Privacy policy

KollabHR, Koverhoop Technologies Inc.

Person responsible for the protection of personal information: [email protected]

Koverhoop Technologies Inc. (“KollabHR,” “we,” “us,” or “our”) is committed to protecting the privacy of individuals whose personal information we collect and process through the KollabHR platform. This Privacy Policy explains what information we collect, why we collect it, how we use and share it, and what rights you have.

This Policy applies to the KollabHR Platform, including our public website, career pages, the HR Portal, Member Portal, Employee App (when available), the Slack integration, and the Microsoft Teams integration. It applies to Customers (organizations), Users (including employees), and applicants using our career pages.

1. Who we are

Koverhoop Technologies Inc. operates KollabHR in Québec, Canada. For employment and recruitment records, the employer determines the purposes of processing and KollabHR acts as its service provider. We are responsible for information we use for our own account administration, billing, security and support. These roles do not limit either party’s legal obligations.

Person responsible for the protection of personal information: [email protected]

2. Information we collect

2.1 Employee and user personal data

• Full name, email address, and phone number
• Home address
• Date of birth
• Profile photo
• Gender (collected as optional diversity data)

2.2 Employment and HR data

• Job title, department, and employment type
• Start date
• Leave and attendance records
• Disciplinary records
• Benefits enrollment data

2.3 Payroll and financial data

• Salary and compensation details
• Bank account information

2.4 Authentication and account data

• Login credentials (username and hashed passwords, passwords are never stored in plain text)
• User roles and permissions

Multi-factor authentication (MFA) data collection is planned for a future release and this Policy will be updated accordingly.

2.5 Automatically collected technical data

• IP addresses
• Browser type and device information
• Session duration

Browser storage, campaign attribution and diagnostic services are described in section 12. Depending on the feature, technical information can include the referring site, landing page, campaign identifiers and error diagnostics.

2.6 Slack integration data

When a Customer connects the KollabHR Slack app:

• Slack bot token and workspace ID, stored upon workspace connection.
• Slack User ID, stored when a User connects their KollabHR account to Slack.
• Slack User IDs retrieved via the Slack API for notification routing, only stored for Users who have explicitly connected their accounts.

KollabHR does not read, store, or process Slack messages or channel content. The integration is used exclusively to send outbound HR reminders and notifications.

Upon disconnection of the Slack integration, all stored tokens and Slack User IDs are permanently deleted. Slack’s own data handling is governed by Slack’s Privacy Policy at slack.com/privacy-policy.

2.7 Microsoft Teams integration data

When a Customer connects the KollabHR Microsoft Teams app:

• Microsoft 365 tenant ID, stored upon connecting the Teams integration for a Customer’s organization.
• Teams User ID, stored when a User connects their KollabHR account to Microsoft Teams.
• Conversation references, used only to deliver notifications to the correct Teams conversation, only stored for Users who have explicitly connected their accounts.

KollabHR does not read, store, or process Teams chat, channel, or meeting content. The integration is used exclusively to send outbound HR reminders and notifications.

Upon disconnection of the Teams integration, the associated Microsoft 365 tenant ID, Teams User IDs, and conversation references are permanently deleted. Microsoft’s own data handling is governed by Microsoft’s Privacy Statement at privacy.microsoft.com.

2.8 Recruitment information and sensitive content

Recruitment records can contain contact details, résumés, employment history, qualifications, skills, cover notes, correspondence, interview arrangements, recruiter notes and review results. Applicants should not include government identifiers, financial, medical or other sensitive details unless the employer establishes that they are necessary and provides an appropriate collection process. Free-text fields and uploaded files can contain information beyond the fields we request; we cannot promise that such information is never received.

3. How we collect information

• Directly from Customers when setting up and managing employee profiles or adding recruitment records.
• Directly from applicants through career forms, uploaded documents and recruitment communications. An employer may also upload a résumé obtained from another source; it is responsible for the lawfulness of that collection. You may ask about the source of your information.
• Directly from Users when they log in, update their profiles, or submit requests.
• Automatically through the Platform’s technical infrastructure (IP address, browser info, session data).
• Through the Slack integration when a Customer connects their workspace or a User links their Slack account.
• Through the Microsoft Teams integration when a Customer connects their Microsoft 365 tenant or a User links their Teams account.

