Privacy Policy
Effective date: 28 October 2026 · Last updated: 28 October 2026
This policy explains how Nomads United, MB, the company behind worklab, handles personal data when you call or message our AI voice assistant on WhatsApp. Calls and messages are answered by an artificial intelligence system powered by OpenAI (the technology behind ChatGPT). You are always talking to an AI, not a human, unless we tell you otherwise.
- Who we are
- What this policy covers
- Data we process
- Why we process it and legal bases
- How the AI works
- Who receives your data
- International transfers
- How long we keep data
- Your rights
- Deleting your data
- Security
- Children
- Changes to this policy
- Contact and complaints
1. Who we are
The controller responsible for your personal data is Nomads United, MB, a company registered in the Republic of Lithuania, which operates the website worklab.biz and the worklab WhatsApp assistant (“worklab”, “we”, “us”). We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and the Law on Legal Protection of Personal Data of the Republic of Lithuania.
| Company | Nomads United, MB |
|---|---|
| Legal form | Mažoji bendrija (small partnership), Republic of Lithuania |
| Company code | 305569211 |
| VAT code | LT100015648119 |
| Registered address | Ateities g. 14-13, LT-37342 Panevėžys, Lithuania |
| Business address | Panerių g. 39, 7th floor, LT-03209 Vilnius, Lithuania |
| hello@worklab.biz · info@nomads.lt | |
| Phone | +370 662 49326 |
| Websites | worklab.biz · nomads.lt |
Contact for all privacy matters: hello@worklab.biz.
2. What this policy covers
This policy applies when you:
- place a WhatsApp voice call to a worklab business number, or accept a WhatsApp call from us after giving permission;
- send us WhatsApp messages, voice notes, images or documents;
- contact us by e-mail or visit worklab.biz.
WhatsApp itself is operated by WhatsApp Ireland Limited / Meta Platforms Ireland Limited. Their processing of your data as a WhatsApp user is governed by the WhatsApp Privacy Policy, not by this policy.
3. Data we process
| Category | Examples | Source |
|---|---|---|
| Identifiers | WhatsApp phone number, WhatsApp profile name, WhatsApp user ID | WhatsApp Business Platform |
| Call content | Your voice audio while the call is live, and the text transcript of what you and the AI said | You, during the call |
| Message content | Text messages, voice notes, images, documents and replies | You |
| Call and message metadata | Date, time, duration, call status, message IDs, delivery and read status | WhatsApp Business Platform |
| Consent records | Your permission for us to call you, opt-in and opt-out history | You, via WhatsApp |
| Account and business data | Name, company, e-mail and preferences, if you share them or have a worklab account | You |
| Technical logs | Server logs, error reports, IP addresses of website visitors | Our systems |
Please do not share special categories of data (such as health, religious beliefs, political opinions, biometric or genetic data, sex life or sexual orientation), payment card numbers, passwords or other sensitive information during calls or in messages. If you do so voluntarily, we will process it only as necessary to respond to you and will delete it according to the retention rules below.
We do not use your voice to identify you (no voiceprints or biometric identification), and we do not create advertising profiles.
4. Why we process it and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your calls and messages with the AI assistant and providing the service you requested | Art. 6(1)(b) – performance of a contract or steps at your request |
| Calling you on WhatsApp (business-initiated calls) and sending you follow-up messages | Art. 6(1)(a) – your consent, given through WhatsApp’s call-permission and opt-in features; you can withdraw it at any time |
| Keeping transcripts so the assistant can remember context and so we can follow up on your request | Art. 6(1)(b) – contract; and Art. 6(1)(f) – our legitimate interest in providing a consistent service |
| Quality assurance, troubleshooting and improving prompts and settings of our assistant (we do not train AI models on your data) | Art. 6(1)(f) – legitimate interest in a reliable and safe service |
| Preventing abuse, fraud, spam and security incidents | Art. 6(1)(f) – legitimate interest in protecting our users and systems |
| Complying with legal obligations (e.g. accounting, responding to authorities) | Art. 6(1)(c) – legal obligation |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) – legitimate interest |
Where we rely on legitimate interests, we have balanced them against your rights and you may object at any time (see Your rights).
5. How the AI works
- You are talking to an AI. In line with the EU Artificial Intelligence Act (Regulation (EU) 2024/1689), every call starts by telling you that you are speaking with an AI assistant, and AI-generated messages are identified as such.
- Real-time processing. During a call, your voice is streamed to OpenAI’s speech and language models, which convert speech to text, generate a reply and convert it back to speech.
- No call recordings by default. We do not store audio recordings of calls. We keep a text transcript and call metadata, as described in section 8.
