Who we are

HR CRM is operated by the HR CRM team. Contact us at [email protected] for any question about this policy or your data.

Data we process

Account data: your name, email address, password (stored only as a hash), role and language settings.

Organization data: company name, logo, departments, positions and settings.

Records your company enters: vacancies, candidates, employees, notes, uploaded CVs and documents, offers, interviews, leave and survey records.

Technical data: logs of sign-ins and changes, needed for security and audit.

Google user data

Connecting a Google account is optional. If you connect one in Settings → Integrations, HR CRM asks for these permissions and uses them only for the features below:

Your email address and basic profile — to show which mailbox is connected.

Send email on your behalf (gmail.send) — to send the messages you write in HR CRM to candidates and employees from your own mailbox: job offers, interview invitations, surveys and other letters. HR CRM does not read, search or store the contents of your mailbox.

View and edit events on your calendars (calendar.events) — to create, update and cancel the interview events you schedule in HR CRM, with a Google Meet link. To offer free time in booking links, HR CRM reads only the start and end times of your existing events; titles, descriptions and attendees of your other events are not read or stored.

Access tokens are stored encrypted on our servers. We keep the identifiers of sent messages and created events so the history in HR CRM stays accurate.

HR CRM's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google user data for advertising, do not sell it, and do not transfer it to third parties except as necessary to provide the features above, for security, or to comply with the law. No person at HR CRM reads this data unless you ask us to for support, or it is needed for security or legal reasons.

You can disconnect Google at any time in Settings → Integrations or at myaccount.google.com/permissions. On disconnect we revoke the access and delete the stored tokens.

Telegram and the AI assistant

Connecting your Telegram is optional. When a team member connects the “Telegram AI assistant” in Settings → Integrations, HR CRM gets access to their private chats in order to keep candidate cards up to date.

New messages of private chats are sent to an AI model (Anthropic) that decides whether the chat is with a candidate and returns data for the card: name, contacts, vacancy, stage, facts and resume.

HR CRM does not store message text. Chats the AI recognizes as personal or work chats are not read again. Only the extracted data and resume files sent by the candidate are saved to the candidate card.

Anthropic processes the data only to fulfil the request and does not use it to train models. The assistant can be disconnected at any time in Settings → Integrations or in Telegram: Settings → Devices.

How we use data

To provide and improve the service, to send the emails you ask HR CRM to send, to protect accounts, to process payments and to answer support requests. We do not show ads and do not sell personal data.

Who we share data with

Only with providers that run the service for us: hosting and network infrastructure, an email delivery provider for system emails (account verification, password reset), and a payment provider for subscriptions. They process data only on our instructions.

Telegram and Anthropic AI models — only if a team member connected the AI assistant.

Storage and deletion

Data is kept while your organization's account is active. You can delete records in the app at any time. The organization owner can download all data with every CV and document, and delete the organization with all its data, in Settings → General; deletion takes effect immediately, and copies in backups are overwritten within 14 days. You can also write to [email protected] and we delete the data within 30 days. Payment records are kept as the law requires.

Candidates and employees whose data a company keeps in HR CRM can ask that company, or us, to access, correct or delete it.

Security

Traffic is encrypted with TLS, passwords are hashed, access tokens are encrypted, and each organization's data is isolated from other organizations.

Users can turn on two-factor sign-in with an authenticator app. How we protect the data your company keeps in HR CRM is described in the Data Processing Agreement.

Children

HR CRM is a business tool and is not intended for children under 16.

Changes

We publish any change to this policy on this page with a new date.