WorkFit Privacy Policy

Effective Date: 2026-10-04 Last Updated: 2026-10-04

1. Overview

WorkFit (“we”, “our”, or “the Platform”) complies with applicable data protection laws and regulations, including but not limited to the Personal Information Protection Act and relevant telecommunications laws.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you use WorkFit services.

2. Information We Collect

2.1 Information You Provide

We collect information necessary to provide services such as job matching and fulfillment:

Account Registration

• Required: nickname, login ID (or social ID), phone number
• Retention: until account deletion

Profile / Job Profile

• Required: basic profile (region, language), job preferences
• Optional: salary expectations, experience details
• Retention: until account deletion or user removal

Requests (Matching Input)

• Data you submit for job seeking or hiring purposes
• Retention: lifecycle of the request + audit requirements

2.2 Automatically Collected Information

• Device information (OS, device model)
• Service usage records (access time, interactions)
• IP address and log data (for security and fraud prevention)
• Cookies (for session and analytics)

2.3 System-Generated Information

• Matching results (echo, candidate suggestions)
• Relationship and fulfillment records
• Audit logs and system events

Note: These are operational data required for service integrity and are not user-editable.

3. Purpose of Processing

We process personal data for the following purposes:

1. Service provision (matching, relationship, fulfillment)
2. Identity verification and account management
3. Prevention of abuse, fraud, and unauthorized access
4. Customer support and dispute handling
5. Service improvement and statistical analysis

We do not use personal data beyond these purposes without prior consent.

4. Sharing and Disclosure

We do not sell personal data.

We may disclose data only in the following cases:

1. With user consent
2. When required by law or legal process
3. When necessary for service execution between users (e.g., limited contact info for a confirmed relationship)
4. To service providers under strict data processing agreements (if applicable)

5. Data Retention

Personal data is retained:

• Until the purpose of collection is fulfilled, or
• Until the user deletes their account

However, certain data may be retained for legal compliance:

Inactive accounts may be deactivated or deleted after a defined period, with prior notice.

6. Data Deletion

We delete personal data without delay once the purpose is fulfilled.

Deletion methods include:

• Permanent deletion of electronic records (non-recoverable)
• Secure destruction of physical records (if any)

Archived data is not used for any purpose other than legal compliance.

7. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate information
• Request deletion of your account and data
• Withdraw consent where applicable

Requests can be made via in-app settings or support channels.

8. Cookies

We use cookies to:

• Maintain sessions
• Analyze usage patterns
• Improve service experience

You may refuse cookies via browser settings, but some features may be limited.

9. Security Measures

We implement appropriate technical and organizational safeguards:

• Access control and authentication
• Encryption in transit
• Regular backups and monitoring
• Restricted internal access to personal data

Despite these efforts, users are responsible for safeguarding their own credentials.

10. Children’s Privacy

WorkFit is not intended for minors. If we become aware that a minor has provided personal data, we will delete such data promptly.

11. Changes to This Policy

We may update this Privacy Policy. Any material changes will be announced in advance through the platform.

12. Third-Party AI Connections (ChatGPT, Claude)

12.1 Overview

WorkFit offers an “AI connection” feature that lets you connect ChatGPT (OpenAI) or Claude (Anthropic) to your WorkFit account, only if you choose to.

• AI connection is optional. You can use the rest of WorkFit without it.
• The connection uses MCP (Model Context Protocol) and OAuth, and you must approve it yourself on a consent screen.
• Only job seekers aged 18 or older can use it. If your date of birth cannot be confirmed, you cannot use it.
• To connect, you must turn on “Allow AI connection” in the app and register an AI passkey.
• This section applies to OAuth connections from ChatGPT and Claude.

12.2 Data the AI Service Can Access

A connected AI service receives the data below only when you use a WorkFit feature in a conversation. Our server removes everything except the listed items before sending.

Read (only while “Allow AI to view data” is on)

• Your own job requests: title, job, pay, work location shown in the request, status, created/updated/end dates, number of candidates and proposals
• Job postings that meet the conditions of your request: title, company/employer name, job/role, pay, work location shown in the job posting, work language, condition comparison results (these may include your own conditions, such as your age range), benefits (such as meals), application/proposal status
• Proposals you received: title, job/role, pay/offer amount, work location shown in the job posting, work language, schedule, expiry date, company/employer name, proposal status
• Identification numbers of the requests, proposals, and other items above
• Public job category and location lists (no personal data)

Never provided to the AI service

• Phone number, email, employer contact details and account identifiers
• Nationality, visa
• Chats, reviews, profile pages

Write

• The AI can only create drafts of job requests (title, job, area, pay, schedule, work language, visibility, etc.).
• The AI cannot set visa information; the information in your profile is used.
• A draft is not published until you confirm it (see 12.9).

