Privacy Policy

When an HR firm uses Veillane, that firm (and its client organizations) decide what personal data is entered and why — they are the controllers. Veillane acts as a processor, handling that data under their instructions and our agreement with them. If you are an employee or client of a firm that uses Veillane, direct requests about your records to that firm; we will support them.

For visitors to this website and people who request a demo, Veillane is the controller of the limited information you give us.

• Account data — name, email, and role, managed through our authentication provider.
• Service data entered by firms — requests, messages, time entries, attachments, and related HR case details, which can include personal and sensitive information about the firm's client employees.
• Demo and contact details — the firm name and contact information you submit to request a walkthrough.
• Product usage — pseudonymous, privacy-safe analytics about feature engagement. We do not record case content, names, or message text in analytics.
• Technical data — standard logs needed to run and secure the service.

To provide and operate the platform — routing requests, tracking time, managing retainers and invoices, securing accounts, keeping an audit trail, and providing support. We use aggregate, de-identified usage to improve the product, and we use demo details only to respond to your request. We do not sell your data, and we do not use HR case content for advertising.

Security is built into the data model, not bolted on. Sensitive fields are encrypted at rest with AES-256-GCM. Access is enforced at the database layer with PostgreSQL row-level security that isolates each firm and client organization, backed by role-based permissions across six roles. Confidential matters are restricted to the assigned consultant and authorized admins, and access to them is recorded in an immutable audit log. The architecture is designed to SOC 2 standards (formal certification is not yet in place).

We share data only with the vendors that help us run the service, under contracts that limit their use of it: authentication, database hosting, application hosting, transactional email, rate limiting, and privacy-respecting analytics. We may also disclose information where required by law or to protect rights and safety.

Account and service data is retained while an account is active and for as long as needed to meet legal and recordkeeping obligations (for example, employment-record retention). HR firms direct the retention and deletion of their clients' data; marketing and demo information is kept only as long as needed for that purpose.

If you use the client portal, you can download a copy of the data we hold about you at any time from Privacy & Your Data. Corrections and deletions are routed to your HR firm, which manages your records subject to legal obligations and any active matter. Depending on where you live, you may have additional rights — including under the Illinois Personnel Record Review Act and the California Consumer Privacy Act. To exercise rights, contact your HR firm, or reach us at the address below for data we control.

We keep cookies to a minimum — those needed to sign you in and keep your session secure, plus privacy-respecting analytics. We do not use advertising or cross-site tracking cookies.

Veillane is a workplace tool and is not intended for children. We do not knowingly collect data from children.

We may update this policy as the product and our obligations change. We will revise the date above and, for material changes, provide a more prominent notice.

Questions about privacy or this policy? Email privacy@veillane.com.