Hilo
Sign in

Hilo Privacy Policy

Version draft-2026-10-17

DRAFT TEMPLATE — NOT LEGAL ADVICE. Pre-publication counsel review is required and every bracketed placeholder must be replaced before this page is used for consent, A2P registration or contracts.

Effective Date: [DATE] Controller / operator contact: [LEGAL ENTITY, POSTAL ADDRESS, CONTACT EMAIL] Employee privacy inquiries: first contact your employer's privacy/HR representative; for Hilo service operations contact [PRIVACY CONTACT]. 1. Roles and scope. For employee workforce information entered by a Customer, the employer ordinarily determines the purpose of processing and Hilo acts as a service provider/processor under contractual instructions. For Hilo's own accounts, billing, platform security and marketing (if offered), Hilo may act as an independent business/controller to the extent the law recognizes those roles. Exact roles depend on the specific processing and contract. 2. Categories of information. We may process: identity (name, employee ID, preferred name), account identifiers and authentication hashes, business contacts (phone/email), position/location, schedules and availability, clock/break records and corrections, wage rates/totals where provided, pay periods and audit trails, employee attestations, optional photos, DOB/age status and work permits where required, signed legal forms, communication consent/STOP logs, device/IP/security logs, optional geolocation, customer-uploaded documents and certain sensitive tax identifiers if a configured employer workflow requires them. Do not request full SSN or biometric data in default employee signup. Payment card numbers, if used, should be handled by a certified processor rather than stored in app tables. 3. How data is collected. Information may come from the employer, authorized users, employee self-service, kiosks, SMS keywords, Postmark/Twilio delivery callbacks, integrations or security logs. Clock-in device timestamps may be paired with server-received timestamps; worker activity must not be misrepresented. 4. Purposes and lawful processing. Deliver workforce administration, generate accurate time/payroll files, provide scheduling and alerts, handle disputes, prevent fraud, secure sessions, meet legal recordkeeping obligations and respond to valid rights requests. Optional SMS requires distinct affirmative consent and is not a condition of employment or non-SMS access; any optional analytics, geolocation/photo/biometric or marketing processing requires separate notices/controls where law requires. 5. Sharing and subprocessors. Disclose information only to authorized Customer personnel, contracted processors required to provide Services (currently or as configured: Supabase, Vercel, Twilio for consented messages, Postmark for necessary mail, GitHub for source/development infrastructure without deliberate production HR data), bank/payroll integrations at Customer direction, or legal authorities when required. We do not sell personal information or mobile messaging opt-in information. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging opt-in data and consent will not be shared with any third parties for their marketing/promotional purposes. Service providers may process telephone numbers only as needed to deliver requested texts subject to contracts and law. Maintain a current subprocessor list and separate disclosures for any later vendor. 6. Data security. Apply organization-scoped access, encryption in transit, restricted encrypted storage where feasible, MFA for privileged roles, least privilege, audit trails, keyed API tokens, per-tenant RLS, incident monitoring, secure backups and periodic access review. Employees and customers should not place national IDs or sensitive wage details into free-text messages/SMS. 7. Retention. Specific periods depend on the applicable employer, employment/tax law, contracts and record type. FLSA payroll records generally have a three-year federal baseline and underlying wage-computation records a two-year baseline; longer federal/state tax or labor requirements and legal holds may apply. Define and publish an organization-level retention schedule with deletion and export rights. Consent records and security incident logs are maintained long enough to demonstrate compliance and handle disputes under an approved schedule; no universal numeric period is promised by this template. 8. Individual rights. Depending on your jurisdiction and Hilo/employer role, you may request access, correction, a copy, restriction, deletion where legally allowed and information about automated decisions. For employer-controlled records, Hilo may refer the request to the employer for identity verification and instructions. Accurate wage records, audit trails and legal holds might not be erasable on request. State-specific notices and appeal/authorized-agent procedures will be provided if required. 9. Minors and sensitive data. Hilo is a workplace application and not directed to children for consumer social networking. Employers using it with legally employed minors must establish age/permit/parental requirements, limit access to date of birth and protect school schedules and other minor information. Parental participation applies only when required/appropriate; do not treat a general parental signature as permission for prohibited employment. 10. Location, cameras, and biometrics. If an employer activates geolocation, photograph collection, facial recognition or similar functions, it must provide any required advance notice/consent, determine lawful purposes, limit access and retention, and comply with state biometric/workplace privacy laws. Biometric identification is disabled by default; camera images are not collected just because kiosk exists. 11. Cookies and local storage. Use essential signed session/device cookies, authentication/CSRF controls and limited preferences. Optional analytics tracking is disabled until the proper consent/control has been established; avoid third-party advertising trackers on employee portals and kiosks. Reconcile any offline work events using secure device-scoped storage that is purged after synchronization or retention expiry. 12. International data and updates. Specify actual database region, hosting/data-transfer geography and any required safeguards in a deployed jurisdiction-specific notice. Notify users of material policy changes. Questions: [PRIVACY EMAIL]; complaints may also be made to appropriate regulators.