Privacy Policy
This Privacy Policy describes how CWS collects, uses, discloses, retains, and protects information in connection with our websites and software services, including Hannah, our AI-powered HR information assistant. Additional agreements, including Hannah’s Terms of Service, may govern business customers’ use of the service.
1. Scope and Our Roles
This Policy applies to information collected through CWS websites, including creativeworkforce.ai, requests for demonstrations and trials, customer account administration, communications, and the Hannah service. It does not govern a third party’s separate website or service merely because we link to it.
For Hannah employee conversations and employer-uploaded materials, the subscribing organization ordinarily determines the purposes and means of using the service. CWS processes that information to provide and support Hannah on the organization’s behalf. For our own website, marketing, sales, billing administration, security, and business operations, CWS may determine how information is used. Employees seeking access to, correction of, or deletion of employer-controlled Hannah records should normally contact their employer first.
2. Information We Collect
2.1 Website, sales, and account information
When you register for a trial, request a demonstration, contact us, or manage an account, we may collect names, company names, business addresses, phone numbers, email addresses, account credentials or identifiers, messages you send, and subscription or billing-related details. Payment transactions are processed by Stripe.
2.2 Hannah content and usage
Hannah may process administrator and employee names, work contact details, employee groups, account and authentication identifiers; where a customer connects TimeOut, leave balances and requests; policies, handbooks, and other reference documents uploaded by an employer; questions entered by employees; generated responses; conversation histories, including messages exchanged through Slack, Microsoft Teams, or WhatsApp where a customer connects them; answers and completed PDFs for forms submitted through Hannah; and technical, usage, sign-in, security, and support information. Customer administrators can view individual employee questions and Hannah’s answers. Employees should not assume that their Hannah conversations are private from their employer.
Employers should upload reference materials appropriate for workforce-wide use, not sensitive employee personnel files. Users should avoid including unnecessary sensitive information in questions. Information entered despite these instructions may still be processed as part of providing the service.
2.3 Website analytics, cookies, and logs
Our websites and the Hannah web application may use cookies, browser or device identifiers, and analytics tools to understand usage and improve the websites and services. These technologies may collect browser type, IP address, pages and links viewed, referring pages, device information, and similar activity records. Some cookies persist after a browser session. You can change browser settings to block or delete cookies, although doing so may affect functionality.
These tools include Google Analytics, provided by Google LLC, on our websites and the Hannah web application, and Statcounter on our marketing websites. We configure them so that we do not send them your name, email address, company name, or the content of any documents, questions, or answers. Our pages also load fonts from Google, and our signup page may use Cloudflare Turnstile to prevent abuse; these services receive technical information such as your IP address. To learn how Google uses this information, see https://policies.google.com/technologies/partner-sites.
We may advertise our products, including Hannah, on Google. We use Google Analytics and Google Ads together to measure how our advertising performs, for example whether a visit from one of our ads led to a trial or a purchase. For this purpose, Google may use cookies and device identifiers, and we send Google events such as a trial start or a purchase, together with a pseudonymous identifier and, for purchases, the amount and currency. Google’s use of this information is governed by its Privacy Policy (https://policies.google.com/privacy).
3. How We Use Information
We use information, as applicable, to provide trials and subscriptions; configure and operate Hannah; authenticate users; retrieve reference materials and generate answers; maintain employee conversation histories while customer accounts remain active; provide technical support; review the quality of Hannah’s answers; process billing; protect against misuse and security incidents; communicate about service changes and accounts; analyze and improve our websites and offerings; measure the performance of our advertising; and comply with legal obligations.
We may send newsletters, offers, and other marketing communications to business contacts, subject to applicable law and available unsubscribe options. We do not use SMS authentication messages for advertising or marketing. CWS does not use Hannah Customer Data to train general-purpose AI models, for advertising, or in our website analytics.
4. Hannah AI Processing and Employer Visibility
Hannah uses third-party AI services to process employer-provided reference materials and answer employee questions. Uploaded reference documents are split into passages on the servers that host Hannah, and those passages are sent to Voyage AI to build the search index. When a customer uses document analysis features, such as the Hannah Review during setup and Smart Forms, the full document is transmitted to Anthropic’s API for that analysis. When an employee asks a question, Hannah transmits the question, relevant conversation context, Special Instructions set by the employer, information retrieved from a connected TimeOut account, and relevant retrieved excerpts from the reference materials for answer generation; the complete document library is not transmitted with each question. The question is also sent to Voyage AI to search the reference materials. When an employee fills out a form in chat, Hannah transmits their answers and employee profile details to Anthropic’s API. To review answer quality, Hannah may also transmit the question, the answer, and the employee’s email address to Anthropic’s API. If a user asks questions by voice, the speech recognition built into their web browser hears the question, and the browser’s maker may process the audio.
Under the applicable provider terms, Anthropic does not use this information to train its models. Actual provider retention and processing are governed by the applicable provider agreement, API settings, and exceptions. AI responses may be inaccurate, incomplete, or outdated and should be checked against the employer’s authoritative policies.
A customer’s designated Hannah administrators may review individual employee questions, responses, and conversation histories. Employers are responsible for informing their personnel of this visibility and for deciding how their personnel’s information may be used.
