Privacy Policy

You upload an org chart. We run rules and AI passes against it to produce a report for you. Your workspace data is yours — we don’t sell it, we don’t share it with other customers, and we don’t use it to train AI models. We do use a small list of third-party services to run the product (listed in §4 below). You can delete your account and data at any time.

We collect two kinds of information:

Account information

• Your name and email address
• A hashed copy of your password (never the password itself)
• The company name you use for your workspace
• Your role within the workspace (Owner, Member, etc.)

Workspace data (what you upload)

• CSV or spreadsheet uploads containing employee records: name, title, department, manager relationships, and any optional fields you provide (email, location, work mode, hire date, base salary, bonus target, employment type, brand)
• Snapshot metadata you enter (snapshot name, effective date, company profile)
• Findings, scenarios, and overrides you create while using the product

We also collect basic technical information about your usage — request logs, IP addresses, and browser type — for security and debugging.

• Run the analysis pipeline (rules engine plus Claude-powered passes) and store the resulting findings and reports inside your workspace
• Send you transactional emails — email verification, password reset, and important notices about your account
• Provide support, fix bugs, and improve the product. We may view your data when you ask for help or when investigating an incident that affects your account
• Compute aggregate, de-identified statistics (e.g. how often a given rule fires) to improve the product. We never publish anything that could identify your company or any individual employee

We do not use your workspace data to train or fine-tune any AI model, ours or anyone else’s.

• You, and anyone you explicitly invite to your workspace
• A small number of [Legal Entity Name] employees, when needed for support or debugging. Access is logged
• The third-party processors listed in §4

We never share your workspace data with other customers. We never sell it. We will not disclose it to law enforcement or third parties except where required by law, and we’ll let you know first unless legally prohibited.

We use the following services to operate NoMoStaff. Each has access only to the data needed to perform its function:

• Anthropic (Claude API) — runs two of our three analysis passes. We send excerpts of your org chart (titles, structure, department names, brand names, and — for the Comp-Drift rule — anonymized salary cohort statistics). We use Anthropic’s commercial API; under their terms, data sent to the API is not used to train Anthropic’s models. Hosted in the United States.
• SendGrid (Twilio) — sends email verification and password-reset messages. Sees your name and email address only.
• Railway — hosts our application server and Postgres database. Stores your workspace data at rest. Hosted in the United States.
• Cloudflare R2 — stores the raw CSV files you upload. Encrypted at rest.

We will update this list if we add new processors. If a change materially affects how your data is handled, we’ll notify you by email before it takes effect.

[Legal Entity Name] operates from [Jurisdiction]. Your workspace data is stored on infrastructure located in the United States (Railway and Anthropic). By using NoMoStaff you consent to the transfer and processing of your data in the United States.

• Account and workspace data — kept for as long as your account is active. If you delete your account, we delete this data within 30 days.
• Backups — Railway retains automated database backups for up to 30 days. Deleted data may persist in backups for that window before being purged.
• Request logs — kept for 30 days for security and debugging, then deleted.

You can ask us to:

• Tell you what we have on you
• Correct it if it’s wrong
• Delete your account and all associated workspace data
• Export your data in a machine-readable format

To exercise any of these, email [Support Email]. We’ll respond within 30 days. If you’re in a jurisdiction with stronger rights (the EU under GDPR, California under CCPA, Canada under PIPEDA), those rights apply on top of these.

• Passwords are bcrypt-hashed; we never store them in plaintext
• All traffic between your browser and our servers uses HTTPS
• Workspace data is logically isolated by tenant — access is checked on every request
• We do not currently process payments, so we do not store credit card information

No system is perfectly secure. If we discover a breach that affects your account, we’ll notify you by email without undue delay.

NoMoStaff is built for businesses and is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we’ll delete it.

If we change this policy in a way that materially affects how your data is handled, we’ll email you at least 14 days before the change takes effect. Minor clarifications will be posted here with an updated effective date.

[Legal Entity Name], [Jurisdiction].
Email: [Support Email]