Privacy

Last updated: 1 November 2026

This website

workyol.com is a static page. It sets no tracking cookies and runs no analytics or advertising scripts. It remembers your language choice in your own browser only. Partner links: if you arrive through a partner link (?ref=…), a first-party cookie wy_ref keeps only that partner’s code for 60 days, so the partner can be credited if you start a trial or buy. The click is counted with an anonymous id that changes every day; no IP address is kept. Partners never see your name or e-mail (partner terms). Our web host keeps standard server logs (IP address, date, page requested) for security, for a limited time.

When you buy

Workyol is sold by Afrikyol, LLC (Delaware, USA). Card payments are handled by Stripe: you type your card details on Stripe’s own checkout page and we never see or store them; Stripe processes them under its own privacy policy (stripe.com/privacy). From Stripe we receive your name, e-mail, country and the payment status, so we can send your licence key, handle refunds, send updates and answer support requests. Orders placed by WhatsApp or e-mail are paid against an invoice; we keep the invoice details the law requires. We do not sell or share your details. Licence e-mails are sent through our e-mail provider, Brevo (Sendinblue SAS, France).

When you e-mail us

We use your e-mail only to reply and to provide the support you asked for.

The Workyol software

Workyol runs on your own computer or server. Your contacts, messages, reports and access tokens stay there. They are sent only to Meta’s official platforms (WhatsApp Business Platform, Messenger, Instagram) when you send or answer messages, and never stored by us (only the licence check and the message relay described below reach us). You are the controller of that data and responsible for having a legal basis (such as consent) to message your contacts.

Message relay

So that you need no tunnel or public address, each activated computer gets a permanent webhook address at workyol.com (workyol.com/hook/…). You give this address to Meta, and Meta sends to it the notifications for your accounts: incoming messages and comments, and delivery reports. Our server keeps each notification exactly as Meta sent it only until your Workyol collects it, usually within seconds, and then deletes it. Anything not collected is deleted after 3 days at most. We do not read, analyse or share these notifications. Your Workyol checks Meta’s signature on each one with your App secret, which never leaves your computer. If you prefer, you can give Meta your own public address instead (Settings → Webhook → Advanced), and then nothing passes through our server.

Scheduled posts

When you choose “Post from workyol.com” for a Reel or a LinkedIn post, your Workyol sends the video, its cover and caption, and an encrypted copy of your Page access token to our server, so the post can go out at the chosen time even when your computer is off. The video is deleted from our server as soon as it is published (at most 7 days after the post’s date if something fails), and the post record 60 days after it is finished. Posts published from your own computer never pass through our server. The Schedule report, exports and monthly reports are made on your own computer from your own data and are not sent to us.

If you connect LinkedIn in Workyol, you sign in on LinkedIn through your own LinkedIn app (“Sign In with LinkedIn using OpenID Connect” and “Share on LinkedIn”). LinkedIn asks you to let Workyol read your name and profile id (openid, profile) and post on your behalf (w_member_social). Workyol uses this only to publish the posts you schedule, with the text, picture or video you choose, at the time you choose. It does not read your messages, connections or feed, and we never share this data. LinkedIn gives the access for 60 days; Workyol shows the days left, and workyol.com e-mails you a Reconnect link 7 and 3 days before it ends. Your LinkedIn access stays on your own computer, except for posts sent with “Post from workyol.com” (same rules as above). You can disconnect in Workyol at any time, or remove Workyol in your LinkedIn settings (Data privacy → Permitted services). See also the LinkedIn Privacy Policy.

YouTube

If you click “Connect YouTube” in Workyol, Google asks you to let Workyol upload videos to your YouTube channel (youtube.upload), see which channel it is and its playlists (youtube.readonly), and add a video to one of your playlists and post a comment (youtube.force-ssl). Workyol uses these permissions only for what you ask on its YouTube page: to upload the videos you choose, with the title, description, tags, visibility, publish time and thumbnail you set; to add each one to the playlist you pick; to post the first comment you type under it; and to show the name and picture of the connected channel and the list of its playlists. It never changes or deletes your existing videos, comments or captions, and it does not read your subscribers, analytics or other people’s data.

What is kept, and where: workyol.com keeps the channel’s id, name and picture link, a count of today’s uploads (Workyol allows 3 a day per channel), and Google’s lasting access for that channel, encrypted with a key only our server has. Your computer only receives a pass valid for one hour for each upload; the video itself goes straight from your computer to YouTube and never passes through our server. Nothing from your YouTube account is sold, shared with anyone else, used for advertising, or used to train AI models.

You can stop it at any time: “Disconnect” on Workyol’s YouTube page deletes the stored access from our server and asks Google to cancel it, and you can also remove Workyol at myaccount.google.com/permissions. When the access is removed, everything we kept about that channel is deleted at once.

