Privacy Policy

1. Who we are

HRpotamia, Erbil, Kurdistan Region, Iraq. Contact for privacy matters: contact.hr@examopotamia.com. Where the law requires a representative in the EU or UK, we will appoint one and publish the details here.

2. Data we process and why

Account data (as controller): name, work email, role, hashed password, sign-in times, language preference, and the workspace you belong to. Purpose: to provide and secure your account. Legal basis: performance of the contract with the Customer, and our legitimate interest in security.

Workspace and billing data (as controller): company name, country, time zone, plan, usage counts, invoices and payment references, correspondence with us. Purpose: contract, invoicing, tax and accounting law.

HR data in workspaces (as processor): candidate and employee records, contact and emergency details, identity documents and their numbers and expiry dates, onboarding tasks, attendance requests, punches and remote check-ins including device location at the moment of check-in, and content the Customer's users enter. Purpose: the service, as instructed by the Customer. The legal basis is the Customer's to establish.

Passkeys (as processor): only the public part of a passkey credential and its counter. Face and fingerprint data never leave the user's device and are never sent to us.

Technical data (as controller): security logs, salted hashes of network addresses (never raw addresses), error reports, and an audit trail of changes. Purpose: security, abuse prevention and support. Legal basis: legitimate interest.

AI features (as processor): when a user asks the assistant, scans a document or opens the briefing, the relevant workspace data the user may see is sent to our AI sub-processor to generate the output and is not used to train models.

3. Where data is stored and transfers

Data is stored and processed on Cloudflare infrastructure, with the primary database and files in a European region, and is delivered through Cloudflare's global network. AI and email features use providers in the United States. Transfers of personal data from the EU, UK or Switzerland rely on Standard Contractual Clauses and the UK Addendum; see Section 12.4 of the Terms. If you are in a country with its own transfer rules (for example Saudi Arabia, the UAE or Türkiye), your employer, as controller, is responsible for meeting them, and we support that with the documentation in the Terms.

4. How long we keep data

Account and workspace data: for the life of the workspace, then deleted within thirty days of termination after the thirty day export period. Audit entries: up to four hundred days. Security and rate-limit records: up to twenty-four hours. Provider backups and point in time recovery: up to thirty days after deletion. Billing records: as long as tax and accounting law requires, typically seven to ten years. Password reset links: thirty minutes.

5. Sharing

We share personal data only with the sub-processors listed in Annex 1 of the Terms, with professional advisers under confidentiality, and with authorities where the law requires. We do not sell personal data and do not use it for advertising. We may disclose data to protect the rights and safety of users or the public where the law permits.

6. Your rights

Depending on your jurisdiction you may have the right to access, correct, delete or receive a copy of your personal data, to restrict or object to processing, to withdraw consent where processing is based on consent, and to complain to a supervisory authority (in the EU, your national data protection authority; in the UK, the Information Commissioner's Office). For account data, email us at the contact address and we respond within one month. For HR data in a workspace, contact your employer; we will help them respond.

7. Automated decisions

The AI features produce drafts, summaries and answers for a person to review. The service does not make decisions with legal or similarly significant effects about you by automated means alone. Attendance results are computed from punches and the Customer's rules and are reviewed and approved by people in the Customer's organisation.

8. Security

The measures we apply are listed in Annex 2 of the Terms. No system is completely secure; if a breach affects your data we will notify the controller without undue delay and, where required, you and the authorities.

9. Cookies and local storage

We use one essential cookie that keeps you signed in and the browser's local storage for preferences such as language and sidebar theme. On sign-up, Cloudflare Turnstile may set a cookie to tell people from bots. We do not use advertising or cross-site tracking cookies, so no cookie consent banner is needed.

10. Children

The service is for organisations and their working-age staff. We do not knowingly process data of children under sixteen except as employees or candidates entered by a Customer where local employment law allows.

11. Changes

We update this policy when the service or the law changes and show the date and version at the top. Material changes are notified to workspace admins. This is version 2.0.

12. Contact

Privacy questions and requests: contact.hr@examopotamia.com. Postal address: HRpotamia, Erbil, Kurdistan Region, Iraq.