Privacy Policy

  • Effective Date: 6 Oct 2026
  • Last Updated: 6 Oct 2026

1. Introduction

Welcome to Mighty Workflow (“Mighty Workflow,” “we,” “our,” or “us”). This Privacy Policy explains how we collect, use, disclose, and protect personal information when you access or use our websites, applications, and related services (the “Services”).

This Policy applies to Subscribers, Invited Users, and visitors of our Services. It covers both:

  • Customer Data submitted into a Workspace, where the Subscriber is the Controller and Mighty Workflow acts as the Processor, and
  • Personal data we collect directly (such as account, billing, support, and usage data), where Mighty Workflow acts as the Controller.

We are committed to protecting personal information in compliance with the Protection of Personal Information Act, 2013 (POPIA) and, where applicable, the General Data Protection Regulation (GDPR) and the UK GDPR.

This Privacy Policy should be read together with our Terms of Service and Data Processing Agreement (DPA).

2. Who We Are

Mighty Workflow is an email-based workflow and collaboration platform that enables Subscribers and their Invited Users to organize client communications into structured workflows, track deadlines and tasks, and collect documents or information from clients.

Mighty Workflow is owned and operated by MIGHTY TOOLKIT (PTY) LTD, a company registered in South Africa under registration number 2025/685291/07. For purposes of this Privacy Policy, Mighty Toolkit (Pty) Ltd is responsible for processing personal information as described in this Policy.

  • Registered Address: 2 Willow Ridge, Royal Ascot, Cape Town, Western Cape, 7441, South Africa
  • General Contact Email: [email protected]
  • Information Officer (POPIA): Allister Smith — [email protected]
  • EU/UK Representative: If required by law, we will appoint a representative in the EU/UK and update this Policy with their details.

3. Key Roles

  • “Subscriber”: The individual or legal entity that enters into our Terms of Service by signing up for and creating a Workspace in the Services. The Subscriber is legally responsible for the Workspace, including payment of any applicable fees, control of User access and management of User roles and permissions. In Mighty Workflow, the Subscriber is assigned the role of Owner.
  • “Invited User” (also “Team Member”): Any individual the Subscriber invites into a Workspace and to whom the Subscriber grants access, roles, and permissions within the Services (e.g., employees or contractors who collaborate in creating and managing workflows). The Subscriber controls Invited Users’ roles, permissions, and access, and may change or revoke them at any time.
  • “Contact”: An external party (e.g., a client, applicant, or supplier) whom the Subscriber or its Team Members communicate with by email through the Services to request, collect, or exchange documents or information. Contacts interact with the Services solely over email and do not access the Workspace.
  • Data Controller vs. Data Processor:
    • Mighty Workflow as Controller (POPIA: Responsible Party): We act as the Controller for personal data you provide directly to us or that we collect as you use the Services (e.g., account registration, billing, support, and usage data).
    • Subscriber as Controller, Mighty Workflow as Processor (POPIA: Operator): You act as the Controller for personal data you collect from your Contacts through the Services. In these cases, Mighty Workflow acts as your Processor, processing such data solely on your documented instructions and in accordance with our Data Processing Agreement (DPA).
  • "Merchant of Record" (MoR): The company that resells subscriptions to the Services to Subscribers. As the seller, the Merchant of Record processes payments, issues invoices, handles refunds, and calculates, collects, and remits applicable transactional taxes. Mighty Toolkit (Pty) Ltd provides the Services themselves. For Mighty Workflow, the Merchant of Record is Polar Software Inc.

4. What Personal Information We Collect

We collect and process different types of personal information depending on how you interact with our Services. This includes information we process as a Controller (for our own business purposes) and as a Processor (on behalf of Subscribers, under their instructions).

  • Information You Provide (Controller):
    • Company or business name (if applicable)
    • First and last name
    • Email address
    • Login credentials (passwords are stored in hashed form)
    • Payment and billing details (processed by our authorized Merchant of Record and independent Controller for payment processing and tax remittance — we do not collect or store card details)
    • Support requests, emails, or other communications with us
  • Information from services you connect (Controller)
    • If you sign in with Google, the name, email address, and profile image from your Google account
    • If you connect Google Calendar, the access tokens needed to keep it in sync (stored encrypted)
    • If you connect an AI assistant, a record of the app and the access you granted it
  • Information we collect automatically (Controller)
    • IP address, device and browser type
    • Usage and log data (e.g., pages requested, actions, and timestamps)
    • Cookies and similar storage (see Section 13)
    • Log files and metadata related to your use of the Services
  • Information we process on behalf of Subscribers (Processor)
    • Customer Data submitted to, sent through, or generated within the Services — including emails and attachments from Contacts, documents, identity information, proof of income, proof of residence, or any other information determined by the Subscriber.
    • Workflow activity, such as email correspondence with Contacts, document uploads, approvals, comments, and workflow steps completed by the Subscriber or its Team Members.

