Privacy Policy

Version of 26 October 2026

Who we are. PapaHR is an HR system for companies, website papahr.com. Questions about data: [email protected].

Whose data and what data.

• Account: name, email, password (we store it only in encrypted form — a hash), language, company, devices you signed in from (for sign-in with a code).
• Employee data entered by the company: full name, position, department, manager, hire date, work email, phone, status; if the company chooses — photo (with the employee's consent), birthday (visible only if the employee allowed it), salary and its history, time off and timesheet, onboarding plans, 1:1 meetings, goals, reviews, documents.
• Candidates: name, contacts, résumé, stages and ratings for the vacancy.
• Surveys: employee answers; in anonymous surveys results are shown only for groups of 3 people or more, and no one can see an individual person's answers.
• Requests to the "PapaHR team" and the "Write to us" form: name, email, text.
• Technical: page address, browser type, error log; visit statistics from Google Analytics on the public pages of the website.

Why. To make the HR system work: profiles, time off, meetings, plans, reports, emails and reminders to employees and managers; to answer questions; to protect accounts (sign-in with a code, bot protection at sign-up). We do not sell data and do not use company employee data for advertising.

Who sees it.

• The owner of the company account and the people they invited — within their role: HR sees the company, but sees salaries only if the owner allowed it; a manager sees their team; an employee sees their own data.
• Employee photos and candidate résumés open only inside the company account; direct access to them from the internet is closed.
• The PapaHR team — only to answer a request or fix an error.

Where it is stored. Servers and database — DigitalOcean, Frankfurt (Germany). Files (photos, résumés, attachments) — Cloudflare R2 file storage, region "Eastern Europe". Database backups — DigitalOcean, Frankfurt.

Who we share it with (only to make the service work).

• DigitalOcean — hosting, database, backups.
• Cloudflare — website protection and delivery, file storage (R2), forwarding of email to papahr.com addresses.
• SendPulse — sending emails from PapaHR (invitations, sign-in codes, reminders).
• Google — sign-in with Google (if you chose it), reCAPTCHA (bot protection), Google Analytics (website statistics).
• Telegram, Slack, Microsoft Teams — only if the company connected them itself; reminders and decision buttons are sent there.
• Anthropic (Claude) or OpenAI (ChatGPT) — only if the company turned on AI and entered its own key; only the data needed for the request is sent.
• Mike Pritula Academy — checking academy subscription and courses by the user's email.

How long we keep it. As long as the company account exists. Deletion — on request to [email protected]: we delete the account and company data within 30 days; data disappears from backups as they are replaced — no later than 90 days. The company itself can delete any employee, candidate or document.

Your rights. To find out what data about you is stored, to correct it, delete it, and get a copy. A company employee first contacts their HR (the company manages employee data); [email protected] — if that did not work.

Cookies. For sign-in and settings (language, theme, hiding salaries) and for Google Analytics statistics on public pages.

Changes. We publish the new version on this page with its date.