Core HR
Everyday HR
More Apps
By Role
Getting Started
VergeHR helps organisations look after their people, which means it handles personal information about employees, managers and the people who run each account. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, how long we keep it, and the choices and rights you have.
This policy applies to the VergeHR website at vergehr.com, the VergeHR web application, the VergeHR mobile apps for iOS and Android, and related features (together, the “Service”). It is part of our Terms of Service.
The Service is operated by [LEGAL ENTITY NAME] (“VergeHR”, “we”, “us”). For account and website information we decide how and why it is processed. For the employee information an organisation puts into VergeHR, that organisation decides what it stores and why, and we process that information on its behalf and according to its instructions.
We use personal information to provide, secure and improve the Service; to create and manage accounts; to send service emails such as activation, password-reset and security codes; to respond to you; and to meet legal obligations. We do not use it for advertising.
We rely on a small number of providers — for example for hosting, storage and email delivery — who process information only on our instructions and only to operate the Service. [LIST PROVIDERS BEFORE LAUNCH.]
VergeHR sets a small number of essential cookies. The site cannot work without them, so they are always on:
| Name | Purpose | Duration |
|---|---|---|
vergehr_session | Keeps you signed in. It holds a random token; the server keeps only a scrambled (hashed) copy. | 30 days, or until you sign out |
vergehr_csrf | Protects forms against forged requests from other websites. | 1 year |
vergehr_consent | Remembers whether you accepted or declined analytics. | 180 days |
Analytics cookies (optional). Our public pages use Google Analytics in Google's Consent Mode. Only if you accept does it set its own cookies (_ga and _ga_*) to measure visits. Until you accept, it stores nothing on your device and receives only anonymous, cookie-free signals (for example that a page was viewed), which Google uses to estimate overall traffic. It is never loaded inside the app. If your browser sends a Global Privacy Control signal, we treat it as a refusal. You can change your mind at any time with the Cookie settings link at the foot of any page — declining also deletes the analytics cookies.
Browser storage. We also store a few preferences in your browser, such as light or dark mode and which settings tab you last used. These stay on your device.
If your organization switches on AI apps and your role allows it, you can connect an AI app of your choice (such as Claude or ChatGPT) to VergeHR. The app then receives what it reads from VergeHR on your behalf, only what your role lets you see, to answer you. That provider's own privacy terms apply to what it receives. VergeHR never sends data to an AI app that you haven't connected, and doesn't use what the connector returns for advertising or to train AI models. You choose what each app may do, you can disconnect it at any time, and every request it makes is listed for you and your administrators.
We keep personal information for as long as the account is active and as needed to provide the Service. When an account owner asks to delete their account, it is scheduled for deletion and permanently erased after 30 days, including its team members' logins; signing in during that period cancels the deletion. Sign-in sessions last up to 30 days, and security codes expire after a few minutes.
For connected AI apps: access tokens last one hour and refresh tokens 30 days, a connection lasts at most 90 days before you approve the app again, and the record of what each app did, along with ended connections, is kept for 180 days. All of it is erased with the organization.
Connections to the Service are encrypted, passwords are stored only as secure hashes, each organisation's data is isolated to its own account, and every account can turn on two-factor authentication. No system is perfectly secure, but we work to protect your information and will notify you of a breach where the law requires.
Connected AI apps sign in with OAuth 2.1, and their tokens are stored only as scrambled (hashed) copies. A connection ends when you disconnect it, change your password, lose access, or when your organization switches AI apps off.
You can review and correct your profile in Settings, turn two-factor authentication on or off, and delete your account. Depending on where you live, you may also have rights to access, correct, delete, restrict or object to our processing of your personal information, and to data portability. To exercise them, email [email protected]. If your information was added by an employer, we may refer your request to that organisation.
The Service is intended for adults and for organisations. We do not knowingly collect personal information directly from children.
We may update this policy from time to time. We will post the updated policy on this page and change the “Last updated” date, and notify you of material changes before they take effect.
If you have any questions about this policy or how we handle your information, please contact us:
[LEGAL ENTITY NAME] (VergeHR)
Email: [email protected]
Contact form: vergehr.com/contact
