Privacy Policy

• Email address (for account creation and magic link authentication)
• Conversation content with the AI HR Advisor
• Documents you choose to upload to the AI HR Advisor (PDF, JPG or PNG). We extract the text and do not keep the file; see Section 6.
• Your email address and an optional note, if you join the waitlist for review by a human HeHRa Advocate
• Your email address and checkout status, if you begin a purchase (collected by Stripe and shared with us)
• Your email address, if you ask us to email you a link back to a free conversation. It is deleted with the conversation after 30 days.
• Intake notes and booking details for Advocate sessions
• Payment information (processed by Stripe; we do not store card numbers)
• Advocate application information (name, bio, certifications, states)

• Contact basics (name, email, phone, LinkedIn URL, state, country)
• Professional history (role, years of experience, industries, expertise)
• Current employer and other corporate consulting clients (used to populate your matching-pool exclusion list and to manage conflicts of interest)
• Rate expectations, weekly availability, and insurance status
• Open-text answers ("Why HeHRa," "Best at," additional info, referral source)
• Uploaded credential files (PDF, JPG, PNG, or HEIC) such as certificates, licenses, and transcripts
• Consent records (scope acknowledgment, independent-contractor acknowledgment, truthfulness and Terms/Privacy consent)
• Session metadata (UTM parameters, referrer, IP address, user agent) used to understand how applicants found the page and to deter abuse

• Usage data and analytics (via Vercel Analytics and product analytics)
• Device type, browser type, and IP address
• Pages visited and features used

• Provide, maintain, and improve the Service
• Process transactions and send related information (receipts, confirmations)
• Send transactional emails (booking confirmations, account notifications)
• Send up to two reminder emails if you begin a purchase and don't complete it. Each includes an unsubscribe link, and completing the purchase or unsubscribing stops them.
• Send the email you request with a link back to your free conversation, and one follow-up about 48 hours later if you haven't purchased. Neither includes what you wrote. Each includes an unsubscribe link, and completing a purchase or unsubscribing stops the follow-up.
• Create de-identified, aggregated information, as described in Section 6
• Facilitate Advocate-client connections and bookings
• Monitor and analyze usage patterns and trends
• Comply with legal obligations

• With Advocates: When you book a consultation, your intake notes and contact information are shared with the booked Advocate to prepare for your session.
• With HeHRa Reviewers (Advocate applications): Advocate applications — including open-text answers, credential files, and disclosures — are shared with the HeHRa team members responsible for reviewing applications and with any third parties we engage specifically for credential or reference verification.
• Service Providers: We use Stripe and Stripe Connect (payments and advocate payouts), Supabase (database and private file storage), Anthropic (AI), Resend (email), Vercel (hosting and analytics), PostHog (product analytics and session recording), Upstash (rate limiting), and Cloudflare Turnstile (bot protection) to operate the Service.
• Legal Requirements: When required by law, subpoena, or to protect our rights.

Your conversations with the AI HR Advisor are stored in your account. They are never shared with your employer, never sold, and never used to train AI models. Conversation content is shared only as described in Section 5: with the service providers that operate the Service, such as Anthropic, which processes your messages to generate the Advisor's replies, and when we are required to disclose it by law.

A small number of authorized HeHRa team members may review conversations internally for one purpose only: improving the quality and safety of the Advisor's guidance, for example understanding which questions are common, where the Advisor's answers fall short, and how it should handle unusual situations. We use Anthropic's Claude API to process your messages. Anthropic's data retention and privacy policies apply to the processing of your messages.

Conversations are not privileged. Unlike communications with your own attorney, your conversations with the Advisor could be subject to a subpoena or other legal process. If that happens, Section 5 applies.

Uploaded documents. When you upload a document, we send it to our AI provider to extract its text, then discard the file. We do not store uploaded files. The extracted text is kept in your conversation like any other message.

De-identified and aggregated information. We may combine information from many conversations into de-identified, aggregated statistics, for example how often conversations concern a particular type of workplace situation, or the time of day people most often reach out. We may use and publish these statistics, including in research, articles and marketing. Aggregated information does not identify you, your employer or any individual situation. We keep it in de-identified form, we do not attempt to re-identify it, and we do not sell it or provide it to any employer.

Individual stories. We never publish, quote or describe an individual person's conversation or situation, even with names removed, without that person's written permission and their approval of the final text. Examples on our website and in our marketing are written from scratch or are composites of common patterns.

• Access your personal data by logging into your account
• Delete your account and associated data by contacting us at privacy@hehra.com
• Opt out of non-essential communications

If you are a resident of a US state with a comprehensive consumer privacy law — currently including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — you may have some or all of the following rights regarding your personal information. These rights are not absolute and may be limited by applicable law.

• Right to know whether we are processing your personal information, and to access it
• Right to correct inaccuracies in your personal information
• Right to delete your personal information
• Right to obtain a copy of the personal information you previously provided, in a portable format
• Right to opt out of the sale of personal information, targeted advertising, or profiling that produces legal or similarly significant effects
• Right to limit the use and disclosure of sensitive personal information
• Right to non-discrimination for exercising any of these rights

We do not sell your personal information, we do not share it for cross-context behavioral or targeted advertising, and we do not use it for profiling that produces legal or similarly significant effects about you.

The AI HR Advisor lets you enter free-text information, which may include sensitive details about your employment situation. We process this information only to provide the Service and only with your consent or as otherwise permitted by law. We do not use sensitive personal information to infer characteristics about you.

Email privacy@hehra.com with the request you would like to make. You may also use an authorized agent to submit a request on your behalf; we may require the agent to provide proof of your written authorization and may still ask you to verify your own identity directly.

To protect your information, we will take reasonable steps to verify your identity before acting on a request. We use the information you provide in a request only to verify identity and to respond to the request.

If we decline to act on your request and your state's law provides an appeal right, you may appeal by emailing privacy@hehra.com with "Privacy Appeal" in the subject line. We will respond in writing with our decision and the reasons for it. If your appeal is denied, you may contact your state attorney general.

This section supplements Sections 2, 5, and 9 for HeHRa Advocate applicants and accepted Advocates.

Advocate application data is stored in our Supabase database with Row Level Security enabled. Uploaded credential files are stored in a private Supabase Storage bucket (advocate-credentials) that is not publicly accessible. Review-time access to credential files happens via short-lived signed download URLs issued to authorized HeHRa reviewers (default expiration: seven days).

• Accepted Advocates. Application data and verified credential files are retained while your Advocate account is active and for one (1) year after offboarding, after which they are deleted unless we are legally required to retain them longer.
• Declined applicants. Application data is retained for ninety (90) days after the decline decision; uploaded credential files are deleted automatically at the end of that window. Summary analytics data (without identifying information) may be retained longer to evaluate recruiting patterns.
• Pending review. While your application is in review, data is retained until a decision is made.
• Applicant-initiated deletion. You may request deletion of your application and any associated credential files at any time by emailing advocates@hehra.com. We will honor the request within thirty (30) days, except where we are legally required to retain specific records.

The employer and other-clients information you disclose is used to populate your matching-pool exclusion list. We do not publish this information on your public Advocate profile, and we do not share it with clients; it is used internally to route matches.

Advocate payouts are processed through Stripe Connect. Stripe collects and stores the identification data required by its Know-Your-Customer (KYC) obligations directly; HeHRa receives only the account status and transfer metadata it needs to operate the payout pipeline. Stripe's privacy policy governs Stripe's handling of that data.