Privacy Policy

Introduction

WorkRail ("we," "us," or "our") operates a reentry employment platform designed to support Colorado Employment Transition Navigators (ETNs) and the individuals they serve. This Privacy Policy explains how we collect, use, share, and protect personal information when you use the WorkRail platform. By using WorkRail, you agree to the practices described here.

Data We Collect

We collect the following categories of personal information:

• Identity information: Full name, date of birth, and government-issued identification numbers as provided during intake.
• Contact information: Email address and phone number.
• Employment history: Prior work experience, skills, certifications, and any occupational restrictions related to parole or probation conditions.
• Coaching and case notes: Progress records, barrier assessments, and notes entered by assigned ETNs during case management.
• Call recordings and transcripts: Outbound calls placed through the WorkRail platform may be recorded for quality assurance and case documentation purposes. Participants are notified before recording begins.
• Usage data: Log data including IP addresses, browser type, and pages visited, collected automatically to maintain platform security and performance.

How We Use Your Information

We use your information for the following purposes:

• Facilitating case management between clients and their assigned ETNs.
• Matching clients to employment opportunities, apprenticeships, and job fairs based on skills, certifications, and parole-specific eligibility requirements.
• Enabling secure communication between ETNs and their clients.
• Generating AI-assisted resumes, coaching content, and employer outreach materials. AI-generated content is reviewed and approved by ETNs before use.
• Producing aggregate, de-identified reports for authorized state agency partners to track program outcomes.
• Maintaining platform security, preventing fraud, and complying with applicable law.

Data Sharing

We do not sell your personal information. We share your information only in the following limited circumstances:

• Your assigned ETN: The Employment Transition Navigator managing your case has access to your profile, employment history, coaching records, and call logs.
• Authorized state agency users: Staff at Colorado Division of Criminal Justice (DCJ) authorized agencies may access aggregate case data for program oversight. Individual record access is limited to directly authorized personnel.
• Infrastructure providers: WorkRail runs on Supabase (database and authentication) and Vercel (hosting). These providers process data only as necessary to deliver platform services and are bound by data processing agreements.
• Legal requirements: We may disclose information if required by law, court order, or to respond to lawful requests from public authorities.

Data Retention

Your data is retained for as long as your case is active in WorkRail. When a case is closed, your information is retained in accordance with applicable state record-keeping requirements unless a deletion request is received.

Upon written request to privacy@workrail.io, personal data will be deleted within 90 days of account closure, except where retention is required by law or legitimate agency oversight obligations.

Your Rights

You have the right to:

• Access: Request a copy of the personal information WorkRail holds about you.
• Correction: Request that inaccurate or incomplete data be corrected.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Restriction: Request that we restrict processing of your data while a correction or deletion request is reviewed.

To exercise any of these rights, contact us at privacy@workrail.io. We will respond within 30 days.

Security

WorkRail takes data security seriously. All data is encrypted in transit using TLS 1.2 or higher and encrypted at rest using AES-256 encryption within our Supabase and Vercel infrastructure. Access controls, audit logging, and row-level security policies are enforced at the database layer to ensure that only authorized personnel can access specific records.

While we implement industry-standard safeguards, no system is completely immune to risk. If you suspect a security issue, please contact compliance@workrail.io immediately.

California Residents — CCPA Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions.
• Right to Opt-Out of Sale: WorkRail does not sell personal information. No opt-out is required, but you are entitled to this disclosure.
• Right to Non-Discrimination: We will not discriminate against you for exercising any CCPA rights.

To submit a CCPA request, email privacy@workrail.io with "CCPA Request" in the subject line.

Minors

WorkRail is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If you believe a minor's data has been submitted to the platform, contact us at privacy@workrail.io and we will promptly remove it.

Changes to This Policy

We may update this Privacy Policy periodically. When we do, we will revise the "Last updated" date at the top of this page. Continued use of WorkRail after any changes constitutes acceptance of the updated policy. Material changes will be communicated to active users by email.

Contact Us

For privacy-related questions or to exercise your rights, contact us at: