Privacy Policy

Effective date: August 21, 2026 Last updated: September 3, 2026

HR for the People ("we," "us," "our") operates the HR for the People suite of tools (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, how we share it, and the choices you have.

By using the Service, you agree to the collection and use of information as described in this policy.

1. Information We Collect

Account information. When you create an account, we collect your name, email address, and authentication information.

Intake responses. When you use the Service, we collect the answers you provide to our guided questions — for example, your field of study or work history, your interests, your stated preferences, and similar career-related information.

Resumes. If you upload a resume to get your recommendations, we process its contents to generate your results but do not retain a copy of the file or its content after your session. Resume content is not included in any data set we analyze, license, or sell.

Offer letters and benefits documents. If you upload an offer letter, benefits guide, or similar employer document, we extract specific terms from it — such as job title, compensation, location, and benefits structure — and do not retain the uploaded file itself. We use automated methods to remove your name, address, and other information that would identify you or any other named individual before this data is used further. This extracted data is our primary source for the de-identified data sets described in Section 3.

Payment information. If you purchase a paid plan, our payment processor, Paddle.com Market Limited ("Paddle"), collects and processes your payment details directly on our behalf. We do not receive, process, or store your credit card number or other payment credentials. Paddle acts as merchant of record for these transactions; see Paddle's own privacy policy for details on how it handles your payment information.

Usage and device information. We automatically collect information about how you use the Service, including IP address, browser type, device identifiers, pages viewed, and referring URLs, typically through cookies and similar technologies. See Section 8.

2. How We Use Information

We use the information described above to:

• Provide the Service — generate the recommendations, results, or content you request
• Maintain your account and communicate with you about the Service
• Improve, test, and develop the Service, including the underlying models and question sets
• Create de-identified, aggregated data sets — primarily from specific terms we extract from offer letters, benefits guides, and similar employer documents you upload (such as job title, compensation, and benefits structure, without your name or other identifying details) — which we may analyze internally and license or sell to third parties, in order to provide compensation and benefits benchmarking data to employers, researchers, and workforce organizations
• Process payments through Paddle
• Send you our newsletter or other marketing content, if you've opted in
• Maintain the security and integrity of the Service
• Comply with legal obligations

3. How We Use De-Identified Data

When you upload an offer letter, benefits guide, or similar employer document, we remove information that identifies you or any other named individual — such as names, home addresses, and personal salutations — before the remaining terms (job title, compensation, location, benefits structure, and similar data points) are added to our aggregated data sets. We do not retain the uploaded file itself. Intake question responses you provide (such as your career interests, field of study, or work history) may also be included in de-identified, aggregated form. We use this data for our own analysis and may also license, share, or sell it to third parties, including in aggregated or statistical form.

Resume content is never included in these data sets — we don't retain resumes at all past the session in which you upload one.

We do not sell, license, or share:

• Your name, email address, phone number, mailing address, or other direct contact information
• Personal information in a form that identifies you, unless you've separately consented

We maintain technical and administrative safeguards designed to prevent de-identified data from being re-identified, and we contractually prohibit any third party we share de-identified data with from attempting to re-identify it.

Opting out. If you'd prefer we not include your offer letter or benefits document data in our aggregated, de-identified data sets, contact us at [email protected] and we will exclude anything you upload after that point. Because de-identified data is, by design, no longer linked to your identity, we may not be able to identify and remove your specific contribution from data sets already created before your request — but we will honor your opt-out going forward. See Section 6.5 for more on this and related rights.

4. How We Share Information

We share personal information (not de-identified data) only in these circumstances:

• Service providers, including Paddle for payment processing, our email newsletter provider (only if you've opted in to marketing emails), and other vendors who perform services on our behalf (such as hosting, analytics, and customer support), under contracts that restrict their use of your information to providing those services
• Legal reasons — to comply with a law, regulation, legal process, or government request, or to protect the rights, property, or safety of HR for the People, our users, or the public
• Business transfers — if we're involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to this policy or a successor policy
• With your consent — for any other purpose we've disclosed to you and you've agreed to

We share de-identified data more broadly, including with third parties for their own use (such as research, market insights, or product development), as described in Section 3. See Section 6.2 for why we believe this doesn't constitute a "sale" or "share" of personal information under California law, and Section 6.5 for how to opt your uploads out of this regardless.