As a Controller, we do not intentionally collect special categories of personal data (e.g., health information or biometric identifiers) or children’s data. Subscribers may process sensitive information as Customer Data — such as identity numbers, tax references, and financial records — within the limits set out under “Sensitive Data” in Section 5 of our Terms of Service. The Subscriber, as Controller, is responsible for having a lawful basis to process it, as described in our DPA.

Google data. If you sign in with Google, we receive your name, email address, and profile image. If you connect Google Calendar, we create and manage a Mighty Workflow calendar, and its events, in your Google account, and read your calendar list only to find that calendar; we don’t read your other calendars or their events. Google tokens are stored encrypted and deleted when you disconnect. We use Google data only to provide these features — never for advertising or to train AI models — and our use of information received from Google APIs complies with the Google API Services User Data Policy, including its Limited Use requirements.

Under the GDPR and UK GDPR (Article 6) and POPIA (section 11), we rely on the following lawful bases to process personal information, depending on the context:

  • Consent
    • When you opt in to something optional, such as marketing emails.
    • You may withdraw consent at any time (this does not affect processing carried out before withdrawal).
  • Contract / performance of a contract
    • To create and maintain your Workspace.
    • To provide, support, and secure the Services under our Terms of Service.
    • To handle billing and payment (via our Merchant of Record).
  • Legal obligation
    • To comply with tax, accounting, and regulatory requirements.
    • To respond to lawful requests from regulators or authorities.
  • Legitimate interests (where these are not overridden by your rights and freedoms)
    • To maintain and improve the security and performance of the Services.
    • To prevent fraud, misuse, or abuse.
    • To improve the Services, using usage data and privacy-friendly analytics (never the content of Customer Data).

Controller vs Processor: When we act as a Controller (e.g., account, billing, usage data), these legal bases apply directly. When we act as a Processor (e.g., Customer Data inside your Workspace), the Subscriber is responsible for establishing a lawful basis, and we process data solely on the Subscriber’s instructions as set out in our Data Processing Agreement (DPA).

6. How We Use Your Information

We use personal information for the following purposes, in line with the legal bases described in Section 5:

  • As a Controller (our own business purposes):
    • To create and manage Subscriber accounts and Workspaces.
    • To provide, maintain, support, and secure the Services.
    • To communicate with you about updates, features, billing, or service issues.
    • To respond to support requests or inquiries.
    • To process payments and manage subscriptions (through our Merchant of Record).
    • To monitor and investigate usage for security, fraud prevention, and abuse detection.
    • To improve the Services, using usage data and privacy-friendly analytics (never the content of Customer Data).
    • To comply with applicable laws, regulations, and legal processes.
  • As a Processor (on behalf of Subscribers):
    • To process Customer Data within a Workspace, solely on the Subscriber’s instructions, in order to facilitate workflows (e.g., collecting documents, managing approvals, completing workflow steps).
    • To generate AI-assisted suggestions from workflow emails — suggested to-dos, workflow summaries, and draft replies — which a User reviews before acting on. Email content is sent to our AI sub-processor for this purpose only; AI drafts are never sent without a User reviewing and sending them. Neither we nor our AI provider use it to train AI models.

We do not sell personal data to third parties.

7. Sharing Your Information

We do not sell your personal information. We may share it only in the following circumstances:

  • Service providers / sub-processors – such as hosting, file storage, backups, platform email delivery, and AI processing providers. All sub-processors are bound by contractual obligations to protect your information and may only process it on our documented instructions. A current list is published on our Sub-processors page.
  • Merchant of Record – our payment provider, which acts as an independent Controller for payment data (see Section 8).
  • Services you choose to connect – such as Google sign-in, Google Calendar, your Workspace’s own email provider, or an AI assistant you connect to your Workspace. Data is shared with these services only at your direction; they are listed on our Sub-processors page.
  • Legal or regulatory authorities – where required by applicable law, regulation, legal process, or enforceable government request.
  • Business transfers – in connection with a merger, acquisition, reorganisation, or sale of assets, in which case your information may be transferred to the new entity subject to this Privacy Policy.

For Customer Data inside Workspaces, we act as a Processor. This means we only share such data with sub-processors as authorised by the Subscriber and described in our Data Processing Agreement (DPA).

8. Payment Processing

We use an authorized Merchant of Record to process all subscription payments.

  • When you make a purchase, your payment details (such as card information) are collected and processed directly by the Merchant of Record, not by Mighty Toolkit (Pty) Ltd.
  • The Merchant of Record acts as an independent Controller for payment information and may process personal data in accordance with its own Privacy Policy and GDPR/POPIA obligations.
  • The Merchant of Record calculates, collects, and remits applicable taxes (e.g., VAT, GST, sales tax) as the seller of the subscription.
  • We only receive limited information from the Merchant of Record necessary to confirm your order (e.g., name, email address, transaction ID, tax jurisdiction), and use this solely to provide our Services and maintain records.

