Privacy Notice

Effective 1 November 2026

This notice explains how personal data is handled on the HRStuff website and in the HRStuff application. “HRStuff”, “we”, “us” and “our” mean Clearworks Pte. Ltd., the Singapore company operating the HRStuff service. HRStuff’s data-protection contact is info@hrstuff.io.

1. Who is responsible for personal data

For employee, payroll, leave, claim and other workforce records entered by a customer organization, that organization normally decides why and how the data is used and is the data controller or equivalent responsible organization. HRStuff processes that data to provide the service and normally acts as its processor or service provider.

HRStuff is responsible as controller, or in an equivalent role, when we decide how to use sign-up and account administration details, public Contact enquiries, service security information, our support inbox and records needed to operate or defend the service. If you are an employee or other worker asking about information entered by your organization, contact that organization first. We will assist it where required.

2. Information we may handle

Depending on how the service is used, this may include:

• Organization and account details: company name, country, currency, time zone, plan, workforce size, administrator and user names, work email addresses, roles, password hashes and sign-up acceptance records;
• Identity and contact details: employee number, name, work and personal email, telephone number, address, date of birth, national identity or work permit number, nationality, country, emergency contacts and login details;
• Employment and demographic details: job, department, manager, employment type and dates, gender, race, religion, marital status, residency status and numbers of dependants and children, and disability eligibility;
• Pay and financial details: salary, allowances, deductions, contributions, payroll rules, bank name, account and routing details, payslips and payroll reports;
• Payment and subscription details: payer and Customer name, email, plan, billed headcount, amounts, currency, payment and subscription status, renewal and cancellation dates, and the card brand, last four digits and expiry date. Stripe collects full card and payment-method details directly; HRStuff does not store the full card number or security code;
• Leave, claims and documents: leave types, dates, reasons and decisions; expense descriptions, amounts, categories and receipts; employment documents; and related comments. These records may reveal health, religion or other sensitive information;
• Support and communications: Contact enquiries, support requests, reply addresses, attachments, the page concerned and responses; and
• Connected services and delivery records: enabled provider, workspace, channel, chat, account or destination identifiers and display names; protected connection credentials or webhook addresses; command text received from a connected provider; selected event types and safe event data; and delivery times, outcomes and errors; and
• Security and usage records: IP address, browser or device user-agent, approximate country code supplied by the website proxy, public-site page loads and sign-up clicks, a random per-tab visit code, visible-tab time, session times, failed logins, activity-log entries, support-access reasons and email delivery records.

Passwords are not stored in plain text. HRStuff stores a salted password hash used to check a later login.

3. Where information comes from

We receive information from people who sign up or contact us, from customer administrators and other authorized users, from workers using their own accounts, from files uploaded or imported by the Customer, from connected-service providers when a user sends a command to HRStuff through them, and automatically from use of the website and application. A Customer may therefore provide information about a worker without that worker entering it personally.

4. Why information is used

We use personal data as needed to:

• create and administer organizations, users, permissions and subscriptions;
• provide employee records, leave, claims, payroll calculations, payslips, reports, notifications, connected-service commands, imports, downloads and other requested features;
• authenticate users, maintain sessions, prevent abuse, investigate faults, secure the service and preserve an activity trail;
• answer enquiries and support requests and, where enabled, deliver those messages by email;
• maintain, troubleshoot and improve the reliability and usability of the service;
• administer subscriptions, payments, renewals, failed payments, cancellations and billing support; and
• comply with law, enforce agreements, and establish, exercise or defend legal claims.

5. Legal grounds

Where laws such as the GDPR require a legal basis, HRStuff relies as appropriate on performing a contract or taking requested pre-contract steps, complying with legal obligations, and legitimate interests in providing, securing, supporting and improving a business service. We rely on consent only where we specifically ask for it and the law makes it appropriate. The Customer is responsible for identifying its own legal basis for workforce data, including any sensitive or special-category data.

6. Payroll rules and scheduled actions

HRStuff can apply rules configured by the Customer and can run scheduled actions, such as creating or publishing payslips. These processes use the data and instructions the Customer supplies. HRStuff does not decide who should be hired, dismissed, promoted or disciplined. The Customer decides whether to use automation and is responsible for appropriate human review. Workers should ask their organization for information about the rules and consequences that apply to them.

7. Who may receive information

Personal data is available to Customer users only according to their assigned role and permissions. HRStuff personnel or contractors may receive limited access where needed for security, operations or requested support. Customer support access inside an organization is read-only, reason-based, time-limited and recorded in that organization’s activity log.

