Privacynothing kept
What we collect, and what we don't.
This notice covers two different things that are easy to confuse: this website, which collects almost nothing, and the wayworks product, where your organisation decides what is held and we hold it on their instructions. The rules that apply are different in each case, so they are separated below.
Last reviewed 13 September 2026 · controller: legal entity name and registered address
This website
No cookies. No analytics.
That is not a position we are working towards. It is what the pages you are reading actually do, and you can confirm it in your browser's developer tools in about ten seconds.
- No cookies are set
This site sets no cookies of any kind — not necessary ones, not preference ones, none. There is no consent banner because there is nothing to consent to.
- No analytics, no tag manager, no pixels
No Google Analytics, no advertising or social pixels, no session recording, no heatmaps, no A/B testing tool. Nothing on these pages reports your visit anywhere.
- Nothing is stored in your browser
No local storage, no session storage, no fingerprinting. Close the tab and nothing of this visit remains on your machine.
- The interactive parts compute in your browser
The cost calculator, the fit check and the workspace demo all run in the page. The figures you type are never transmitted — they do not reach a server at all, ours or anyone's.
- Fonts are the one exception
Typefaces are loaded from Google Fonts, so Google receives your IP address and user-agent in order to serve the files. If that matters to your organisation, tell us — the fonts can be self-hosted, and we will do it.
- Server logs
Our host records ordinary request logs — IP address, time, page, user-agent — to serve the site and defend it from abuse. Retention is the host's log retention period.
no banner, because
there is nothing to ask
When you contact us
The things you send on purpose.
- Email
If you write to hello@debuginit.com we hold the message and your address in order to reply and to keep a record of the conversation. Legal basis: legitimate interests, and steps taken at your request before a contract.
- Feedback on a letter
The letters page has a feedback box. Where the page cannot deliver it, it opens a draft in your own mail client instead and tells you so — it never pretends to have sent something it did not. The files are never withheld either way.
- Nothing is sold or shared for advertising
We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not profile you. This is true as a matter of fact, not only as a policy.
The product
Your data, held on your instructions.
Inside a wayworks workspace, your organisation is the controller and we are the processor. You decide what goes in, who may see it and how long it stays; we act on those instructions and nothing else. The terms that bind us are in the data processing addendum.
- What is held
Whatever your organisation puts there — people records, tasks, documents, time, payroll and finance records among them. The categories depend on which modules you switch on.
- Where it is held
hosting provider and the regions offered. The product is designed so an organisation can hold its space in a region it chooses.
- How long
For as long as your organisation keeps it, plus the post-termination deletion window after the agreement ends. Retention rules inside the product are yours to set.
- Who else touches it
Only the subprocessors on the published list, each under written terms. You are told before that list changes.
- If you are an employee of a customer
Your employer, not us, decides what is held about you and answers your requests. Ask them first; we will help them, and we will point you to them if you ask us.
Your rights
What you can ask for.
These rights come from different laws in different places, and the detail varies, but the practical position is the same everywhere: you may ask what is held, ask for a copy, ask for it corrected, and ask for it deleted.
- EEA and UK — GDPR
Access, rectification, erasure, restriction, portability, objection, and the right not to be subject to solely automated decisions with legal or similarly significant effects. You may also complain to your supervisory authority — for the UK, the ICO.
- California — CCPA as amended by CPRA
Know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information, so there is no opt-out link to offer; we will confirm that in writing on request. You will never be treated differently for exercising a right.
- Other US states
Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Florida, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky and Rhode Island have comparable rights on their own timelines. We apply the same process to all.
- India — DPDP Act 2023
The DPDP Rules were notified in November 2025 and phase in, with the substantive obligations on data fiduciaries landing around May 2027. Access, correction, erasure, grievance redressal and nomination apply.
- Brazil — LGPD
Confirmation, access, correction, anonymisation, portability, deletion, and information about sharing.
- Canada, Australia, South Africa and others
PIPEDA and Quebec's Law 25, the Australian Privacy Act, POPIA in South Africa, APPI in Japan, PIPA in Korea and PIPL in China each give comparable rights. Write to us and we will handle it under whichever applies to you.
Ask by writing to hello@debuginit.com. We answer within one month, and tell you if we need longer and why. We do not charge, except for requests that are manifestly unfounded or repetitive.
Moving data across borders
Transfers.
- The mechanism
Where data leaves the EEA or the UK, transfers rely on the European Commission's Standard Contractual Clauses, with the UK International Data Transfer Addendum where the UK is involved, plus a transfer risk assessment.
- Adequacy
Where the destination has an adequacy decision, that is relied on instead, and no further mechanism is needed.
- Keeping it in one place
If your organisation needs its space to stay in one region, that is a deployment decision rather than a policy one, and it is available. Ask before you sign.
Contact
Ask us anything about this.
Privacy questions, a rights request, or a security review that needs answers we have not published — the same address reaches us, and a person reads it.
- Privacy contact
- Data protection officer
DPO, or a statement that none is required
- EU or UK representative
Article 27 representative, if one is required