Privacy Policy

This policy explains how Staffvelo ("we", "us") handles personal data when you use staffvelo.com and the Staffvelo application (the "Service").

1. Who is responsible

For data about visitors to our website and the administrators who sign up, we are the data controller. For the employee, candidate and payroll data a customer company puts into its workspace, the customer is the controller and we act as their data processor under the customer's instructions and our Terms of Service.

2. What we collect

• Account data: name, work email, password (stored as a salted hash), company name, workspace address, plan and billing status.
• Workspace data entered by customers: employee profiles, time off, documents, payroll inputs and outputs, hiring records, reviews, survey responses, project boards, attendance.
• Usage data: server logs (IP address, browser, pages requested, timestamps) kept for security and debugging.
• Payment data: handled by Stripe. We never see or store full card numbers.

3. How we use it

To provide and secure the Service, send transactional email (invitations, notifications, payslips, receipts), respond to support requests, and understand aggregate usage. We do not sell personal data and we do not use customer workspace data to train models.

4. Legal bases (UK & EU GDPR)

Performance of a contract (providing the Service), legitimate interests (security, product improvement, fraud prevention), legal obligation (tax and accounting records) and consent where we ask for it (marketing email).

5. Sub-processors

Provider	Purpose	Location
Cloudflare, Inc.	Hosting, database (D1), file storage (R2), network security	Global edge; data at rest in EU/UK region
Resend, Inc.	Transactional email	Ireland (eu-west-1)
Stripe, Inc.	Payments and invoicing	EU / US (Stripe's DPA)
Google LLC	Optional: Google sign-in, Meet links	Per Google's terms, only if enabled
Slack / Microsoft / Zoom / Greenhouse	Optional integrations a customer connects	Per each provider, only if connected

6. Retention

Workspace data is kept while the customer's account is active. When a customer asks us to delete a workspace, its data is removed from live systems within 30 days and from point-in-time recovery within a further 30 days. Payroll and billing records we are legally required to keep are retained for the statutory period.

7. Your rights

You can access, correct, export or delete your personal data, object to processing, or lodge a complaint with your supervisory authority (in the UK, the ICO). Employees should contact their company's administrator first, since the company controls the workspace; you can also write to us at privacy@staffvelo.com.

8. Cookies

The application uses a single strictly-necessary session cookie. The marketing site sets no tracking cookies.

9. Changes

We'll post updates here and, for material changes, email workspace administrators.