We use service providers to operate HRStuff. Render provides application and database hosting in Singapore and keeps infrastructure backups. Cloudflare provides private R2 object storage for uploaded files and separately encrypted company backups, and may supply the approximate country code used in public-site statistics. Resend delivers transactional service email, including login-creation, password-reset and notification messages, and forwards enquiries submitted through the public Contact page. Stripe provides the embedded sign-up checkout, subscription billing, invoices, saved payment methods, payment collection, fraud prevention and the customer billing portal. Each provider receives only the information needed to perform its service under its own security and contractual obligations.

When a payer uses Stripe, Stripe may receive contact, billing, transaction, payment-method, device, browser and fraud-prevention information. HRStuff receives the payment status, Stripe reference numbers, amounts, currency, renewal information and masked card details, but not the full card number or security code. Stripe explains its handling of personal data in its Privacy Policy.

If the Customer enables event delivery through Slack, Microsoft Teams, Telegram, Zapier or Make, HRStuff sends the selected event type, status, employee or requester and approver names where needed, and a link back to HRStuff to the chosen destination. Claim amounts, leave reasons, attachments and payslip contents are not included in those event deliveries. Zapier and Make receive one selected event at a time; shared messaging destinations may receive grouped summaries.

If the Customer enables personal Slack notifications, Slack supplies HRStuff with workspace member profiles, including Slack user identifiers, names and work email addresses. HRStuff matches work email addresses exactly to active employee records and stores the resulting employee-to-Slack-account link so personal notifications can be delivered.

A user who links a private Telegram chat can also send the /leavebalance and /claims commands to the HRStuff bot. Telegram sends the command text and Telegram user and chat identifiers to HRStuff. After matching that private chat to an active HRStuff login, HRStuff replies through Telegram. A leave balance reply includes leave types and balance figures. A claims reply includes counts and currency totals for pending and approved but unpaid claims.

If a user connects a private calendar feed to Google Calendar, Microsoft Outlook, Apple Calendar or another calendar reader, that reader can retrieve the names, job titles, leave types, dates and approval status visible to that user, together with public holidays. The private feed address acts as a credential. HRStuff stores only its one-way fingerprint and rechecks the owner’s current access whenever the feed is requested.

If a Customer connects direct Google Calendar sync, Google supplies HRStuff with an authorization token and the names and identifiers of calendars that the connecting administrator may update. HRStuff encrypts the lasting authorization token, stores the selected calendar identifier, and creates, updates or removes HRStuff-managed approved leave events in that calendar. Those events contain the employee name, leave type and leave dates, but not the leave reason. HRStuff does not read or change unrelated calendar events.

We may also disclose information to professional advisers, auditors, insurers, regulators, courts, law-enforcement bodies, or a buyer or successor to the service where reasonably necessary and lawful. We do not sell personal data or use Customer workforce data for third-party advertising.

8. Countries and international transfers

HRStuff is designed for organizations in different countries. Its main hosting and storage arrangements are:

• Render - application and database hosting: Customer account, workforce and service data are processed by the application and primary PostgreSQL database in Render’s Singapore region. Render may also keep infrastructure backups. Safeguards include restricted administrative access, encrypted network connections and Render’s contractual data-protection obligations.
• Resend - transactional and contact email: sender and recipient addresses, subject lines, message text and delivery details are processed primarily in the United States. Resend states that email and log data on its standard plans are normally kept for 30 days. Safeguards include encrypted connections and the protections described in Resend’s Data Processing Addendum and security information.
• Cloudflare R2 - private files and encrypted backups: uploaded receipts and documents, and separately encrypted company backup archives, are stored in private R2 buckets. The location depends on the setting used for each bucket and is not represented as Singapore-only. Under Automatic placement, Cloudflare selects a location; a location hint is best effort and is not a data-residency guarantee. Safeguards include restricted bucket credentials, encryption in transit and at rest, and the protections in Cloudflare’s Data Processing Addendum. Cloudflare explains its placement options in its R2 data-location documentation.

Connected services such as Slack, Microsoft Teams, Telegram, Zapier and Make, payment provider Stripe, and authorized users may process information in other countries according to the destination selected by the Customer and the provider’s terms.

Where personal data is transferred outside Singapore, HRStuff uses applicable provider terms, data-processing agreements and technical controls intended to require protection comparable to the Singapore Personal Data Protection Act. HRStuff reviews material provider and subprocessor changes and updates this notice where appropriate. The Customer remains responsible for safeguards required for destinations it selects or controls.