Workyol uses the YouTube API Services. By connecting YouTube you agree to the YouTube Terms of Service; Google’s handling of your data is described in the Google Privacy Policy. Workyol’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This section covers the data Workyol receives through Google APIs when you connect YouTube: the channel’s id, name and picture link, the list of its playlists, and Google’s access for that channel. Workyol shares, transfers or discloses this Google user data only with:

Google / YouTube itself, to do what you ask: the videos, titles, descriptions, tags, thumbnails, playlist choices and first comments you set are sent to YouTube through the YouTube API Services, and the access is sent back to Google to upload, to refresh it, or to cancel it when you disconnect.
Our hosting provider, Hostinger (Hostinger International Ltd.), which runs the workyol.com server where the encrypted access, the channel id, name and picture link and the daily upload count are stored. Hostinger acts only as our infrastructure provider (a data processor): it stores this data for us and does not use it for anything else.
You: your own Workyol app on your computer receives the channel name, picture and playlists to show them to you, and a one-hour pass for each upload.
Authorities, only if the law requires it: we would disclose data only when we are legally obliged to (for example a valid court order), and only the data required.

We do not share, sell, rent or transfer Google user data to any other company or person: not to advertisers, data brokers or information resellers, not to other users, and not to AI or analytics services. It is never used for advertising, never used to train AI or machine-learning models, and never read by people at Afrikyol, LLC unless you ask us to look at a problem with your connection, or for security or legal reasons. If Afrikyol, LLC were ever merged or sold, Google user data would only move to the new owner under this same policy, and we would tell you first so you can disconnect and have it deleted.

How we protect sensitive data

This covers the sensitive data that reaches our server: Google user data (your YouTube channel’s access, id, name, picture link and playlists), the Page access tokens of scheduled posts, and licence and order data. We protect it as follows:

Encryption in transit: every connection between your Workyol app, our server and Google or Meta uses HTTPS (TLS). Nothing is ever sent unencrypted.
Encryption at rest: Google’s lasting access for your channel (the refresh token) and every Page access token are encrypted with AES-256-GCM before they are stored, each with its own random value. The key is kept only in a private settings file on our server, outside the public website, and is never stored in the database, in backups of the database, or on your computer.
Least data, short life: your computer only ever receives a pass valid for one hour; the lasting access never leaves our server. Your videos go straight from your computer to YouTube and never touch our server. Licence keys are stored only as fingerprints (one-way hashes) and IP addresses only in a scrambled form.
Restricted access: the server’s private folders and settings are blocked from the web, the database password is kept only in that private settings file, and only the founder of Afrikyol, LLC has administrator access, protected by strong, unique passwords. Staff never read Google user data except as described above.
Secure code: database requests use parameterised queries, Google sign-in uses a one-time random state value to block forged requests, and messages between our own services are signed and time-limited.
Deletion: when you click “Disconnect” or remove Workyol in your Google account, we revoke the access at Google and delete everything we kept about that channel at once. You can also ask us to delete it by writing to hello@workyol.com.
Incidents: if we ever learned that Google user data or other personal data had been exposed, we would revoke the affected access, fix the cause, and inform the affected users and, where the law requires it, the authorities, without undue delay.

Connections and AI assistants

Incoming actions (a website form, Zapier, Make or n8n adding a contact or sending a template) can be sent to your private address workyol.com/in/…; our server keeps each request, with a fingerprint of your connection key, only until your Workyol collects it, like the message relay. Outgoing events go directly from your computer to the addresses you add; they never pass through our server. AI assistants on your computer (Claude, Codex, Gemini CLI, Cursor…) talk to your Workyol directly. If you turn on the ChatGPT connector, ChatGPT’s requests and your Workyol’s answers pass through workyol.com/mcp/… only to be handed over, and are deleted within an hour at most; our server keeps a fingerprint of the connector address, never the address itself. What you share with an AI assistant, a video generator (such as Higgsfield) or an automation tool is governed by that company’s own privacy policy.

Licence check

When you activate your licence key, and regularly after that (when the app starts, every few hours and before a real campaign), the software sends the key, your computer’s name and system to our licence server at workyol.com to confirm the key is valid and count how many computers use it. Before each real campaign it also sends the number of messages in it, so trial licences can be limited. Nothing else is sent: no contacts, messages, templates or Meta credentials. Our server stores only a fingerprint of each key and a scrambled form of your IP address (to stop abuse).

Your rights

You can ask us to access, correct or delete the personal data we hold about you (your order, e-mails, and any YouTube or LinkedIn data kept on our server for scheduled posts) by writing to us.

Questions: hello@workyol.com · Back to workyol.com