Privacy Policy

Last updated: October 18, 2026

Quick HR Solutions, LLC (“Quick HR,” “we,” “us,” or “our”)
Website: https://cypresshr.app
Email: support@cypresshr.app

This Privacy Policy explains how we handle information in connection with our website, accounts, billing, and support, and how we process employment-related data on behalf of our business customers who use CypressHR (the “Service”).

We run B2B HR software for United States small and mid-size employers. CypressHR is offered for U.S. employers only for now. Your employer (our customer) decides what employee information goes into the Service. We process that employee information as a service provider / processor for the employer. We do not sell it, and we do not use it to train public AI models.

United States only

• CypressHR is offered for United States employers only at this time. Multi-state U.S. operating states and a U.S. compliance feed are supported; “national” means U.S. states, not international.
• We describe our actual privacy and security practices. We do not market GDPR, EU/UK, or other international privacy-compliance claims.
• Our main hosting is in the United States. Each subprocessor and where it processes data is listed on the Subprocessors page. Non-U.S. workforce data is outside current product scope.
• Our security posture is practical controls at launch (see Security Posture).
• I-9: You may upload a completed Form I-9 PDF/scan to restricted employee files and track status. CypressHR does not provide in-app electronic I-9 completion, remote ID verification, or biometric identity checks.
• We will update this Policy as our practices evolve.

1. Two kinds of data

We handle two kinds of data and treat them differently. The rest of this policy calls them Track A and Track B.

If you are an employee using the employee portal, your employer is primarily responsible for how your workplace data is collected and used. Direct privacy questions about your employment records to your employer’s HR contact. You can also reach us at support@cypresshr.app and we will route appropriately.

2. Track A: Website, account, billing, and support data

2.1 Categories we may collect

Depending on how you interact with us, we may collect:

• Identity & contact: name, business email, phone, company name, job title, mailing address
• Account credentials: username, authentication data (we do not store your password in plain text)
• Billing & commercial: subscription plan, payment method tokens via our payment processor (Stripe), invoices, tax IDs if provided for business billing
• Communications: emails, support tickets, call notes, demo or sales correspondence
• Technical / usage: IP address, device/browser type, approximate location derived from IP, pages viewed, referring URLs, log data, cookie identifiers
• Marketing preferences: opt-in/opt-out status for our own marketing (we do not use marketing SMS without recorded opt-in)

We do not intentionally collect government ID scans or I-9 images through our public website. Inside the authenticated product, Customers may upload a completed Form I-9 PDF/scan to restricted employee files.

2.2 Sources

• Directly from you (forms, email, phone, account setup)
• Your employer/company if they invite you as an admin
• Automatically via cookies, logs, and similar technologies on cypresshr.app and the Service.
• Our payment processor (Stripe) for payment status

2.3 Purposes for Track A data

• Provide, secure, and improve the website and Service
• Create and administer Customer accounts
• Bill and collect fees; prevent fraud
• Provide customer support
• Send service/transactional messages (security alerts, billing, product changes)
• Send marketing only where permitted and consistent with your preferences
• Comply with law, enforce agreements, and protect rights and safety
• Limited internal analytics to understand product usage (aggregated or account-level where possible)

2.4 Sharing of Track A data

We may share Track A data with:

• Service providers / subprocessors who help us run the business (hosting, email, payments, support tools, error monitoring). See our Subprocessors list
• Professional advisors (counsel, accountants) under confidentiality
• Authorities when required by law or to protect rights
• Business transfer parties in a merger, financing, or sale (with appropriate protections)

We do not sell Track A personal data for money. We do not share it for cross-context behavioral advertising in a way we treat as a “sale” or “targeted advertising” under applicable law without required notices and opt-outs.

3. Track B: Customer Employee Data (processor / service provider)

3.1 Who controls this data

The Customer (your employer or the company that licensed the Service) is the controller / employer for Customer Employee Data. Quick HR processes that data only to provide the Service and related services under our agreement with the Customer (including our Customer DPA), and on the Customer’s documented instructions.

3.2 Categories Customers may upload or generate

Customers may choose to store or generate, among other things:

• Worker profiles and directory information (name, work contact, job title, location, manager, employment status)
• Organization and location structures
• Secure documents, handbooks, and e-sign acknowledgments of receipt
• Employee portal activity related to those features
• PTO requests/balances and related notes the Customer configures
• Timesheets and time entries (non-biometric)
• Tasks/cases with restricted access (HR operational workflows)
• Onboarding/offboarding checklists and task completion status
• Compliance calendar items and an informational / regulatory update feed filtered by operating state(s), awareness notes only, not legal advice; any suggested policy helpers require human confirmation before changes apply
• Texas and other state workplace notices the Customer posts or acknowledges
• Announcements, roles/permissions, MFA status, audit metadata
• Light analytics derived from Service use (for the Customer’s company account)
• Medical / ADA vault documents when the Customer uses that feature (see below)

3.3 Keep-outs and where medical files go

Customers should not use the Service for:

• In-app electronic I-9 / document examination, remote ID verification, or biometric/selfie identity checks. Allowed: completed Form I-9 PDF/scan in restricted files plus status tracking
• Biometric timeclock data (fingerprints, face geometry, etc.)
• Background-check / CRA reports or adverse-action workflow packages
• Medical / ADA medical certifications in general personnel files. Please use the Medical / ADA vault instead
• Native payroll/tax filing as system of record data beyond what light time/PTO features support
• Full carrier claims integrations outside the Medical vault’s document-hosting purpose
• Content for AI auto-discipline / auto-reject / auto-score of protected traits (we do not offer that)

If keep-out data is uploaded to the wrong place, we may suspend access to the affected content, delete or move it per our Terms/DPA, and ask the Customer to remediate.

Medical / ADA vault: CypressHR includes a separate Medical vault for doctor's notes, medical certifications and accommodation paperwork, kept apart from the main personnel file. That is a product feature for sensitive medical employment documents.

3.4 Purposes for Track B data (limited)

We process Customer Employee Data to:

• Host and display it to authorized Customer users and workers as configured
• Provide e-sign acknowledgment, PTO, timesheet, checklist, case/task, notice, Medical vault, and related features
• Secure the Customer’s company account (MFA, access control, audit logs, backups)
• Provide support to the Customer
• Maintain the service, fix bugs, and produce aggregated / de-identified metrics that do not reasonably identify individuals
• Comply with law and our contracts

We do not:

• Sell Customer Employee Data
• Use Customer Employee Data to train public AI models
• Use Customer Employee Data for Quick HR’s own unrelated marketing
• Make employment decisions for the Customer (hiring, firing, discipline, compensation). The Service is a tool; the Customer remains employer of record

3.5 Sharing of Track B data

We share Customer Employee Data only:

• With subprocessors needed to run the Service (listed in our Subprocessors list), under written terms
• With persons the Customer authorizes (Customer admins, managers, workers via portal permissions)
• When required by law (we will notify the Customer unless legally prohibited)
• To protect against urgent security threats consistent with the DPA

Quick HR personnel access Customer Employee Data only on a least-privilege, need-to-know basis for support, security, and operations.

4. Subprocessors

We use vetted vendors to host and operate the Service. Our current list (with purposes and locations) is published in our Subprocessors page.

We will notify Customers of material subprocessor changes as described in the Customer DPA.

5. Security (overview)

Controls at launch include, at a high level:

• Encryption in transit and at rest
• Multi-factor authentication (MFA) for appropriate account types
• Each customer’s data is kept separate from every other customer’s (logical separation)
• Backups and audit logging
• Least-privilege internal access

We have not completed a SOC 2 audit or other third-party certification. Details are in our Security Posture one-pager.

6. Retention (high level)

• Track A: Kept as long as needed for the account relationship, legal/accounting needs, and security, then deleted or de-identified.
• Track B: Retained per Customer configuration, our Retention & Deletion Schedule, and the Customer’s instructions. After termination, Customers typically get an export window, then we delete from active systems and allow backups to age out.

Customers remain responsible for keeping employment records as long as employment laws require (often longer than Service defaults). See the Retention & Deletion Schedule.

7. Texas notes (TDPSA and Chapter 521)

7.1 Texas Data Privacy and Security Act (TDPSA)

The TDPSA generally applies to “consumers” acting in an individual or household context. It excludes individuals acting in a commercial or employment context, and related employment data used in that role, to the extent of that carve-out.

What that means in practice:

• Customer Employee Data processed for the employer in an employment context may fall outside TDPSA “consumer” rights.
• Website visitors and other individuals interacting with Quick HR as consumers (not as employees of a Customer in that employment role) may have TDPSA rights where the Act applies to us.

Where TDPSA consumer rights apply, you may be able to request access, correction, deletion, portability, or opt-out of sale/targeted advertising/profiling as defined by law. Submit requests to support@cypresshr.app. We will verify and respond as required. If we deny a request, we will explain how to appeal.

7.2 Texas data-breach law (Chapter 521) and sensitive personal information (SPI)

Texas Business & Commerce Code Chapter 521 requires businesses to protect sensitive personal information and to address certain breaches of system security. SPI can include items such as Social Security numbers, driver’s license numbers, and certain financial account information (see statutory definition).

Employment files and hosted documents can contain SPI. We design the Service with security controls and contractual limits, and we route medical files to the Medical vault. Customers should minimize SPI uploads and use restricted access features.

8. Cookies and similar technologies

We use cookies and similar tools that are:

• Necessary for login, security, and load balancing
• Analytics / performance, when enabled
• Marketing, only if enabled and consistent with your preferences

You can control cookies through browser settings. Some features may not work if you block necessary cookies.

Website analytics. On our public marketing pages (not inside the CypressHR app, and never on sign-in, password, or invite pages) we use Google Analytics 4 to understand how visitors find and use the site. It sets first-party cookies (such as _ga) and collects pages viewed, approximate location derived from IP address, device and browser type, and referring site. We turn off Google signals and ad personalization, remove query strings from page addresses, and send no names, email addresses, or company names to Google. Google processes this data for us as a service provider. We keep this analytics data for 14 months. We do not sell your personal information or share it for cross-context behavioral advertising. If your browser sends a Global Privacy Control signal, we don't load Google Analytics. You can block these cookies in your browser settings or use Google's opt-out add-on at https://tools.google.com/dlpage/gaoptout.

9. Children’s privacy

The Service and website are for businesses and workforce adults. They are not directed to children under 13 (or under 16 where relevant). We do not knowingly collect personal information from children in those age bands.

10. United States only (current commercial scope)

Product scope: CypressHR is offered for United States employers only at this time. We are not marketing international, EU/UK, or “global privacy compliance” features.

What we aim to follow: Applicable U.S. federal and state privacy and data-security laws that apply to Quick HR and to Customer’s use of the Service (including Texas Business & Commerce Code Chapter 521 regarding sensitive personal information and breach of system security, and other U.S. state privacy laws where they apply to us).

We describe specific practices (security controls, subprocessors, retention, breach processes, this Policy) rather than a blanket “fully compliant with every privacy statute” badge, and we keep these legal pages updated when laws or vendors change.

10.1 Where data is processed

• Our main hosting is in the United States. Each subprocessor and where it processes data is listed on the Subprocessors page.
• CypressHR is not offered as a non-U.S. employment-data product at this time.

10.2 If a Customer has workers outside the United States

Please tell us before upload. This Policy and current go-to-market assume U.S. workforce data. Processing personal data of people outside the U.S. may require extra contracts and legal steps that are outside current scope.

10.3 Keeping this Policy updated

We update legal pages on the CypressHR site when U.S. laws, subprocessors, or hosting practices change.

11. Your choices and contacts

• Employees: Contact your employer first for employment-record requests.
• Customer admins: Manage user access inside the Service; contact support@cypresshr.app for account/privacy issues.
• Consumers / website: Email support@cypresshr.app.

12. Changes

We may update this Policy. We will post the updated version with a new “last updated” date and, where required, notify Customers or provide additional notice.

13. AI statement

Quick HR does not use Customer Employee Data to train public AI models. Any future AI-assisted features will be disclosed and will remain subject to Customer instructions, our keep-outs (including no auto-discipline / auto-reject / auto-score of protected traits), and updates to this Policy.