ProcessWorks privacy notice

Who is responsible for your information

ProcessWorks is operated by Jamal Akram, a sole trader who also operates Lustra Studio. For privacy questions, requests or complaints, email [email protected].

This notice covers the ProcessWorks website, agency workspace, support and authorised commerce and advertising workflows. Lustra Studio creative services have their own service-specific privacy information. Shared sign-in does not make every workspace record available to other users or combine the two products' subscriptions.

We act as a controller for account administration, service security, billing administration and our own correspondence. When an agency or business instructs us to process personal information for its client operations, we act as a processor to the extent we handle that information solely on its instructions. That business remains responsible for its authority to supply the information and for the privacy information it gives its clients and customers.

Information we collect and where it comes from

• Account and security information: your email address, account identifier, profile information and authentication or security records supplied by you or the shared Lustra identity service.
• Workspace and client records: workspace names, memberships, roles, client names and contact details, connected-account metadata, integration status and operational preferences entered by you or an authorised team member.
• Workflow records: requests, submitted content, proposed actions, approval decisions, automation settings and activity history associated with your workspace.
• Connected-service information: the product, listing, inventory, order or advertising information returned by a provider for an authorised and enabled workflow. Available data depends on the provider, permissions and approval status.
• Support and commercial information: ticket subjects and descriptions, replies, correspondence, plan information and transaction references where relevant. Do not include passwords, live access tokens or payment-card details in support messages.
• Technical information: request and error information, browser or device information, network identifiers and security events handled by hosting and authentication services to operate and protect the service.

We receive information directly from users, from team members acting for their organisation, from shared authentication and from connected services they authorise. Account details are necessary for sign-in; workspace and connection information is necessary for the associated feature. You can choose not to supply optional information, but a feature may not work without the information it requires.

How we use information and our lawful bases

• Providing the service: account access, requested workspace functions, authorised integrations and support rely on performing our contract with you, or taking steps you request before entering a contract, where applicable.
• Operating business accounts: where our customer is an organisation, we rely on our legitimate interests in administering that relationship and communicating with its authorised users.
• Security and reliability: detecting misuse, enforcing access boundaries, investigating faults and keeping relevant audit records rely on our legitimate interests in protecting users and operating a reliable service.
• Legal obligations: we use information where needed to meet applicable accounting, tax, legal or regulatory duties.
• Consent: where consent is required for an optional use, we request it separately. You can withdraw it through the relevant control or by contacting us; withdrawal does not affect processing that was lawful before it was withdrawn.

For client personal information processed on a business customer's instructions, that customer determines its purposes and lawful basis. Authorising a platform connection does not replace any separate data-protection responsibilities.

Amazon Ads and marketplace information

Public Amazon Ads connectivity is subject to Amazon approval and advertiser authorisation. Where approved and enabled, an advertising workflow may access advertiser/profile identifiers, campaign and ad-group settings, keywords or targeting, budgets, bids, statuses, search-term reports and performance metrics such as spend, attributed sales, ACOS and ROAS.

This information is used only for the approved advertising functionality: monitoring the authorised advertiser account, identifying performance changes, preparing recommendations, producing advertiser-specific reports and carrying out permitted actions the user authorises. Access is limited to the information and personnel needed for that purpose. We do not sell Amazon Ads data, publish it as public website content or use it for unrelated audience profiling.

Amazon Ads data must not be shared with an AI provider or combined with other third-party data unless permitted by Amazon's approval and policies, including prior written approval where required. A user's connection or action approval alone does not override those restrictions.

Other marketplace workflows may use authorised catalogue, listing, inventory and operational order information. Do not put buyer delivery addresses, contact details, customisation information or other unnecessary personal data into ChatGPT prompts, listing drafts or support tickets. Provider-specific permissions and restrictions determine what each workflow can access.

Shared identity and service providers

ProcessWorks uses the Lustra Studio identity service for sign-in, verification, account recovery and security checks. Authentication requests pass through that service; ProcessWorks does not keep a separate copy of your password in its workspace records. ProcessWorks workspace, client, support and activity records are stored separately from Lustra creative project records.

