Privacy Policy
1. Who we are
HRlume ("we", "us") is an independent project built and run by an individual developer, not (yet) through a registered company. For any question about this policy or about your personal data, use our contact form and select “Terms and legal” so the request is identified correctly.
This policy covers the HRlume marketing site at hrlume.xyz and the HRlume application. It does not cover any third-party site we link to.
2. Controller and processor
HRlume is built for employers to run their own HR data. Where a company uses HRlume to manage its own staff, that company is the data controller for the employee data it puts into the system, and we act as a processor on its instructions. If you are an employee and want your data corrected or erased, ask your employer first — they control it, and we act on their instruction.
We are the controller for a narrower set of data: enquiries sent to us directly, and the operational logs described below.
3. What we process
- Account data — name, work e-mail, role, and the employment details an employer chooses to record (position, department, manager, start date, and any custom fields they configure).
- Content you create — leave requests, documents, assets, candidate records, survey answers, goals and performance reviews.
- Authentication data — a password hash (PBKDF2, never the password itself), and if enabled, a two-factor secret and backup codes.
- Sign-in records — session timestamps, and the IP address of a sign-in only where the employer has switched that option on.
- Contact enquiries — the name, e-mail, company, message and source page you submit, together with the request IP address, browser, operating system and approximate country, region and city supplied by Cloudflare. We use this context only to answer the enquiry and prevent abuse.
- Integration identifiers — where an employee connects Telegram, Google Calendar or Outlook Calendar, or their employer connects Slack or Google/Microsoft sign-in, the identifier and access token needed to deliver notifications or calendar invites on their behalf.
We do not sell personal data, and we do not use customer content to train machine-learning models.
4. Why we process it
- To provide the service — performance of the arrangement with the employer using HRlume.
- To keep it secure — legitimate interest in preventing unauthorised access and abuse.
- To answer enquiries you send us — legitimate interest in replying to you.
HRlume is currently free — nothing here is processed for billing, since there is no billing yet. If that changes, this section will say so.
5. Where it lives
HRlume runs on Cloudflare Workers, with data stored in Cloudflare D1 (database) and Cloudflare R2 (uploaded files). Cloudflare operates a global network, so data may be processed in locations outside your own country. Transfers are covered by Cloudflare's own data protection terms and standard contractual clauses.
Self-hosted deployments run inside the customer's own Cloudflare account. In that arrangement we have no standing access to their data.
6. Sub-processors
These providers may process personal data on our behalf, and only for the feature that names them:
- Cloudflare, Inc. — hosting, database, file storage, network security, and (on the marketing site only, if you accept the banner) cookieless visit analytics.
- Resend — transactional e-mail delivery (invitations, verification, notifications).
- Telegram Messenger — only where an employee links their own Telegram account for notifications.
- Slack Technologies — only where an employer connects a Slack workspace for notifications.
- Google LLC — only where an employer enables Google sign-in, or an employee connects Google Calendar.
- Microsoft Corporation — only where an employer enables Microsoft sign-in, or an employee connects Outlook Calendar.
An employer who configures their own SMTP server, Telegram bot, Slack workspace, or Google/Microsoft app registration is choosing their own sub-processor for that channel, and that relationship is theirs, not ours.
7. How long we keep it
Customer content is retained for as long as the employer's account is active, and deleted within 30 days of the account being closed, unless we are required to keep it longer. Candidate records carry their own consent and retention handling inside the product, controlled by the employer.
8. Your rights
Subject to applicable law, you may request access to your data, correction, erasure, restriction, portability, or object to processing. Where the employer is the controller, we will pass your request to them rather than act on it ourselves. You also have the right to complain to your local data protection authority — in Ukraine, the Ukrainian Parliament Commissioner for Human Rights; in the EU, your national supervisory authority.
9. Security
Passwords are hashed with PBKDF2 and never stored in readable form. Stored credentials for integrations (SMTP passwords, bot tokens, OAuth secrets) are encrypted at rest. Two-factor authentication is available and can be made mandatory by an employer. Sessions expire after a configurable period of inactivity. No system is perfectly secure, and we do not claim otherwise.
10. Cookies and similar technology
The marketing site sets no advertising cookies, and no analytics of any kind run before you choose. When you first visit, a banner asks whether we may count visits with Cloudflare Web Analytics — it sets no cookies and doesn't fingerprint your device, it just counts page views and where they came from. Decline and nothing loads at all. You can change your mind any time via "Cookie preferences" in the footer; your choice is remembered in your browser's local storage, not a cookie.
The application itself keeps your session token and interface preferences in your browser's local storage — these are necessary for it to work and are not used for tracking.
11. Changes
We will update this page when our practices change, and update the date at the top. Material changes affecting customers will also be notified to the account administrator by e-mail.