Privacy Policy

1. Introduction

This Privacy Policy explains how HR MONSTER PTE. LTD. (UEN 202538262Z), 1 North Bridge Road, #30-02, High Street Centre, Singapore 179094 collects, uses, discloses, transfers, and protects Personal Data when you visit or use our website, interact with us in connection with the site or our services, or otherwise engage with us where this policy is made available.

This policy also applies when you install or use the HR Monster Browser Importer browser extension, connect HR Monster to ChatGPT or another compatible OpenAI service, or use an approved integration that exchanges data with HR Monster through the Model Context Protocol (MCP).

Where we provide services to a business customer as a processor or intermediary, this policy does not fully describe that customer-controlled processing. In those cases, the Customer Agreement and any data processing addendum govern, and the customer remains responsible for its own privacy notices to employees, workers, applicants, and other end users.

By using the site, extension, connected app, or by providing Personal Data to us, you acknowledge that you have read and understood this Privacy Policy.

2. Our role

HR Monster acts as a controller for website visitors, prospects, business contacts, newsletter recipients, marketing leads, and job applicants.

Where customers upload or manage data about their own employees, candidates, contractors, or business contacts inside the product, HR Monster generally acts as a processor or intermediary on behalf of that customer.

When a user connects a third-party app such as ChatGPT, HR Monster processes authorization records and user-directed requests so the integration can access the customer tenant within the permissions granted by that user. OpenAI or another integration provider may separately act as a controller or processor under its own terms and privacy policy.

3. Definitions

For this policy, Personal Data means information that identifies or can reasonably identify an individual, including definitions under the Singapore Personal Data Protection Act 2012 (PDPA) and, where applicable, the GDPR, UK GDPR, or similar laws.

Processing means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion, or other handling.

4. Personal Data we collect

We generally do not seek to collect sensitive personal data unless it is necessary and lawfully permitted.

• Contact and business information such as name, job title, company, email address, and phone number.
• Account and usage information such as login records, product activity, device details, browser type, IP address, and page interactions.
• Communication information such as support requests, meeting notes, demo requests, and other correspondence with us.
• Marketing and preference information such as newsletter signups, content downloads, event responses, and communication preferences.
• Recruitment information such as CVs, application history, interview notes, and related hiring materials.
• Browser extension data imported from supported pages, workflow inputs, local cache, sync state, and run history needed to provide extension functionality.
• Connected-app data such as OAuth client and authorization details, requested and granted scopes, token and revocation records, MCP tool requests, selected action parameters and results, and operational identifiers or logs used to secure and diagnose the connection. We do not receive your ChatGPT or OpenAI account password.

5. How we collect Personal Data

• Directly from you when you contact us, create an account, book a demo, apply for a job, or otherwise interact with us.
• Automatically through cookies, analytics tools, log files, device information, and similar technologies.
• From third parties such as partners, referral sources, customers, public sources, and service providers.
• Through user-initiated browser extension imports, local storage, and session sync needed to authenticate, process supported pages, and submit workflow inputs.
• From ChatGPT, OpenAI, or another integration provider when you connect HR Monster and ask the integration to retrieve information or perform an action using the permissions you granted.

6. How we use Personal Data

Where processing relies on consent, you may withdraw that consent at any time, subject to applicable law and contractual restrictions.

• Operate, maintain, secure, and improve the website, extension, and services.
• Respond to inquiries, support requests, demo requests, and customer communications.
• Send service notices, updates, marketing communications, and product information where permitted.
• Manage our commercial relationship with prospects, customers, partners, and vendors.
• Recruit and assess job applicants.
• Protect our rights, detect abuse or misuse, and comply with legal or regulatory obligations.
• Authenticate extension users, import supported pages, submit workflow inputs, and display workflow runs or history.
• Authorize connected apps, enforce tenant and scope permissions, execute user-requested searches or actions, return the requested results, revoke access, prevent abuse, and diagnose failed requests.