4. How we use information

• To provide and operate the KollabHR Platform and its features.
• To manage employee records, leave, assets, and HR workflows on behalf of Customers.
• To receive applications, manage recruitment communications and interviews, and provide authorized optional AI review as explained in section 6.7.
• To authenticate Users and manage access controls.
• To send HR reminders and notifications via Slack or Microsoft Teams where these integrations are enabled.
• To respond to support requests and communicate with Customers and Users.
• To monitor Platform performance, security, and session activity.
• To comply with applicable legal and regulatory obligations.
• To improve and develop the Platform based on usage patterns.

We do not sell personal information. Recruitment documents are not used for our advertising. Website campaign attribution is described in section 12. Optional AI-assisted recruitment can involve profiling, as described below.

5. Necessary processing and consent

We limit collection and use to necessary, identified purposes. Where consent is required, it must be specific, informed and freely given. A subscription agreement or general acceptance of these terms does not replace an applicant’s separate choice about optional AI review. Applicable statutory exceptions must be assessed for the particular processing; “legitimate interests” is not a blanket authorization under Québec law.

Required fields identify information needed to provide the requested service; without that information we may be unable to process the request. Optional information and optional AI consent are separate. Consent requests must be clear, specific to each purpose and separate from other written information. Where required, use or disclosure of sensitive information requires express consent. Consent applies only for the time needed for the stated purpose.

6. Data sharing and third parties

We do not sell personal information.

6.1 Service providers

We share data with third-party vendors who help us deliver the Platform, including hosting, cloud infrastructure, and security services. These providers are contractually bound to process data only as instructed and in compliance with applicable law.

Access within KollabHR is limited, according to duties, to authorized support, technical/security and account-administration personnel. Within the employer’s organization, authorized HR staff and hiring-team members can access recruitment records according to their permissions.

6.2 Slack

When the Slack integration is enabled, KollabHR sends outbound notifications to Users via the Slack API. Slack receives Slack User IDs and the content of those notifications. Slack’s use of this data is governed by their own Privacy Policy.

6.3 Microsoft Teams

When the Microsoft Teams integration is enabled, KollabHR sends outbound notifications to Users via the Microsoft Teams/Bot Framework API. Microsoft receives Teams User IDs, conversation references, and the content of those notifications. Microsoft’s use of this data is governed by their own Privacy Statement.

6.4 Stripe

Payment processing is handled by Stripe, Inc. (“Stripe”) on behalf of Koverhoop Technologies Inc., who is the seller of record for KollabHR subscriptions. Stripe processes billing and payment information under their own Privacy Policy. KollabHR does not store full payment card details; this information is held by Stripe.

6.5 Legal authorities

We may disclose personal information to authorities if required by law, court order, or where a specific legal exception permits disclosure. We limit the disclosure to what is authorized and necessary.

6.6 Business transfers

In the event of a merger, acquisition, or asset sale, personal information may be transferred. Any disclosure must meet the applicable legal conditions and safeguards, including notice when required. A transaction is not permission to use information for unrelated purposes.

6.7 Recruitment and AI service providers

Applications can include contact details, a résumé, professional history, skills and a cover note. The employer receives this information to assess the application. Optional AI review compares application content with the job requirements and produces a score and explanation. It may be inaccurate or biased. Hiring staff must review the underlying application and make the decision; a score is not an automatic rejection or hiring decision.

The career form explains AI use before submission and records the applicant’s choice. Declining optional AI review does not prevent applying. Contact the employer to withdraw permission for future processing, request correction, or request human review. Withdrawal cannot undo processing already completed.

The current AI route uses OpenRouter and a selected model provider, which can include Google Gemini. Relevant résumé content and job requirements are sent to those services when AI review is authorized. See OpenRouter’s DPA and terms. Routing and retention depend on the contracted service and account configuration. The Google Cloud DPA applies where incorporated into the applicable Google agreement; using Gemini through OpenRouter does not by itself establish a direct Google Cloud agreement with KollabHR.

7. International data transfers

KollabHR is based in Quebec, Canada. Information may be processed outside Québec, including elsewhere in Canada or the United States, depending on the contracted service and provider route. Before entrusting personal information outside Québec, the responsible organization must assess privacy risks and the applicable legal and contractual safeguards. Provider selection and written arrangements must reflect that assessment. This policy does not promise Québec-only or Canada-only AI processing.

8. Data retention

Employers must define and apply a necessary recruitment retention period, including for unsuccessful applications, résumés and AI results. Keeping a subscription active is not a reason to retain every applicant indefinitely. When the identified purposes are fulfilled, information must be destroyed or lawfully anonymized, subject to applicable legal retention requirements. Ask the employer for its recruitment retention period.

