We collect data you provide (company name, email, role, job title) and usage data for service delivery. Employee PII is handled under your company's privacy obligations.
Data is stored on Cloudflare infrastructure — D1 (SQLite) for structured data and R2 for uploaded documents. I-9 scans and compliance documents are encrypted at rest (AES-256). Tenants are isolated at the data layer.
For EU new hires, we provide a Data Processing Addendum (DPA) on request and rely on Standard Contractual Clauses (SCCs).
We do not use customer or employee data to train, fine-tune, or improve our AI models. Data is used only for real-time generation for your company.
Data is retained for the duration of your account. On cancellation, data is retained for 30 days for reactivation or export, then deleted.