Reworkd

GDPR overview

Reworkd never claims GDPR compliance anywhere on its site. Section 3 of the privacy notice explains that the GDPR and UK GDPR require it to state its legal bases, listed as consent, performance of a contract, legitimate interests, legal obligation and vital interests. Users in the EEA, the UK and Canada are granted access and copy, rectification, erasure, restriction of processing, portability and objection rights, with consent withdrawable at any time; the notice points to national supervisory authorities, the UK ICO and the Swiss data protection authority. Beyond that the file is thin: no Article 27 EU representative, no data protection officer, no dedicated privacy contact beyond support@reworkd.ai, no DPA and no sub-processor list. California CCPA and Virginia CDPA sections are present, with a 45-day response window extendable by 45 days. The notice dates from 9 June 2023 and its postal address block was left blank.

Who owns the data?

The terms of service leave the user responsible for the data they submit. Section 22, User Data, says Reworkd retains certain transmitted data to manage service performance and runs routine backups, while disclaiming any liability for loss or corruption and asking users to waive any right of action arising from it. On the personal side, the privacy notice covers names, email addresses and billing addresses, with no sensitive categories and no data received from third parties; payment details are held by Stripe. Scraped files sit in Reworkd's own S3 buckets and are retrieved through pre-signed URLs. Reworkd AI, Inc. states it has never sold personal data to third parties and commits not to.

Reuse rights

The material reviewed records no clause limiting how a customer may re-use the data their own jobs extract; the terms simply make the user solely responsible for what they transmit, and results are pulled out through bulk JSON or CSV exports and the public API without any permission step. Reworkd's own use is set out in the privacy notice: it processes information to provide, improve and administer the services, communicate with users, prevent fraud and comply with the law, and more specifically to create and authenticate accounts, answer requests and support tickets, request feedback and protect vital interests. Automatically collected data includes IP address, browser and device characteristics, operating system, language, referring URLs, approximate or precise location, usage logs and error reports, gathered through cookies, web beacons and pixels. Information may be shared in a merger, sale of assets, financing or acquisition, and with business partners for products, services or promotions. Signing up through a social account gives access to name, email, friend list and profile picture. Do-Not-Track browser signals are not honoured, and training models on customer data is not mentioned anywhere.

Data retention & training

Hosting summary

Reworkd names no hosting country and no hosting region anywhere on its site or in its documentation. What the documentation does say is that downloaded files are stored in Reworkd's own Amazon S3 buckets and served through pre-signed URLs, with asynchronous downloads handled by AWS Lambda and a dedicated queue. That establishes an AWS footprint without telling you which region it sits in. The publisher, Reworkd AI, Inc., is incorporated in California, which makes a US jurisdiction the reasonable expectation, though it is never stated as a hosting commitment. The marketing site itself resolves to 76.76.21.21, an anycast CDN node geolocated in the United States, but that describes where the website is served from, not where customer data lives. There is no DPA, no sub-processor list beyond Stripe as payment processor, and no data residency option on offer. European users who need a documented region or transfer basis will not find one here.