Privacy Policy

The HRHQ application

What the product collects, and why.

HRHQ is practice-operations software used by HR consultants (our customers) to run their own client work. It is currently in a private pilot. When a consultant uses HRHQ, the application processes:

AccountAccount information — name, email, and sign-in handled by our authentication provider (Clerk). HRHQ never stores passwords. Clerk sets the cookies that sign-in and sessions need, including on the sign-in page itself. The application sets one cookie of its own: a short-lived security code, used only while a consultant connects Gusto, that expires within 10 minutes. No analytics, advertising or tracking cookies.
RecordsBusiness records the consultant enters — their clients, client contacts, employee rosters, credentials, trainings, notes, generated documents, time entries, and invoices.
CallsBusiness-line call data — call metadata (numbers, times, durations) and voicemail recordings on the consultant's dedicated business line, provided through Twilio. Voicemail transcription is off by default. The audio stays with Twilio; HRHQ keeps the call details, a reference to the recording and, if transcription is turned on, the transcript; only people signed in to the consultant's practice can play the recording.
PayrollPayroll data displayed via Gusto — when a consultant connects a client company they administer, HRHQ displays that company's roster and payroll history read-only. Compensation figures from Gusto are never stored by HRHQ; on the consultant's explicit action, only identity fields (name, job title, hire date) are imported to the roster. Connections are encrypted and can be disconnected at any time.
CalendarGoogle Calendar events, if connected — when a consultant signs in with Google, HRHQ lists the account's calendars so the consultant can pick which to sync, keeps the IDs of the ones picked, and reads events from those calendars, read-only, while the consultant is using the app: 30 days back and 14 days ahead. For each event it stores the title, start and end time, location and Google's event ID. Attendee email addresses are read only to work out which client a meeting is with, then dropped: HRHQ keeps the matched client, the contact's name from the consultant's own records, or just the email domain. HRHQ's database holds no Google password or token; access runs through the consultant's sign-in with Clerk and can be removed at any time in the Google account's third-party access settings.
PortalClient portal members — people a consultant invites from a client company to view that client's invoices, documents and receipts. For each one, HRHQ keeps their email address, an optional display name, when they were invited or removed, and a record of which portal pages, invoices, documents and receipts they opened and when, which the consultant can see. Sign-in runs through Clerk using the invited email address, and removal ends access immediately. Members receive an email through Resend when the consultant sends them an invoice. The portal shows the consultant's logo, which the browser loads from wherever the consultant hosts it.
TelemetryError and usage telemetry — production error monitoring (Sentry) and an internal per-tenant audit log of AI usage. No advertising or cross-site tracking, anywhere.

Use & AI

How information is used.

Solely to provide HRHQ to the consultant whose data it is. We do not sell personal information, share it for advertising, or use it to train AI models. HRHQ's AI features send redacted text to Anthropic to power product functions (like drafting summaries); that text can include a meeting's title and location from Google Calendar. Each AI call is designed to leave a metadata-only record — never the text itself — in a per-tenant audit log. HRHQ's AI features don't read payroll data from Gusto.

Processors

The services HRHQ runs on.

Each processes data only to provide its function to HRHQ:

SupabaseManaged database (all application data at rest, encrypted, with per-tenant isolation enforced at the database).
VercelApplication hosting.
ClerkAuthentication and sign-in.
GustoPayroll data, displayed read-only under the consultant's own authorization.
GoogleCalendar events, read-only, under the consultant's own Google sign-in.
TwilioBusiness-line telephony (call metadata, voicemail audio).
ResendTransactional notification email.
AnthropicAI features (redacted text only; no payroll data from Gusto).
SentryProduction error monitoring.
UpstashRate limiting on the application's API (receives the requester's IP address to count requests).
Google FontsTypeface delivery on the website and on this policy page.

Retention & your choices

Keeping, deleting, and asking.

Retention: business records are kept while the consultant's account is active — they are the consultant's own working records. Call and meeting entries in the review queue are cleared automatically: after 30 days if dismissed, 90 once logged (billed time stays on the ledger), 180 if never reviewed. Voicemail audio is held by Twilio; HRHQ doesn't delete it automatically. Compensation figures from Gusto are never stored. Deletion: disconnecting Gusto stops HRHQ from using that connection immediately; its encrypted keys stay stored until the practice is deleted. Deleting a client's records, or a practice's whole account, is handled by us on request (email below). Deleting a practice removes all of its records from HRHQ's database, including the stored keys for connected services, and an automated test checks that nothing is left behind. Your rights: to access, correct, or delete information, or to ask anything about this policy, email tristan@skylensfilms.com — requests are honored regardless of whether a specific statute requires it. This policy is maintained under California law (CalOPPA). Children: neither the site nor the product is directed at children under 16, and we don't knowingly collect children's information. Changes: material changes to this policy update the effective date above.

Privacy Policy.

The site itself collects nothing.

What the product collects, and why.

How information is used.

The services HRHQ runs on.

Keeping, deleting, and asking.