5. Data Retention

We retain your personal information for as long as your account is active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements.

After you delete your account:

• We delete or de-identify the personal information tied to your account within 30 days of deletion.
• We never retained your resume in the first place, so there's nothing to delete there.
• Offer letters and benefits documents you uploaded, once identifying details are removed, are incorporated into our aggregated data sets and are not deleted, because they are no longer linked to you or any other identifiable individual. Deleting your account stops future collection and removes your identifiable data, but it does not retract data that has already been de-identified and is no longer associated with your identity.

6. Your Rights and Choices

6.1 General rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Delete your personal information (see Section 5 for what this does and does not cover)
• Data portability — receive a copy of your information in a portable format
• Withdraw consent, where we rely on consent to process your information
• Opt out of the inclusion of your data in our de-identified, aggregated data sets (see Section 6.5)

To exercise these rights, contact us at [email protected]. We may need to verify your identity before completing your request. We will not discriminate against you for exercising any of these rights.

6.2 California

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the rights described in Section 6.1, along with:

• The right to know the categories and specific pieces of personal information we've collected about you, and the categories of sources, purposes, and third parties involved
• The right to opt out of the "sale" or "sharing" of your personal information. We do not knowingly sell or share personal information as those terms are defined under the CCPA/CPRA. The offer letter and benefits data we license or sell is processed to meet the CCPA's de-identification requirements before it leaves our systems, and we believe it no longer constitutes "personal information" once that process is complete. You can still opt your uploads out of this process at any time — see Section 6.5.
• The right to limit the use of sensitive personal information, to the extent we process any
• The right to designate an authorized agent to make a request on your behalf

To exercise these rights, contact us at [email protected].

6.3 Colorado, Virginia, Connecticut, and other states

If you're a resident of Colorado, Virginia, Connecticut, or another state with a comprehensive privacy law, you have rights similar to those in Section 6.1, generally including the right to opt out of targeted advertising, the sale of personal information, and profiling in furtherance of decisions that produce legal or similarly significant effects, and the right to appeal a denied decision. To exercise these rights or appeal a decision, contact us at [email protected].

6.4 European Economic Area, United Kingdom, and Switzerland

If you're located in the EEA, UK, or Switzerland, the General Data Protection Regulation (GDPR) or UK GDPR gives you the rights in Section 6.1, along with the right to restrict or object to our processing of your information and the right to lodge a complaint with your local data protection authority.

Our legal bases for processing your personal information are: performance of a contract (to provide the Service you've requested), our legitimate interests (such as improving the Service and creating de-identified data sets, balanced against your rights), and consent, where we ask for it.

See Section 10 for information about international data transfers.

6.5 How to opt out of de-identified data use

If you don't want the offer letter or benefits documents you upload included in our de-identified, aggregated data sets, contact us at [email protected] and ask us to exclude you. Once we receive your request, we will not include any documents you upload afterward in those data sets. Because de-identified data can no longer be traced back to any individual, we generally cannot go back and remove your specific contribution from data sets already created before your request, but your opt-out will be honored for everything going forward.

7. Age Requirement

The Service is designed for and directed to users who are 18 years of age or older. By using the Service, you represent that you are at least 18. We do not knowingly collect personal information from anyone under 18. If we learn that we've collected personal information from someone under 18, we will delete it.

8. Cookies and Tracking Technologies

We use cookies and similar technologies, such as session cookies and analytics tools, to operate the Service and understand how it's used. Most browsers let you control or disable cookies through their settings. Disabling cookies may affect how parts of the Service function.

9. Security

We use reasonable administrative, technical, and physical safeguards designed to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

10. International Users

The Service is operated from the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we'll notify you by email or through a notice on the Service before the changes take effect. The "Last updated" date at the top reflects the most recent version.

12. Contact Us

[email protected]