5. When We Disclose Information
CWS may disclose information to providers that help us operate our websites and Hannah, subject to appropriate arrangements; to an employer and its authorized administrators in connection with that employer’s Hannah account; to the approvers and recipients of forms submitted through Hannah; to comply with legal obligations or lawful requests; to protect rights, safety, and service integrity; and as part of a corporate acquisition, merger, sale, reorganization, or similar transaction.
Hannah providers currently include Microsoft Azure (hosting and data storage), Anthropic API (document and answer processing), Voyage AI (search indexing), Twilio (authentication messaging by SMS and email), Stripe (subscription payment processing), Google (analytics, advertising measurement, and web fonts), and Statcounter (website analytics). Where a customer or feature uses them, providers also include Slack, Microsoft Teams, and Meta WhatsApp (message delivery), ElevenLabs (voice), and Cloudflare (signup abuse prevention). Additional providers may be identified in Hannah’s maintained Subprocessor List. Some providers, such as Stripe and Google, may also process information for their own independent legal and operational responsibilities.
We do not rent or sell personal information to third parties without consent. Mobile phone numbers and SMS consent information are never sold, rented, or shared with third parties or affiliates for marketing or promotional purposes.
6. Data Retention, Export, and Deletion
We retain website, account, and business records for as long as reasonably needed for the purposes described in this Policy, subject to applicable legal obligations and retention practices. Marketing contacts may opt out of promotional communications; an opt-out does not necessarily require deletion of billing, security, or legally retained records.
For Hannah, employee conversation histories are retained for the duration of the subscribing organization’s active account, without an automatic per-conversation expiration period. Authorized customers can request an export of their Hannah chat data through CWS; export is not currently self-service. CWS will verify and securely fulfill requests according to the applicable service process. When a user deletes a chat message in Hannah, it is removed from that user’s view but remains in the customer’s stored records.
Following termination or closure of a Hannah account, CWS deletes Customer Data from active production systems, service logs, and applicable subprocessors within thirty (30) days, subject to applicable legal retention requirements and the independent obligations of certain providers. Residual Customer Data in disaster-recovery backups is deleted no later than one hundred eighty (180) days following account termination or closure. Backup data is restricted to recovery purposes, and restored data remains subject to applicable deletion obligations. A self-serve free trial that ends without being continued is deleted with its information when the free period ends, subject to the backup period above.
7. Security and Incidents
CWS uses commercially reasonable administrative, technical, and organizational safeguards designed to protect information handled through its websites and services. Each customer’s Hannah information is stored separately from other customers’ information. No system is guaranteed to be completely secure. We investigate suspected security incidents and provide notifications when required by applicable law or contractual commitments.
8. Choices and Privacy Requests
You may opt out of CWS promotional emails using the unsubscribe instructions in those messages or by contacting info@cws-software.com. You may manage cookies through browser settings and any choices made available on our websites. To stop Google Analytics from collecting information about your visits, you can install the Google Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout). To control how Google uses information for ads, visit My Ad Center (https://myadcenter.google.com/).
Depending on your state and the information involved, you may have rights to access, correct, delete, or obtain a copy of personal information, or to opt out of specified processing. Such rights may be subject to exceptions. Send requests concerning information CWS controls to info@cws-software.com. For employer-controlled Hannah records, contact your employer; CWS may assist employers with requests as required. We may need to verify identity and authority before fulfilling a request.
California residents may also have rights under applicable California privacy statutes, including requests concerning certain disclosures for direct marketing under California Civil Code § 1798.83.
9. SMS and Mobile Messaging
CWS uses SMS text messages solely for identity verification, including one-time passcodes when a user initiates authentication. CWS does not send marketing or promotional SMS as part of this program. Users provide their mobile numbers for this purpose; we do not purchase phone numbers from marketing lists.
Mobile phone numbers and SMS consent information will not be sold, rented, or shared with third parties or affiliates for marketing or promotional purposes. SMS data is used only to provide, operate, secure, and support authentication, except as required by law. Message frequency varies based on user-initiated requests; message and data rates may apply.
Reply STOP to stop receiving SMS messages, or HELP for assistance, where supported by the messaging program; you may also contact support@cws-software.com. Authentication may be unavailable by SMS after opting out. See the SMS Terms & Conditions at https://cws-software.com/sms-terms/.
10. Children, Outside Links, and Geographic Scope
Our websites and Hannah are not directed to children under 13, and CWS does not knowingly solicit personal information from children under 13. If you believe we have collected such information, contact us so we can review and take appropriate action. Linked external websites and services have their own privacy practices.
Hannah is offered to business customers in the United States. This limitation on sales does not, by itself, establish that every data transfer, processing activity, or individual user is located in the United States.
11. Changes to This Policy
We may revise this Policy as our practices or legal requirements change. We will publish the updated version and its effective date, and provide additional notice of material changes when required by law.
12. Contact Us
Custom Workflow Solutions, LLC dba CWS Software
17 Broadway, Second Floor
Florham Park, NJ 07932
General privacy questions: info@cws-software.com
Hannah support and authentication: support@cws-software.com
Telephone: +1-877-214-4954