Legal
Privacy Policy
Social HR is an HR workspace operated by Social Team. This policy explains what the service handles, including data received from Google. The Terms of Service cover how the product may be used.
Who this covers
Each customer organization has its own workspace on a subdomain of socialhr.online. People in one workspace cannot see another workspace’s employees, files, or records. The customer decides who inside that workspace may view HR records. Social HR processes that information to provide the service.
Information in a workspace
Depending on the modules the customer turns on, a workspace can hold:
- Employee profiles, job details, documents, and organization structure
- Attendance punches, shifts, leave, and payroll figures
- Recruiting records, goals, and helpdesk tickets
- Chat messages and project work the customer creates in the workspace
- Account credentials, session cookies, and language or theme preferences
Customers enter this information themselves, or their employees do while using the workspace.
Google sign-in
People who are not employees can open a Storage folder that was shared with their email. That sign-in uses a separate Google client and asks only for OpenID and the account email. Social HR uses the verified email to match an existing share. It does not receive that person’s Drive files, contacts, or calendar, and it does not use the email for advertising.
Storage and Google Drive
File names, folders, sharing, and quotas are stored by Social HR. The file bytes are kept in one Google Drive account that Social HR operates for the platform. Staff connect that account from the control plane. The Drive permission lets Social HR create, read, update, and delete files in that platform account so customers can upload and download their own files.
A customer’s personal Google Drive is not connected. An outside person who signs in with Google sees only the folders shared with their email, and only at the access level the customer chose.
Calendar and Meet
When a meeting in Projects needs a video link, Social HR can create, update, or delete an event on the platform Google Calendar and store the Meet link on that meeting. Guest addresses typed on the meeting are sent to Google as attendees so the invitation can go out. This uses the same platform Google account as Drive. It does not read a customer’s or an employee’s personal calendar.
Google API Limited Use
Social HR’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the sign-in, Storage, and Calendar features described above. It is not sold, not used for advertising, and not used to train generalized models.
Attendance, location, and the desktop app
- Clock-in can record the time and, when the customer requires it, whether the device is inside a work location.
- Face check-in stores a biometric template used to match the person at the clock. The enrollment photo is not kept.
- If the customer enables the desktop app, it can send activity heartbeats and, when screenshots are turned on, an image of the focused display. The customer’s administrators control whether tracking and screenshots are on.
Cookies and notifications
The site uses cookies to keep a person signed in and to remember preferences. If someone turns on browser notifications, the browser’s push subscription is stored so a closed tab can still receive alerts they already allowed. The marketing site does not run advertising tags.
Who can see it
Customer administrators and the people they authorize see records inside their own workspace. Social HR staff operate the platform (provisioning, plans, and the platform Google connection) and do not use the control plane to browse a customer’s HR records. Hosting and email providers process data only so the service can run. We do not sell personal information.
How long it is kept
Workspace data stays while the customer’s account is active. A suspended or cancelled workspace keeps its data and blocks sign-in until the workspace is deleted. Server logs and security records are kept for as long as needed to operate and protect the service. Disconnecting Drive or Calendar in the control plane stops new use of that Google grant.
Security
Workspaces are isolated from each other, traffic uses HTTPS, and access follows the customer’s roles. No method of storage or transmission is perfect. Customers should keep administrator accounts limited to people who need them.
Children
Social HR is a workplace product. It is not directed at children, and customers should not use it to collect information about children.
Requests and changes
Employees should start with their own organization’s HR administrator, who controls the workspace. Platform questions can be sent to ops@socialhr.online or through Social Team. When this policy changes, the effective date at the top of this page changes with it.