• Cloudflare: hosts the website and application and provides database, file-storage and network services used to operate the service.
• Connected commerce and advertising providers: Amazon and, where enabled and authorised, providers such as Shopify, eBay or Etsy receive the requests needed for your chosen workflow and return the information permitted by your connection.
• OpenAI: when you use a permitted ProcessWorks workflow through ChatGPT, the relevant requested information is returned to your conversation. OpenAI handles that information under the terms and privacy controls applicable to your account. Amazon Ads restrictions described above continue to apply.
• Lustra creative providers: if you choose a Lustra Studio image workflow, the prompts and reference images needed for that workflow may be sent to Google image-generation services through Lustra. Connecting a commerce account does not itself send all its data to image generation.
• Support, email and payment services: correspondence and transactions use the provider required for that function. Lustra creative billing remains separate; any ProcessWorks payment provider and payment terms are identified before purchase.

Providers receive information needed for their function, subject to applicable confidentiality, data-protection and platform restrictions. We may also disclose information where legally required, to handle a legal claim or to investigate misuse. We do not sell your personal information.

International processing

Cloud hosting, AI and other providers may process information outside the UK, including through international infrastructure. Transfer arrangements depend on the provider, service and destination. Where UK data-protection law requires a transfer safeguard, the transfer must be covered by an applicable adequacy arrangement or appropriate safeguards, such as approved contractual terms with any required additional protections.

Contact [email protected] for information about the destinations and safeguards relevant to your use of the service, and how to obtain a copy of applicable safeguards.

Cookies and browser storage

ProcessWorks uses browser storage for sign-in state and workspace preferences. Signing out clears the local ProcessWorks session; clearing browser storage may sign you out or reset preferences. The ProcessWorks marketing site does not currently embed PostHog or Google Analytics. Links to Lustra Studio, ChatGPT and marketplace sites open services with their own storage and privacy controls.

Any optional analytics or advertising tracking that requires consent must be explained and offered through an appropriate choice before it is used. Essential authentication and security storage is used to provide the service you request.

Retention, disconnection and deletion

We keep account and workspace information while needed to provide the service and administer the relationship. Support correspondence and audit records may remain for the time needed to resolve the issue, investigate security events, handle disputes or meet legal obligations. The criteria are the purpose of the record, whether it remains necessary, applicable platform requirements and any legal retention duty.

We do not currently provide a single automatic deletion timetable covering every record, file and provider. You can request deletion by email. We verify the request, identify the affected records and storage locations, process applicable deletions and explain any information that must remain and why. Deleting a workspace record does not by itself guarantee deletion of associated files or copies held by another service.

Amazon Ads data is subject to stricter purpose limits: it must be deleted when no longer needed for the approved functionality, on Amazon's request or when the applicable agreement ends, except where lawful retention is required and permitted. Any such retained data must be restricted to that legal purpose and deleted when that requirement ends.

Disconnecting a client or revoking provider authorisation stops future access through that authorisation; it is separate from deletion of existing records. Use the provider's own application-access controls to revoke permission and contact us for help with ProcessWorks connection records. Copies already returned to ChatGPT, held by a marketplace or included in backups have separate controls; a request to one service does not automatically delete every copy.

Security and incident reporting

We use HTTPS, shared account-security checks, workspace membership controls and activity records to protect service access. No online service can guarantee absolute security. See our security page for the controls and reporting process.

Report suspected misuse, a vulnerability or a privacy incident to [email protected] with the subject Security report. Include a safe description and contact method, but do not send live credentials. Reports are acknowledged, tracked, investigated and followed through containment and remediation, with notifications where applicable.

Your rights, choices and complaints

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal information. You may withdraw consent where it is the basis for a use. We may need to verify your identity and clarify the scope of a request.

Your right to object: you can object to processing based on legitimate interests. Contact us and explain your circumstances so we can assess the request. You can object to direct marketing at any time.

Where we process information for an agency or business customer, we may direct your request to that customer and assist it with responding. We respond within the applicable legal time limits, normally one month for UK rights requests, subject to lawful extensions or exceptions.

You can raise a concern with us or complain to the UK Information Commissioner's Office or another relevant data-protection authority. You do not have to contact us first to exercise that right.

Updates and contact

We update this notice when the service or its processing changes and show the revision date above. Privacy questions, requests for provider details and deletion requests can be sent to [email protected]. For service responsibilities and commercial conditions, see our terms of service.