9. International Data Transfers

  • Hosting: Our primary servers are located in the European Union (EU), and Customer Data is hosted in this region. If you or your Contacts are located outside the EU, this means personal information will be transferred internationally for storage and processing. By using the Services, you acknowledge that Customer Data and personal information may be transferred from South Africa (or your location) to the EU for storage and processing. Transfers to the EU are permitted under section 72 of POPIA, as the EU is subject to the General Data Protection Regulation (GDPR), which provides an adequate level of protection substantially similar to POPIA.
  • Other transfers: Some of our sub-processors process data outside the EU or South Africa (their locations are listed on our Sub-processors page). In such cases, we implement appropriate safeguards, such as Standard Contractual Clauses (SCCs), adequacy decisions, or binding agreements that uphold equivalent protections, to ensure compliance with GDPR and POPIA.
  • Access from South Africa: Our team is based in South Africa and accesses data from there, where POPIA protects it. Where the GDPR or UK GDPR applies to Customer Data we access from South Africa, the safeguards in Section 6 of our DPA apply.
  • POPIA compliance: Transfers from South Africa are only made where the recipient is subject to a law, contract, binding corporate rules, or binding scheme that effectively upholds data-protection principles substantially similar to those contained in POPIA.
  • Subscriber responsibility: As the Controller, the Subscriber is responsible for ensuring that their use of the Services and any transfer of Customer Data complies with applicable data-transfer laws in relation to their own Contacts.

10. Data Retention

We retain personal information for as long as necessary to provide the Services or as otherwise required by law. Specifically:

  • Customer Data: Retained while your Workspace is open — moving to the Free plan doesn’t delete anything. After your Workspace is closed, Customer Data is retained for 60 days so that you can request an export or reactivate your Workspace, and is then permanently deleted within a further 30 days, unless a longer period is required by law (see Section 14 of our Terms of Service).
  • Account and billing records: Retained as required by applicable law (e.g., tax, accounting, audit).
  • Backups: Deleted data may remain in encrypted backups for up to 30 days.
  • Analytics and security logs: May be retained in pseudonymised or anonymised form for longer periods to detect abuse, ensure system integrity, and improve our Services.

You may request a copy or deletion of your information at any time by emailing [email protected], and we will respond within 30 days, unless retention is required by law or necessary to protect our legitimate interests (e.g., resolving disputes, enforcing agreements).

11. Security

We protect personal information with the security measures set out in Section 8 of our DPA, and require our sub-processors to protect it too. No system is completely secure.

Security is a shared responsibility. Subscribers are responsible for configuring their Workspace securely — for example, managing roles and permissions, requiring Users to turn on two-factor authentication, and removing departing Users.

12. Your Rights

Under POPIA, the GDPR, and the UK GDPR, you have the following rights (subject to certain limitations under law):

  • Access – request a copy of the personal data we hold about you.
  • Correction – ask us to correct or update inaccurate or incomplete data.
  • Deletion (“right to be forgotten”) – request that we delete your personal data, unless retention is required by law or for legitimate business purposes.
  • Withdraw consent – where processing is based on your consent (e.g., marketing), you may withdraw it at any time.
  • Restrict or object – to processing in certain circumstances, including direct marketing.
  • Portability (GDPR only) – request a portable copy of your personal data in a structured, commonly used, machine-readable format.
  • Lodge a complaint – with your local regulator if you believe your rights have been infringed.

If a firm uses Mighty Workflow to work with you (you’re one of its Contacts), that firm controls your information, so please contact it directly. If you contact us, we’ll pass your request on and help the firm respond.

In South Africa, you may lodge a complaint with the Information Regulator (inforegulator.org.za). In the UK, you can complain to the Information Commissioner’s Office (ico.org.uk).

To exercise any of these rights, contact us at [email protected]. We may need to verify your identity before fulfilling your request. We aim to respond within 30 days, as required by POPIA and GDPR.

13. Cookies

We only use cookies and similar storage that the Services need or that you ask for:

  • Sign-in and security: keeping you signed in and protecting your account, including a short-lived cookie while you connect Google Calendar.
  • Preferences: remembering choices you make, such as collapsed panels and light or dark theme (stored as cookies or in your browser’s local storage).

We don’t use advertising or cross-site tracking cookies. We may use privacy-friendly analytics that don’t use cookies or identify you, to understand overall use of our website and the Services. Because none of this needs your consent, there is no cookie banner. If we ever want to use cookies that do, we’ll ask first. You can block cookies in your browser, but you won’t be able to sign in without them.

14. Children’s Privacy

Our Services are not directed to children under 18, and we do not knowingly collect personal data from minors. If we become aware that personal data has been collected from a child without appropriate parental or guardian consent, we will take steps to delete it promptly. This section doesn’t cover children’s information in Customer Data (for example, dependants on a tax return), which the Subscriber controls.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will not apply retrospectively. Where practical, we will provide at least 30 days’ notice by email or in-app notification.

16. Contact Us

For privacy-related questions or requests, please contact our Information Officer:

  • 📧 [email protected]
  • 🏢 2 Willow Ridge, Royal Ascot, Cape Town, Western Cape, 7441, South Africa

If you are located in the EU/UK, you may also contact our representative (once appointed under Article 27 GDPR/UK GDPR).