9. How long information is kept

Customer workforce data is generally kept while the Customer account is active and until the Customer deletes the relevant record or a platform administrator deletes the company account, subject to verified backup archives, deletion queues and legal requirements. When a live company account is deleted, its live HR data, logins, uploaded files, company activity log and original sign-up record are deleted. That sign-up record includes the company name and the administrator name and email address supplied during sign-up. Messages sent to HRStuff’s support inbox and related email-delivery records may be kept after account deletion so an unanswered request, security issue or dispute is not erased.

For disaster recovery, HRStuff normally keeps a rolling set of up to seven verified, encrypted company backup archives in storage separate from ordinary uploaded files. Older verified archives are removed as newer ones complete. When the company account is deleted, its app-managed backup archives become unavailable for download or restore and are queued for automatic removal, with a normal completion target of 24 hours. Failed removals are retried and reported to platform administrators. Infrastructure snapshots kept by the hosting provider follow that provider’s separate retention schedule; an infrastructure recovery must reapply completed company deletions before restored data is made available. Copies previously downloaded by the Customer remain under the Customer’s control.

Ordinary login sessions expire after the configured inactivity period. A customer user may instead choose a private-device session that expires no later than 30 days after login. Expired sessions are removed. Other retention periods are chosen according to the purpose of the record, contractual and legal duties, security needs, limitation periods and whether a dispute is reasonably expected. We will not knowingly keep personal data longer than needed for those purposes.

10. Security

HRStuff uses measures including role-based access, separation between customer organizations, password hashing, protected session cookies, request-forgery protection, upload checks, activity records and production HTTPS settings. No internet service can guarantee absolute security. Customers must manage user permissions, devices, exports and passwords appropriately and report suspected incidents promptly.

If HRStuff reasonably believes that Customer Data has been involved in a personal-data breach, we will notify the affected Customer without undue delay where the law requires it and provide available information needed for the Customer’s assessment. Where HRStuff controls the affected data, we will make required notifications to individuals and regulators.

11. Cookies, analytics and advertising measurement

HRStuff uses necessary cookies to sign users in securely, protect form submissions and carry short-lived status messages between pages. These do not depend on an advertising choice.

Optional public-site analytics and advertising measurement stay off until you choose “Accept all cookies”. “Necessary only” and “Reject cookies” both keep them off and remove this tab’s analytics identifiers. The website remembers your choice in a preference cookie for up to 180 days and in the browser's local storage. The preference cookie contains only your choice, not a visitor identifier. Earlier advertising-only acceptance does not enable analytics; we ask for the combined choice again.

When allowed, public-site analytics use a random code stored only in the browser tab's session storage. It ends with that tab's browsing session and is stored by HRStuff only as a one-way code. It is used to calculate active visible-tab time without identifying the person using the tab.

When analytics are allowed, HRStuff also briefly uses the IP address and browser user-agent sent with a public-page request to create a one-way identifier for that combination. The identifier changes each calendar day in HRStuff's reporting timezone and is used to estimate daily visitors and sign-up interest. HRStuff does not write the raw IP address or user-agent to its public-site analytics tables. The resulting daily identifiers and related public-site statistics are kept for up to 367 days.

On public marketing pages, the same choice also allows Google Ads measurement. Google’s advertising tag is not loaded unless that choice is allowed. If allowed, the tag may store or read advertising cookies and receive the public page, advertising interaction and one confirmed company-level outcome: a trial start or the company’s first successful subscription payment. The first-payment event includes the actual payment amount excluding tax, currency and a Stripe transaction reference so retries are not counted twice.

Google Ads tags are not placed on employee-facing application pages. HRStuff does not send employee details, payroll, leave, claims, sign-up contact details or enhanced- conversion personal data to Google. Advertising personalization stays off. The choice itself is stored in the browser's local storage.

Stripe's embedded payment form and Stripe-hosted billing pages may use cookies and device or browser information to complete payments, remember payment choices, secure its services and prevent fraud. Stripe describes those uses in its own Privacy Policy.

12. Your rights

Depending on the law that applies, an individual may have rights to be informed, access personal data, correct it, request deletion or restriction, object to certain uses, receive portable data, withdraw consent, and complain to a data-protection authority. These rights are not absolute and differ by jurisdiction and legal basis.

For workforce records controlled by a Customer, send the request to that Customer. For HRStuff-controlled account, Contact or security records, use the Contact page or email info@hrstuff.io. We may need to verify identity and authority before acting. You may also complain to the data-protection regulator in your country where the law gives you that right.

13. Changes to this notice

We may update this notice when the service, providers or law changes. We will change the effective date and give appropriate notice of material changes. An older notice continues to describe processing that occurred while it was in effect.