Privacy Policy

1. Information we collect

We collect:

• Account details — name, work email, job title, company and role within the portal.
• Content you provide — HR documents, policies, audit responses, notes and files you or your administrator upload.
• Usage data — sign-in times, pages viewed and actions taken, used to keep the service secure and reliable.
• Technical data — browser type, device and IP address, collected automatically when you access the portal.
• Reading and acknowledgement records — which handbook chapters and policies you have opened, how far you have read, and the name you typed when you confirmed you had read them. These form your employer’s compliance record.
• Assistant use — a count of the questions you ask the built-in assistant, kept to apply fair use limits. We do not keep the text of your questions.

2. How we use your information

We use personal information to:

• provide, maintain and secure the portal and your account;
• deliver the HR services your organisation has engaged us for;
• respond to requests and provide support;
• meet our legal and regulatory obligations.

Our lawful bases under UK GDPR are the performance of a contract, our legitimate interests in running and improving the service, and compliance with legal obligations.

3. The built-in assistant

The portal includes an assistant that answers questions about your organisation’s handbook and policies and can write short summaries of them. When you ask it a question, the question, the relevant handbook or policy text and your first name are sent to an AI model (Google Gemini) through Lovable’s AI gateway to produce the reply. The reply is shown to you and is not stored. We keep a count of how many questions each person asks, not the questions themselves.

The assistant answers only from your organisation’s approved documents and the portal guide. It does not give legal advice and it does not make decisions about you.

4. Sharing your information

We do not sell your personal information. We share it only with the service providers who help us run the portal, who act on our instructions and are bound by confidentiality and data protection obligations, and where required by law. Our current providers are:

• Lovable — application hosting, sending sign-in and notification emails, and the AI gateway described above.
• Supabase — database, sign-in and file storage.
• Cloudflare — delivering the portal to your browser.
• Google — the Gemini AI model behind the assistant, reached through Lovable’s gateway, and the typefaces the portal uses, which your browser requests from Google Fonts when a page loads.

5. Data retention

We keep personal information for as long as your organisation uses the service and for a reasonable period afterwards to meet legal, accounting or reporting requirements, after which it is securely deleted or anonymised.

6. Your rights

Subject to UK GDPR, you may request access to your personal information, ask us to correct or delete it, object to or restrict certain processing, and request a copy in a portable format. You can download a copy of the information the portal holds about you at any time from the Your data section of your Profile page. For anything else, contact us using the details below. You also have the right to complain to the Information Commissioner’s Office (ICO).

7. Security

We use appropriate technical and organisational measures — including access controls, encryption in transit and role-based permissions — to protect your information against unauthorised access, loss or misuse.

8. Changes to this policy

We may update this policy from time to time. The latest version will always be available on this page with its effective date.

9. Contact us

Questions about this policy or your information can be sent to hello@wearethryve.co.uk or via wearethryve.co.uk.