Privacy Policy

OneclickHR is operated by Nextkin Life LLC ("we", "us", "our"). This policy explains how we handle personal information in connection with the OneclickHR marketing website at oneclickhr.app and the OneclickHR application at app.oneclickhr.app.

You can reach us about anything in this policy at privacy@oneclickhr.app.

This distinction matters, because it determines who decides what happens to your information.

When you visit this website, contact us, or sign your organization up for OneclickHR, we are the controller of that information. We decide why we hold it and what we do with it, within the limits of this policy.

When your employer uses OneclickHR to manage HR records about you — your attendance, leave, pay, documents, tasks and profile — your employer is the controller and we are a processor acting on their instructions. We do not decide what employee data your employer puts into their workspace, how long they keep it, or who inside their organization may see it. If you are an employee and you want your HR data corrected or deleted, your employer is the right place to start; we will support them in responding to you.

Information you give us

• Contact form submissions: your name, work email, company name, the team size and enquiry type you select, and the message you write.
• Account registration: the email address and organization details used to create a workspace, plus authentication information handled by our authentication provider.
• Correspondence: emails you send us and our replies.

Information collected automatically

• Standard server log information when you request a page: IP address, user agent, requested URL, referrer and timestamp. This is generated by our hosting provider as part of serving the request.
• Rate-limiting state for our contact form, held in memory on the server for a short period and keyed by IP address, to prevent abuse.

This marketing website runs no analytics scripts, no advertising pixels and no third-party trackers. We do not build behavioral profiles of visitors.

Information processed on behalf of an organization

Inside the application, we process whatever employee and candidate records an organization chooses to store: identity and contact details, employment and department information, attendance and leave records, timesheets, salary and payslip data, work authorization records and expiry dates, uploaded documents, task assignments, calendar entries, support tickets and notification preferences. The organization determines the scope of this; we process it to provide the service.

• To respond to enquiries you send us. Legal basis: our legitimate interest in replying to you, or performance of a contract where you are a customer.
• To provide, secure and maintain the service, including authentication, access control, audit logging and abuse prevention. Legal basis: performance of a contract and our legitimate interest in operating a secure service.
• To send transactional messages such as email confirmations, payslip notifications, approval notifications and work authorization expiry reminders. Legal basis: performance of a contract, or our customer’s instructions where we act as processor.
• To comply with legal obligations, including responding to lawful requests and retaining records we are required to keep. Legal basis: compliance with a legal obligation.

We do not use personal information for advertising, and we do not sell personal information to anyone.

We use a small, deliberately short list of service providers to run the product. Each one processes a defined category of data under a contract that limits it to that purpose. The full list, with what each provider processes, is on our subprocessors page.

• Supabase — Postgres database, authentication and realtime infrastructure.
• Cloudflare — R2 object storage for uploaded files and documents.
• Resend — delivery of transactional email.
• Vercel — application and website hosting, including request logs.
• Google — Google Calendar sync and Google sign-in, for organizations that enable them.

We may also disclose information where we are legally required to, where it is necessary to protect our rights or the safety of others, or in connection with a merger, acquisition or sale of assets — in which case we will give notice before your information becomes subject to a different privacy policy.

Our service providers operate internationally, which means personal information may be processed outside the country where it was collected. Where we transfer personal information from a jurisdiction that restricts such transfers, we rely on the transfer mechanisms our providers make available, including standard contractual clauses.

Data residency region is chosen per deployment. If your organization has a requirement about where its data is stored, raise it with us before you start and we will tell you plainly whether we can meet it.

• Contact form submissions: kept for as long as needed to handle your enquiry and for a reasonable period afterwards for our records, then deleted.
• Server logs: retained by our hosting provider for a limited period in line with their standard retention.
• Contact form rate-limiting state: held in server memory only, for a short window, and not written to durable storage.
• Customer workspace data: retained for as long as the organization’s account is active. On termination it is deleted in line with the terms agreed with that organization.
• Audit log entries: retained for the life of the workspace, because their purpose is to provide a durable record of what changed.

Our security approach is described in full on our security page. In summary, and specifically:

• Multi-tenant isolation is enforced by the database. Row Level Security is enabled on every table, and every tenant-scoped table carries a non-null tenant id, so a query that omits a filter still cannot cross an organization boundary.
• Isolation is tested against a real database, including cross-organization reads and writes in both directions, direct access by id with no filter, and employee-to-employee isolation.
• Deactivation takes effect immediately, because access is re-checked from the database on every request rather than trusted from an existing token.
• Uploaded files are validated after they land by reading the stored bytes back, including magic-byte sniffing, MIME denylisting, SVG sanitization and image-spoof detection. Anything that fails is deleted.
• Third-party integration tokens are encrypted with AES-256, and the service refuses to start on a malformed encryption key.
• Mutations are recorded in a tamper-evident audit log.

No system is perfectly secure, and we will not claim otherwise. We hold no security certifications or attestations today, and we do not represent compliance with SOC 2, ISO 27001, HIPAA or GDPR certification schemes.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to the processing of your personal information, to data portability, and to withdraw consent where we rely on it.

To exercise a right in relation to information we hold as controller — for example a contact form submission — email privacy@oneclickhr.app. We will respond within the time required by applicable law, and we may need to verify your identity first.

If your request concerns HR data held in your employer’s workspace, contact your employer. They control that data, and we will assist them in responding to you.

OneclickHR is a business tool and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

We will update this policy when our practices change. The date at the top of this page reflects the most recent revision. Where a change materially affects how we handle your personal information, we will take reasonable steps to notify you — for customers, by email to the workspace owner.

Questions, requests and complaints about this policy can be sent to privacy@oneclickhr.app. Security reports go to security@oneclickhr.app. General enquiries go to hello@oneclickhr.app.