Skip to main content
At Windmill, privacy and security are at the core of what we do. We act as a central hub for your cloud service providers, integrating them into a single place to help improve company efficiency and operations.

​
What Windmill collects

Windmill connects to your authorized business applications through their APIs. We only collect data that’s necessary to provide our service and only from systems you explicitly authorize. From your HRIS (HR system) We collect basic organizational data to build your org chart and roster: first and last name, work email, job title, department, manager and reporting structure, start date, employment status, and gender (if your HRIS provides it). What we do NOT collect from HRIS Home addresses, Social Security Numbers, government IDs, dates of birth, phone numbers, pronouns, compensation, payroll, benefits, bank account details, and employment contracts. These fields are never requested or stored, even if your HRIS contains them. See Personally Identifiable Information for the full canonical list of fields and their sources. From connected productivity tools When you connect tools like Slack, Google Workspace, GitHub, Jira, or Linear, we collect activity data that helps Windy understand collaboration patterns and generate insights. The specific data collected depends on which integrations you enable.

​
No browser installations

Windmill does NOT install anything on employee computers or in browsers. We only connect with the APIs of explicitly authorized business applications.
  • We collect as little or as much as authorized by the business owner
  • Windmill simply pieces together data that already exists in your connected systems

​
Privacy and access controls

Connected-content permissions When connected content has source-level access controls, Windmill keeps that permission context. For example, a private Google document or Slack channel does not become visible to people who cannot access it in the source. Some integrations provide company-level activity or usage data instead. Windmill applies the permissions for that feature to this data. Org chart scope The org chart defines direct and indirect reporting subtrees. Managers can use this scope in supported features. Roles, delegation, source permissions, and feature-specific privacy rules can provide or limit other access. Admin visibility Windmill Admins manage workspace configuration, integrations, billing, and access settings, but admin status alone does not grant unlimited visibility into every employee’s content. Source permissions, org-chart scope, delegation, and feature-specific privacy rules still apply. Admins and Data Analysts can view company-wide analytics where the analytics feature provides that access. 1:1 auditability 1:1 auditability is an explicit company-level setting for compliance, employee relations, and manager support. When enabled, authorized managers or HR Admins can review shared manager/direct 1:1 notes and history in a read-only audit view. Private Notes, participant-specific prep topics, Catch Me Up reports, and recording access are excluded. Access delegation Admins and HR Admins can give one member supported manager-like visibility into another manager’s reporting scope. Delegation does not provide access to the other member’s account and does not let the delegated member impersonate that person. Delegation does not provide all content that the selected manager can see. It excludes 1:1 notes and agendas, does not change Google or Slack permissions, and does not override feature-specific privacy rules. See Permissions and Access for all limits.
Delegation changes start an access refresh after you save the rule. Only Admins and HR Admins can add or remove delegation rules.

​
Product analytics

Windmill uses PostHog to understand how people use Windmill, so we can improve the product. We record:
  • The pages people visit and the actions they take in Windmill
  • The name and email of the signed-in person, and their company name
  • When someone saves a change, the name of the action, whether it worked, and how long it took. We don’t record what they entered
Admins can turn this off with Allow product analytics under Data controls in Settings > Security. When it’s off, PostHog doesn’t load in the browser and we stop sending these events for your company.
The change can take up to 5 minutes to apply everywhere. We always record when a company creates an account and when it completes payment.

​
Session recording

PostHog can record sessions in Windmill so we can find and fix issues faster.
  • Recordings show the pages people visit and what they click
  • Recordings hide text typed into form fields, and sensitive values such as API keys and SCIM tokens
  • Other text on the screen, such as review content, can appear in recordings
Admins can turn this off with Allow session recording under Data controls in Settings > Security. Product analytics keeps working when only session recording is off. When product analytics is off, session recording is also off.

​
Changing data controls

You can find these settings under Data controls in Settings > Security: Allow model training, Allow AI telemetry, Allow product analytics, and Allow session recording.
  • All four are on by default, unless your Windmill contract sets them
  • Admins, HR Admins, and Integration Managers can change them
  • If your contract sets a control, its toggle is locked. Contact support to change it
  • Changes to product analytics and session recording apply when you refresh the page
  • When product analytics is off, session recording is also off and you cannot turn it on

​
Historical data

When you connect systems, the amount of historical data varies by integration. For Reviews and 1:1s, Windmill will collect data on a go-forward basis from when the system was connected. If you are interested in capturing more historical data, let us know during onboarding or reach out via your shared support Slack channel.

​
Data retention

Windmill keeps your company’s data while you have an active engagement with Windmill. When your engagement ends, Windmill deletes all of your company’s data 60 days after your account closes. You do not need to request deletion. Before we delete your data, we send emails to the Admins of your account:
  • 30 days before deletion
  • 7 days before deletion
  • 24 hours before deletion
During these 60 days, you can ask us to export your data or to delete it immediately. Send your request to support@gowindmill.com.
After we delete your data, our backups keep a copy for 30 more days. We use this copy only to restore data that we deleted by mistake. After 30 days, the backup copy is removed.

​
Deleting data before your engagement ends

If you must delete data sooner, for example because one of your customers asks for deletion, send a written request to support@gowindmill.com. Our team does the deletion for you. Windmill does not have a self-serve deletion API or a setting to change the retention period.

​
Additional resources

For more detailed information about our privacy practices: