Privacy Policy

Last updated: 6 October 2026

This Privacy Policy explains how hrppl (“hrppl”, “we”, “us”) collects, uses, shares, stores and protects personal information when you visit hrppl.io, sign in to the hrppl application, or are an employee, contractor or job applicant of an organisation that uses hrppl. It also explains the choices and rights you have. If you have a question at any point, contact us at privacy@hrppl.io.

1. Who is responsible for your information

hrppl is a human-resources, payroll and workforce-management platform used by organisations (“customers”) to manage their own people. Two situations apply:

• Workforce data. When your employer or a prospective employer uses hrppl, that organisation decides what information about you is collected and why. It is the controller of that information and hrppl processes it on its behalf and on its instructions. Questions or requests about workforce data are best sent to that organisation first; we will help them respond.
• Our own data. For account holders’ sign-in details, visitors to our website, people who contact us, and customers’ billing contacts, hrppl decides how the information is used and is the controller.

2. Information we collect

Information you or your organisation provide

• Account and profile: name, work email address, phone number, job title, organisation, and the roles and permissions you hold in the application.
• Employment records: employee number, department, branch, manager, employment type and dates, work location and country, and records of onboarding, training, performance reviews, documents and policies you acknowledge.
• Payroll and tax: salary or pay rate, pay calendar, timesheets and overtime, payslips, tax identifiers (for example an Australian Tax File Number), tax and residency status, superannuation or pension fund details, and bank account details used to pay you.
• Leave and absence: leave requests, balances and approvals, and work-from-home requests.
• Sensitive workplace records, only where your organisation uses those features: workplace medical incidents and related attachments, disciplinary and grievance matters, and identity or right-to-work documents you are asked to upload.
• Recruitment: if you apply for a job through a careers page hosted on hrppl, your name, contact details, résumé, cover letter, LinkedIn URL, current role and desired salary.
• Billing: for customers, the billing contact and subscription details. Card payments are taken by our payment processor, Stripe; we do not receive or store full card numbers.
• Communications: messages you send us and support tickets raised in the application.

Information collected automatically

• Attendance and location: when you clock in or out, the time of the punch and, if your organisation uses location checks (geofencing), your device’s location and its reported accuracy at that moment. Your browser asks for permission first, and location is only requested when your organisation has set up geofences. We do not track your location at any other time.
• Biometric attendance devices: if your organisation connects a fingerprint or face-recognition clock, hrppl receives the punch event (device, time and the device’s user number). Fingerprint and face templates stay on the device and are never sent to or stored by hrppl.
• Security and usage logs: sign-in events, an audit trail of changes made in the application, and technical data such as IP address, browser type and the pages requested, used to keep the service secure and working. For rate-limiting public forms we store only a salted, one-way hash of the IP address.
• Cookies and local storage: see section 7.

Information from Google

If you choose “Continue with Google”, we receive the information described in section 3. We do not receive your Google password.

3. Google user data

hrppl offers “Sign in with Google” as an optional way to sign in. When you use it:

• Data accessed: only the basic scopes openid, email and profile — your Google account ID, email address, name and profile picture. We request no access to Gmail, Drive, Calendar, Contacts or any other Google service.
• How it is used: to create or sign in to your hrppl account, to match you to an invitation sent to the same email address, and to display your name and picture in the application. It is not used for any other purpose.
• Storage: it is stored with your hrppl account record by our authentication provider (Supabase) and protected as described in section 9.
• Sharing: Google user data is not sold, not used for advertising, not used to train artificial-intelligence or machine-learning models, and not shared with anyone except the service providers needed to operate sign-in, or where required by law.
• Your control and deletion: you can disconnect Google from your account under Settings → Account, revoke hrppl’s access at any time from your Google Account permissions, or ask us to delete your account and the Google data held with it by writing to privacy@hrppl.io.

hrppl’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use information

• To provide the service: run payroll, record time and leave, manage onboarding, reviews, training and documents, and send payslips and notifications your organisation sets up.
• To authenticate you, enforce multi-factor authentication, end sessions after 24 hours, and keep accounts secure.
• To meet legal and regulatory obligations, such as payroll tax and superannuation reporting your organisation is required to make.
• To send service emails: invitations, password resets, reminders and alerts. We do not send marketing email to employees of our customers.
• To provide support, investigate problems and prevent fraud and abuse.
• To bill customers for their subscriptions.
• To maintain and improve the service using aggregated or de-identified information.

We do not sell personal information, do not use workforce data for advertising, and do not use it to make automated decisions that produce legal or similarly significant effects about you. Where the law requires a legal basis, we rely on performance of our contract with the customer, the customer’s legal obligations, our legitimate interest in running a secure service, or your consent (for example, for optional location access).

5. Who can see your information

Within your organisation, access is limited by role: for example, payroll staff see pay details, managers see their team, and employees see their own records. Organisations are kept separate from one another. hrppl staff access customer data only to provide support or keep the service running, and only authorised staff can do so.

6. Service providers and sharing

We share information only with providers that help us run hrppl, under contracts that restrict their use of it:

• Supabase — database, authentication and file storage.
• Vercel — application hosting.
• Resend — delivery of service emails.
• Stripe — subscription billing and payment processing.
• Google — optional sign-in, as described in section 3.

Your organisation may also send data from hrppl to third parties it chooses, such as a tax authority, a superannuation clearing house or an accounting system. We may disclose information if required by law, to protect the rights and safety of people or the service, or as part of a merger or acquisition, in which case this policy will continue to apply.

7. Cookies and local storage

hrppl uses your browser’s storage to keep you signed in and to remember interface preferences. These are strictly necessary for the application to work. We do not use advertising cookies or third-party tracking cookies.

8. How long we keep information

We keep workforce data for as long as your organisation’s account is active and as instructed by your organisation, which is usually bound by employment, tax and payroll record-keeping laws. Audit logs are kept for a period each organisation can configure and are then deleted automatically. When a customer closes their account, we delete or anonymise their data within 90 days unless the law requires us to keep it longer. Job applications are kept as long as the hiring organisation decides. Accounts you hold directly with us are kept until you ask us to delete them.

9. Security

Data is encrypted in transit (TLS) and at rest. Each organisation’s data is separated by row-level security enforced in the database. Multi-factor authentication is required to use the application, sessions end after 24 hours, accounts can be suspended immediately, and sensitive actions are recorded in audit logs. No system is perfectly secure; if a breach affects your information we will notify you and the relevant regulator as the law requires.

10. Your rights

Depending on where you live, you may have the right to access the information held about you, correct it, have it deleted, restrict or object to its use, receive a copy in a portable format, and withdraw consent you have given. You also have the right to complain to your local data-protection regulator — in Australia, the Office of the Australian Information Commissioner. To exercise a right, contact your employer for workforce data, or email privacy@hrppl.io. We will respond within 30 days and may need to verify your identity first.

11. International transfers

Our service providers may process information in countries other than the one you live in. Where we transfer personal information internationally, we use contractual and technical safeguards required by applicable law, such as standard contractual clauses.

12. Children

hrppl is a workplace service and is not directed to children. We do not knowingly collect information from anyone under 16 except where an employer lawfully employs them and records them in hrppl.

13. Changes to this policy

We will update this page when our practices change and revise the date at the top. If a change is significant, we will tell account holders by email or in the application before it takes effect.

14. Contact us

For any privacy question, request or complaint, email privacy@hrppl.io. Our Terms of Service also apply to your use of hrppl.