Privacy Policy

Draft pending legal review.

Effective date: October 10, 2026

This policy explains what personal data HRjects ("HRjects", "we", "us") collects when you use the HRjects website and application, how we use it, and the choices you have. For a shorter summary of how we protect data, see our Security page.

1. The short version

• HRjects stores project information. It is not designed to hold employee records, pay data or personal details about staff, and we ask customers not to enter them.
• The personal data we hold about you is your email address, your name if you give one, and your activity in projects.
• We store no passwords.
• We do not sell personal data or use it for advertising.
• You can export and delete your data.

2. What we collect

Account data

• Email address. You give it when you sign in, or the person who invites you gives it when they send the invitation.
• Name. Only if you give one.
• Sign-in details. When you ask for a sign-in link, we store a one-way hash of the link until it is used or expires. Links are single-use and expire after 20 minutes. We never receive or store a password.

Activity data

We record your activity in projects: the changes you make, with your name and the time. This is the activity log that members of the project can see.

Technical data

Like any website, our servers receive your IP address and browser type with each request. We use the IP address to limit how many sign-in links one network can request in an hour, and for that purpose we keep only a one-way hash of it for up to two hours. Our hosting provider may keep its own short-lived server logs.

Project content

We store the content that you and others in your workspace enter: plans, tasks, process steps, checklists, issue descriptions and business case figures. Parallel payroll runs record a variance percentage only. This content is meant to describe a project. Please do not enter employee records, pay data, government identification numbers, health information or other personal details about staff. If the names of task owners or other people are typed into a project, we store them as part of that content.

3. How we use it

We use personal data to:

• sign you in and keep you signed in;
• show you the workspaces and projects you have access to, and check your role on every request;
• send sign-in links and invitations by email;
• show project members who changed what and when;
• keep the service secure and prevent misuse;
• answer your questions and requests; and
• meet our legal obligations.

We do not sell personal data. We do not use customer data for advertising.

4. Service providers

We share data with a small number of providers that process it for us:

Provider	What it does for us
Replit	Application hosting and database
Resend	Sending sign-in and invitation emails, and receiving email sent to hrjects.com addresses
Google (Gmail)	The mailbox where we read and answer messages you email to us

We may also disclose data if the law requires it, or to protect the rights and safety of our users, our company or others. If HRjects is involved in a merger, acquisition or sale of assets, data may be transferred as part of that, and this policy will continue to apply to it until you are told otherwise.

5. Who else sees your data

People in a workspace can see the names and email addresses of its members, and project members can see the activity log for that project. Workspace Owners control the workspace: they can change roles, remove people, export all workspace data and delete the workspace. If you use HRjects because your employer or a client invited you, they control the content in that workspace, and requests about that content are best sent to them first.

6. Cookies

We use one essential cookie. It keeps you signed in. It is HTTP-only and secure, and it lasts for up to 30 days. We do not use advertising or tracking cookies.

7. How long we keep it

• Account data is kept until you delete your account.
• Workspace and project content is kept until the project or the workspace is deleted.
• Removed projects are erased 30 days after removal.
• Sign-in links are deleted when used. Unused links expire after 20 minutes.
• Invitations expire after 7 days. The record of an invitation, including the email address it was sent to, is deleted 30 days after it expires, is used or is cancelled.

Activity entries that belong to a workspace are kept with that workspace after a person leaves it or deletes their account, so the project's history stays intact. We keep the most recent 5,000 entries for each project. They are deleted when the workspace is deleted. Copies of deleted data may remain for a limited time in systems run by our hosting provider.

8. Security

All traffic uses HTTPS. Session cookies are HTTP-only and secure. No passwords are stored. Every request is checked against your role in the workspace, and one customer's data is not reachable from another's account. No online service can promise perfect security. Our Security page lists what we do and what we do not have yet.

9. Your rights and choices

Depending on where you live, you may have rights over your personal data. Whatever your location, you can ask us to:

• access the personal data we hold about you;
• correct it if it is wrong;
• delete it; or
• export it.

Some of this you can do yourself. You can change your name and delete your account in your account settings. Workspace Owners can export all of a workspace's data and delete the workspace.

For anything else, email privacy@hrjects.com from the address on your account and tell us what you would like. We may ask you to confirm your identity. We will not treat you differently for making a request. If you are not satisfied with our answer, you may have the right to complain to the data protection or consumer authority where you live.

A data processing agreement is available to customers on request.

10. Children

HRjects is a business tool. It is not directed at children, and you must be at least 18 to use it. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email privacy@hrjects.com and we will delete it.

11. International transfers

We and our service providers may process data in the United States and in other countries where they operate. These countries may have data protection laws that differ from those where you live. By using the service, you understand that your data may be transferred to and processed in those countries. We do not offer a choice of data region at this time.

12. Changes to this policy

We may update this policy. When we make a change that matters, we will update the effective date above and tell you through the service or by email.

13. Contact

Questions and requests about privacy go to HRjects at privacy@hrjects.com.