguards are in place.

We may update this policy as the service or law changes. Material changes will be posted here and may also be communicated in the product. Questions and privacy requests should be sent to accountants@etiendemcpa.com.