Draft for legal review. Items in square brackets must be completed before launch.
This policy explains how apls.ai collects and uses personal data when you visit HikeSeason.com, create a workspace or use the HikeSeason service.
Who we are
apls.ai operates HikeSeason.com and the HikeSeason HR service. Our registered office is at [registered address, India].
For data your company uploads about its employees and candidates, your company is the controller (data fiduciary) and we act as its processor. For account, billing and website data, we are the controller.
Information we collect
Account data: name, work email, phone, role and password hash for admins and users.
Billing data: company name, billing address, tax ID and payment method details. Card numbers are handled by our payment provider (Stripe) and never stored by us.
Usage data: log-ins, pages used, device and browser type, IP address and error reports.
Website data: cookies described in our cookie policy, including the country you choose for pricing.
Support data: messages and attachments you send us.
How we use information
To create and run workspaces, authenticate users and provide the features you request.
To bill subscriptions, count active employees against plan limits and send invoices.
To secure the service, detect abuse and fix errors.
To send service notices. Product news is sent only if you opt in, and you can unsubscribe at any time.
Legal bases
Under the GDPR and UK GDPR we rely on contract, legitimate interests (security and service improvement), legal obligation (tax records) and consent (optional cookies and marketing).
Under India’s Digital Personal Data Protection Act, 2023 we process data with consent or for legitimate uses permitted by the Act.
AI features
AI agents (screening, caller, document, payroll and HR assistant) process customer data only to perform the task your company enables.
Customer data is not used to train third-party AI models. Hiring and employment decisions are always made by people at your company.
Sharing
We share data only with subprocessors listed on our subprocessors page, professional advisers, and authorities where the law requires it. We do not sell personal data.
International transfers and data residency
Each workspace chooses where its data is stored and has its own separate database. Where data moves across borders we use safeguards such as Standard Contractual Clauses.
Retention
Account data is kept while your workspace is active and for up to 90 days after it closes. Billing records are kept for 8 years to meet tax law. Customer workspace data is deleted within 30 days of termination unless your company asks us to export it first.
Security
Data is encrypted in transit and at rest. Each workspace has its own database with separately encrypted credentials, and documents are stored encrypted with a key unique to the workspace. Access is role-based and logged, sensitive fields are masked by default, and we test backups regularly.
Your rights
You can ask to access, correct, delete or export your data, object to processing or withdraw consent. If you are an employee of a customer, please contact your employer first; we will help them respond.
You may complain to your local data protection authority, or in India to the Data Protection Board after contacting our Grievance Officer.
Grievance Officer and contact
Grievance Officer: [name], apls.ai, [address]. Email: legal@hikeseason.com. We respond within 30 days.
Changes
We will post updates here and notify workspace admins by email at least 30 days before material changes take effect.