Privacy Policy

Information We Collect

HRStack.ai collects work contact details (first name, work email address, job title, company name), organisation size, HR technology assessment responses, vendor claim submissions, and usage data required to operate the platform. We do not accept personal email addresses — all submissions require a work email address.

How We Use Information

We use submitted information to deliver assessment reports, review vendor directory claims, provide platform access, support HR technology research, and respond to advisory service requests. We do not use your data for marketing or profiling unrelated to the service you requested.

How We Are Funded, and What Vendors See

HRStack.ai's buyer tools are free to use. We are compensated by vendors on the platform, on terms structured so that our fee does not depend on which vendor a buyer selects.

This does not change what we do with your data. Vendors do not have access to your assessment responses, requirements, evaluation scores, or reports, and cannot obtain access to them by paying us. We do not sell your data, and we do not pass your contact details to a vendor unless you ask us to introduce you.

Lawful Basis

We process work contact data under legitimate business interests to deliver the service you requested. This applies to delivering assessment reports, reviewing vendor claims, managing account access, and responding to advisory enquiries. For users in the EU (GDPR) or India (DPDP Act 2023), you may object to specific processing activities by contacting us using the details in the Data Requests section below.

Service Providers

We use the following third-party processors, each acting on our behalf:

• Supabase — database and authentication infrastructure (United States)
• Resend — transactional email delivery, e.g. assessment reports and sign-in codes (United States)
• Calendly — meeting scheduling for advisory calls (United States)
• Vercel — application hosting and content delivery (United States)
• Microsoft Graph API — appointment management for advisory bookings

We do not sell personal data to any third party.

Retention

We retain data only as long as necessary for the stated purpose:

• Digital Maturity assessment submissions: up to 12 months from submission
• Advisory call requests and discovery data: up to 6 months from last contact
• Buyer accounts: for the duration your account is active, plus a reasonable period thereafter
• Vendor directory claims: until the claim is resolved or you request deletion

Data is deleted or anonymised upon a valid deletion request (see Data Requests below).

Your Rights

Depending on your jurisdiction — including under the EU General Data Protection Regulation (GDPR) and India’s Digital Personal Data Protection Act 2023 (DPDP Act) — you may have the right to access, correct, delete, restrict, or receive a portable copy of the data we hold about you. You may also object to processing activities based on legitimate interests. To exercise any of these rights, see Data Requests below.

Security

We use reasonable technical and organisational safeguards including row-level access controls, encrypted transport, and role-based permissions. No service can guarantee absolute security.

Data Requests

To exercise your data rights — access, correction, deletion, or portability — email abhinay@hrstack.ai with the subject line Data Request and include your work email address. We will acknowledge within 5 business days and fulfil the request within 30 days.

Contact

For privacy questions, contact HRStack.ai at abhinay@hrstack.ai.

Data Protection Contact: Abhinay Sonar, Founder — abhinay@hrstack.ai