- No model training. OpenAI does not use data sent through its business API to train its models unless we opt in, and we have not opted in. We do not use your data to train any AI models.
- No automated decisions with legal effect. The assistant answers questions and helps with tasks. It does not make decisions that produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR.
- AI can be wrong. AI-generated answers may be inaccurate or incomplete. Please verify important information. You can ask to be contacted by a human at hello@worklab.biz.
6. Who receives your data
We do not sell your personal data. We share it only with service providers who process it on our behalf under data processing agreements (Art. 28 GDPR), or where the law requires it:
- Meta Platforms Ireland Limited / WhatsApp – WhatsApp Business Platform (Cloud API), which carries calls and messages between you and us.
- OpenAI (OpenAI Ireland Limited and OpenAI, L.L.C.) – speech recognition, language and speech-generation models that power the assistant.
- Hosting and infrastructure providers located in the European Union – servers, databases, backups and e-mail.
- Professional advisers and authorities – lawyers, auditors, courts, law enforcement or regulators, where required by law or to protect our rights.
- A successor business – if worklab is involved in a merger, acquisition or sale of assets, subject to this policy.
7. International transfers
We store data primarily on servers in the European Union. Some providers (in particular OpenAI and Meta) may process data in the United States or other countries outside the European Economic Area. In these cases we rely on the EU–U.S. Data Privacy Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR) together with supplementary measures. You can request a copy of the relevant safeguards by contacting us.
8. How long we keep data
| Data | Retention |
|---|---|
| Live call audio | Not stored; processed only for the duration of the call |
| Call transcripts and message content | 90 days after the last interaction, then deleted or anonymised, unless you ask us to delete them sooner |
| Call and message metadata | 12 months |
| Consent and opt-out records | As long as consent is active and up to 3 years after withdrawal, to prove compliance |
| Server and security logs | Up to 90 days |
| Contract, invoice and accounting records | As required by applicable tax and accounting law (typically up to 10 years) |
| Data at OpenAI | OpenAI may retain API inputs and outputs for up to 30 days for abuse and misuse monitoring, after which they are deleted, unless the law requires otherwise |
Where data is needed to establish or defend a legal claim, we may keep it until the matter is resolved.
9. Your rights
Under the GDPR you have the right to:
- Access your personal data and receive a copy (Art. 15);
- Rectify inaccurate data (Art. 16);
- Erase your data (“right to be forgotten”, Art. 17);
- Restrict processing (Art. 18);
- Data portability – receive your data in a structured, machine-readable format (Art. 20);
- Object to processing based on legitimate interests, and at any time to direct marketing (Art. 21);
- Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3));
- Not be subject to solely automated decisions with legal or similarly significant effects (Art. 22).
To exercise your rights, e-mail hello@worklab.biz or send us a WhatsApp message. We will reply within one month, which may be extended by two further months for complex requests. We may ask you to confirm your identity, for example by messaging us from the same WhatsApp number. Exercising your rights is free of charge.
10. Deleting your data
You can ask us to delete all data associated with your WhatsApp number at any time:
- Send the word DELETE to our WhatsApp number from the phone number concerned; or
- E-mail hello@worklab.biz with the subject “Delete my data” and the phone number you used.
We will delete your transcripts, messages and profile data within 30 days and confirm when it is done. We may keep only what the law requires us to keep (for example invoices) and a minimal record of your request. To stop receiving calls or messages without deleting data, send STOP, withdraw call permission in WhatsApp, or block our number.
11. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit (TLS), access controls limited to authorised personnel, separation of environments, regular updates and backups, and data processing agreements with our providers. WhatsApp encrypts calls and messages in transit; once they reach our systems through the WhatsApp Business Platform, they are processed by us and our providers as described in this policy. If a personal data breach is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and inform you where required by law.
12. Children
The service is not intended for children under 16. We do not knowingly process personal data of children under 16 (or the lower age set by the law of your EU Member State) without parental consent. If you believe a child has used the service, contact us and we will delete the data.
13. Changes to this policy
We may update this policy when our service or the law changes. The “Last updated” date at the top shows the latest version. If changes are significant, we will inform you through WhatsApp or by other appropriate means before they take effect.
14. Contact and complaints
For any question about this policy or your data, contact us at hello@worklab.biz.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). Our lead supervisory authority is the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija, L. Sapiegos g. 17, LT-10312 Vilnius, vdai.lrv.lt). You may also complain to the authority in the EU Member State of your habitual residence, place of work or the place of the alleged infringement. A list of EU authorities is available on the European Data Protection Board website. We would appreciate the chance to address your concern first.
See also our Terms and Conditions.