Privacy notice

Who we are

DayOneFlow is operated by [Operator legal name], [address], registered under [registration number]. Privacy contact: [privacy contact email]. Data protection officer: [DPO if required].

Our role

Organizations use DayOneFlow to make job offers and to onboard new employees until their probation outcome.

• Candidates, new hires and their emergency contacts: the hiring organization decides what is collected and why. It is the controller. DayOneFlow processes the data on its behalf under a data-processing agreement. The organization's own privacy notice explains its reasons and your rights, so please contact it first. Your personal page shows its contact email when it has set one.
• Staff who sign in (HR, managers, colleagues): [role to be confirmed: DayOneFlow for the account itself and its security; the organization for what you do in its workspace].
• Visitors to this website: DayOneFlow is the controller.

What DayOneFlow holds

Staff accounts

• Name, email address, and a password hash (Argon2id, never the password). With “Sign in with Google” instead: your Google account identifier and the profile picture link Google provides.
• When your email was verified and when you last signed in; your memberships, roles and invitations.
• Notifications, a record of the emails sent to you, and your actions in the audit trail.
• If your organization names you as the signatory of its letters: your name, job title and the signature image it uploads or you draw. Each letter sent keeps a copy of them.
• For running the service, our operators see accounts and organizations (names, email addresses, roles, sign-in dates, counts) but never new hires’ records. We keep internal support notes about a customer’s account and a record of every action our operators take; suspending an account or changing its trial also appears in the organization’s audit trail.

Candidates and new hires

• Name and preferred name, personal email and mobile number; job title, department, location, manager, employment type, work arrangement, start date, an optional employee ID and probation dates.
• Each offer as sent, including the salary and its PDF. Your decision on it, with any message, the time, the version of the acceptance wording, a keyed hash of your IP address (never the address itself) and your browser's identification string.
• Details you enter before day one: legal names, phone, home address, one emergency contact and, only where the organization asks for it, the date of birth.
• Documents you or the organization upload (PDF, PNG or JPEG). These can include identity, right-to-work, tax-ID, employment and education documents if the organization asks for them, and a verification provider's report the organization adds. For each of your uploads, whether HR accepted it or asked for a new copy, with HR's message to you.
• Bank details for your salary, entered by you: the account holder, bank, branch and country, and the account number and bank codes. The account number and codes are encrypted; only HR and admins can open them, every opening is recorded, and you get an email each time they are saved.
• Where the organization runs background, employment, education or reference checks with a provider: the status of each check (for example in progress, verified, not verified or waived), the provider's name and reference, and why a check was waived — never what a check found. Only HR and admins see it.
• Onboarding tasks; check-ins with your manager (their notes, an optional rating and your comment); probation dates, outcomes and reasons; the confirmation letter.
• A hash of your personal link (never the link), its expiry and when it was last used.

Website and technical data

The web server's access log keeps the IP address, time, page (with personal-link codes masked), status and browser identification. Counters that limit repeated attempts are stored only as hashes.

DayOneFlow has no payroll, tax or government-ID fields, though an uploaded document may show such numbers; bank details are collected only as described above. It uses no analytics or advertising tools and stores no raw IP addresses in its database. It does not sell data, use it for advertising or profiling, or make automated decisions about people: offers and probation outcomes are decided by people at the organization.

Why it is used and on what basis

To provide the service to the organization (offers, preboarding, onboarding, check-ins, probation, reminders and emails), to keep accounts and links secure, to keep a tamper-resistant record of important actions and offer decisions, and to run, back up and restore the service.

[Legal bases by jurisdiction, to be completed by counsel: EU/UK GDPR Article 6; India Digital Personal Data Protection Act 2023 (consent or legitimate uses); US state privacy laws where they apply.]

Who receives it

• The organization's staff, by role. HR and admins see their organization's records. Managers see only the hires they manage, without contact details, details forms, documents, verification checks or offers. Members see only their own tasks.
• Service providers: hosting [hosting provider and location]; email delivery [email provider]; encrypted off-server backups [backup storage provider].
• Google, only if you choose “Sign in with Google”.
• [International transfers and their safeguards.]

How long data is kept

• Hiring records (offers, decisions, details, documents, tasks, check-ins, probation, audit trail) are kept while the organization uses DayOneFlow. The app does not delete them by itself. They are deleted within [30] days of the organization's instruction.
• A removed document's file is deleted at once. A note that it existed stays with the record.
• In-app notifications: read ones are deleted once older than 90 days, and all of them after one year.
• Server logs: 14 days [web server log period to be confirmed]. They never contain passwords, links or salaries.
• Backups: daily copies for 7 days, weekly for 4 weeks, monthly for 6 months; copies made before a software update for at most 30 days. Deleted data remains in them until they rotate out [off-server backup retention to be confirmed].

How it is protected

• Encrypted connections (TLS); passwords hashed with Argon2id; sessions end after 12 hours.
• Each organization's data is separated from every other organization's, and people see only what their role and relationship allow.
• Personal links are random, stored only as a hash, expire, and can be revoked; each new link replaces the previous one.
• Files are never public: each download is checked first.
• The application cannot change or delete the audit trail.
• Backups are encrypted before they leave the server.

Cookies

DayOneFlow uses only cookies that are strictly necessary to sign in: a session cookie (12 hours), a cookie that protects the sign-in forms, one that remembers the page to return to, and, for Google sign-in only, two short-lived cookies (15 minutes). There are no analytics, advertising or third-party cookies. Personal links for candidates and new hires work without cookies.

Your rights

Depending on where you are, you may have the right to access, correct or delete your data, to restrict or object to its use, to data portability, and to complain to a regulator. [Rights and response times by jurisdiction.]

Candidates and new hires: please contact the hiring organization first. Your personal page lets you change your details until your first day. If you write to us, we pass your request to the organization within [X] business days and help it answer. Offer decisions and the audit trail are kept as evidence. Deleting one person's record is handled case by case with the organization.

DayOneFlow is not aimed at children. Changes to this notice are shown by the date above.

Contact and complaints

Write to [privacy contact email] or [address]. You may also complain to [supervisory authority].