• Active account data: Retained for the duration of the Customer’s Subscription.
• Post-cancellation: Customer Data is retained for 90 days following cancellation or expiry, after which it is permanently deleted.
• Non-payment suspension: Data is retained for 90 days from the date of suspension before permanent deletion.
• Technical logs (IP addresses, session data): Retained for up to 90 days.
• Slack tokens and User IDs: Deleted immediately upon disconnection of the Slack integration.
• Microsoft Teams tenant ID, User IDs, and conversation references: Deleted immediately upon disconnection of the Teams integration.
• Legal and compliance records: Retained for the period required by applicable law.

9. Your rights

• Right to access: Request a copy of personal information we hold about you.
• Right to correction: Request correction of inaccurate or incomplete information.
• Right to deletion: Request deletion of your personal information, subject to legal retention obligations.
• Right to withdraw consent: Withdraw consent at any time without affecting prior processing.
• Right to data portability: Request computerized personal information collected from you in a structured, commonly used technological format, subject to statutory limits. Created or inferred information, such as an AI score, is excluded from this portability right; this does not remove applicable access or correction rights.
• Publication and search links: Where the legal conditions are met, request cessation of dissemination or de-indexing of a link associated with your name, or re-indexing.
• Questions and complaints: Contact the privacy officer or the employer responsible for your recruitment file. We coordinate requests relating to data processed on an employer’s behalf.
• Right to lodge a complaint: Contact the Commission d’accès à l’information (CAI) in Quebec or the Office of the Privacy Commissioner of Canada (OPC).

To exercise any of these rights, contact us at [email protected]. Submit an access or correction request in writing to the privacy officer, identifying the information sought. We verify identity or authority using proportionate means and respond to these requests within 30 days of receipt. If we refuse, we provide written reasons, the relevant legal basis and information about recourse to the CAI. For employer-controlled records, we coordinate with the employer rather than treating its role as a reason to ignore your request.

10. Security

• Encryption of data in transit using TLS.
• Hashed storage of passwords, plain text passwords are never stored.
• Role-based access controls limiting who can access personal information.
• Regular monitoring for security vulnerabilities.

No system is completely secure. We assess confidentiality incidents, take reasonable measures to reduce harm and prevent recurrence, and maintain an incident register. Where an incident presents a risk of serious injury, we notify the CAI and the affected individuals diligently, as required by law. When acting for an employer, we also inform it without delay so it can meet its obligations. Mandatory privacy obligations cannot be waived by this policy.

Our privacy officer coordinates privacy questions, complaints and rights requests. Personnel access is limited according to their responsibilities. Our governance measures cover handling requests, staff responsibilities, retention and destruction, incident response, and privacy impact assessments for relevant systems and transfers. To complain, describe the issue and the record concerned using the privacy contact above; avoid emailing a full résumé or sensitive identity documents unless requested through an appropriate channel. We acknowledge and investigate complaints and communicate the outcome. You may contact the CAI directly.

11. Children’s privacy

Recruitment may involve applicants under 18. Employers must assess applicable age and consent requirements. For children under 14, obtain parental or guardian consent unless a statutory exception applies. Do not request information that is unnecessary for the role.

12. Cookies and tracking

The Platform uses browser storage for account/session context and preferences. Career pages can remember a chosen language for up to one year using the career_lang cookie.

The marketing website uses ns_first_touch to record first-visit campaign parameters, advertising click identifiers when present, referring site and landing page. Its cookie expires after approximately 90 days; a local-storage copy can persist separately. This information supports campaign attribution and may accompany a signup or contact request. Google Tag Manager is included to load configured website tags; the information processed depends on those tags. Where enabled, Sentry receives application error diagnostics and may receive associated technical or identifying information for troubleshooting.

You can manage or clear cookies and local storage in your browser. Blocking storage can affect preferences or account features. These browser controls do not replace a consent mechanism where consent is required. Optional identification, location or profiling technologies must be inactive by default where the law requires it; this policy alone does not authorize them.

13. Language

This Privacy Policy is available in English. A French version is available at kollabhr.com/fr/privacy-policy and shall be provided upon request under the Charter of the French Language (Bill 96). In the event of any inconsistency, the French version prevails for individuals based in Quebec.

14. Changes to this policy

We may update this Policy to reflect changes in data practices, legal requirements, or Platform features. For material changes, we will provide at least 30 days advance notice via email. The published revision will identify its effective date. A policy update does not itself authorize a new use requiring separate consent.

15. Contact us

Koverhoop Technologies Inc.

Person responsible for the protection of personal information: [email protected]