12.3 Data We Store for the Connection

• AI connection settings: the “Allow AI connection” and “Allow AI to view data” switches
• AI passkey: credential ID, public key, usage counter, creation time, etc.
• Connection record: user identifier, AI service name (ChatGPT or Claude), permissions, consent version and time, expiry time, disconnection time and reason
• Access token: we store only a hash, never the token itself
• Call log: time, AI service name, feature and target used, allowed/denied result and reason, a hash of the request, and the ID of any request published. We do not record the request content, the response content, or your IP address. You can see the latest 50 entries in the app.
• Draft content: kept temporarily for up to 10 minutes until you confirm; after that only a hash remains.

12.4 Purpose

1. To let the AI service you approved view your own job requests, matching job postings and received proposals, and create job request drafts
2. To confirm it is you before publishing (AI passkey)
3. To enforce usage limits and prevent fraud and abuse
4. To show you a record of AI connection activity

12.5 Recipients and Processors

• Data goes only to the AI service you connected.
• Data sent to an AI service is handled under that company’s privacy policy.
• OpenAI privacy policy: https://openai.com/policies/privacy-policy/
• Anthropic privacy policy: https://www.anthropic.com/legal/privacy
• WorkFit data is stored in the Amazon Web Services Seoul region (ap-northeast-2).
• Processor: Vercel Inc. hosts the connect.senk.io confirmation page and only relays confirmation requests. Processing location: United States.

12.6 International Transfer

When you use AI connection, your personal data is transferred outside Korea as follows:

• Recipient: OpenAI (ChatGPT) or Anthropic (Claude), whichever you connected
• Recipient contact: OpenAI privacy@openai.com / Anthropic privacy@anthropic.com
• Destination country: United States
• Data transferred: the data in 12.2
• When and how: in real time, each time you use a WorkFit feature in the AI service, over encrypted connections (HTTPS)
• Purpose: so the AI service can answer your requests and create job request drafts
• Retention: under each company’s privacy policy (see the links in 12.5)
• Legal basis: your consent (Article 28-8(1)(1) of the Korean Personal Information Protection Act), given when you approve the connection yourself on the OAuth consent screen
• How to refuse and what happens: if you do not connect, or you disconnect, no data is transferred. Only AI connection becomes unavailable; the rest of WorkFit is not affected.

12.7 Retention

• Access token: up to 30 days from first authorization. Re-authorizing does not extend this, and no refresh token is issued.
• Temporary data (authorization codes, draft content, usage counters, etc.): deleted automatically after a few minutes to at most 25 hours
• AI passkey: until you delete it or delete your account (kept even after you disconnect all AIs)
• Connection records and call logs: kept for 1 year after the connection is disconnected or expires, then deleted. We keep them to prevent abuse, handle disputes, and for security audits.
• Server logs: do not contain the content of AI feature calls, and are kept for up to 3 months, as in Section 5.
• Data already sent to an AI service: under that company’s policy

12.8 Disconnecting and Withdrawing Consent

• WorkFit app: “Settings → AI connection → Connected AI → Disconnect”. The access token stops working immediately, and drafts you have not confirmed can no longer be published.
• Block: disconnects and refuses new connections from that AI. You can undo this with “Unblock”.
• Turning off “Allow AI connection”: pauses all connections (this is not a disconnection). Turning it back on resumes them; expiry dates are not extended.
• Turning off “Allow AI to view data”: the AI can no longer read your data. Drafting and public lists still work.
• ChatGPT: Settings → Plugins (Apps on some accounts) → WorkFit → under Connected accounts, ••• or Connection next to the account → Disconnect
• Claude: Customize → Connectors (claude.ai/customize/connectors) → Your connectors → WorkFit → Disconnect, or ••• → Remove. On Team and Enterprise plans, an Owner removes it in Organization settings → Connectors.
• If you disconnect only in ChatGPT or Claude: SENK is not notified. Access on the SENK side stops automatically when it expires, 30 days after you first authorized it. To stop access immediately, disconnect in the WorkFit app.
• Account deletion: all AI connections are revoked, and your AI connection settings and AI passkey are deleted. Connection records and call logs are kept for 1 year, then deleted.
• We cannot delete conversations or data already held by the AI service. Please use that service’s own controls.
• OpenAI data controls: https://help.openai.com/en/articles/7730893-data-controls-in-chatgpt
• Anthropic privacy center: https://privacy.claude.com/en/
• Disconnecting does not affect your WorkFit login, job requests, proposals, matching, or any other use of WorkFit.

12.9 Publishing AI Drafts

• AI drafts are never published automatically. A draft is published under your account only after you review it on the connect.senk.io confirmation page and approve it with your AI passkey.
• The confirmation link is valid for 10 minutes and can be used only once.
• The AI cannot edit or delete existing content, and cannot apply, accept, or reject.
• Each connection can publish up to 5 requests per day.
• Published requests are treated like any other job request and are not deleted when you disconnect.

13. Contact

For privacy-related inquiries:

WorkFit Support Company: SENK Email: support@senk.io

Privacy Officer Name: 백범 Title: CEO Email: support@senk.io