7. HR Monster Browser Importer extension

If you use the HR Monster Browser Importer extension, the extension may process content from the active browser tab only after you choose an import or workflow action. This may include candidate profile information, selected page content, page URL, page title, workflow inputs, extension session state, cached user profile data, and recent workflow history.

The extension stores session, profile, and workflow history data in extension-local browser storage and sends imported content to HR Monster over HTTPS to provide the selected workflow.

We do not sell extension data, use extension data for advertising, or transfer extension data for purposes unrelated to the extension’s single purpose.

Our use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

8. ChatGPT, OpenAI, and MCP connections

The HR Monster app for ChatGPT is a user-directed connection. When you connect it, the authorization screen identifies the HR Monster permissions requested by the app. Read permissions may allow permitted tenant data to be retrieved. Write permissions may allow records to be created or updated, workflows to be executed, or leased agent tasks to be processed when you request those actions.

Information needed to fulfil a request may pass between OpenAI and HR Monster, including your instruction, selected HR Monster data, tool parameters, and the result of the requested action. OpenAI processes information it receives under its own terms, privacy policy, account settings, and retention controls. Do not include data in a prompt or action unless you are authorized to disclose and process it through both services.

You can choose not to approve requested permissions, disconnect the app in the connected-app settings provided by OpenAI, or contact HR Monster support to request server-side revocation where applicable. Disconnecting stops new requests but does not automatically delete data already retained by either provider under its applicable policy, customer agreement, or legal obligations.

The connection uses OAuth 2.0 with PKCE and HTTPS. Access remains subject to the user’s HR Monster role, tenant boundaries, the scopes granted during authorization, and any additional product-level permission checks.

9. Global and Asian data protection laws

We are committed to complying with the PDPA and, where applicable, other privacy laws such as the GDPR, UK GDPR, and similar regimes. The rights and obligations available to you may vary depending on your location and the context in which we process your Personal Data.

10. Cookies and similar technologies

We use cookies and related technologies to operate the site, understand traffic and usage patterns, remember preferences, improve performance, and support security. You can control cookies through your browser settings, though some site features may not work properly if cookies are disabled.

11. How we share Personal Data

We do not sell Personal Data. Browser extension and connected-app data is used to provide, secure, and support the requested functionality and is not used by HR Monster for third-party advertising.

• With service providers and subprocessors who help us host, secure, analyse, communicate, support, or operate the site, integrations, and services.
• With OpenAI or another integration provider when you choose to connect that service and direct it to retrieve data or perform an action in HR Monster.
• With professional advisers, auditors, insurers, and business partners where necessary.
• In connection with corporate transactions such as mergers, acquisitions, financing, or restructuring.
• With legal, regulatory, or governmental authorities where required or where necessary to protect rights or safety.

12. International transfers

We may transfer Personal Data outside the country where it was collected. Where required by law, we use appropriate safeguards such as contractual protections or other lawful transfer mechanisms, including standard contractual clauses where applicable.

13. Data security

We use reasonable technical and organisational measures to protect Personal Data against unauthorised access, use, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

For extension-related data, we use HTTPS in transit and local extension storage or sync mechanisms as needed for functionality.

For connected apps, we use HTTPS, scoped OAuth authorization, PKCE, tenant-aware access checks, and revocable credentials. You remain responsible for protecting your HR Monster and third-party accounts and for reviewing permissions before approval.

14. Data retention

We retain Personal Data for as long as necessary for the purposes described in this policy, to comply with legal or contractual obligations, resolve disputes, enforce agreements, or support legitimate business needs. When data is no longer required, we delete or anonymize it where reasonably practicable.

For the browser extension, certain local cache or run-history data may remain until you log out, clear extension storage, or remove the extension.

For connected apps, authorization records, tool requests, results, and security or diagnostic logs may be retained according to the applicable Customer Agreement, tenant settings, operational needs, and legal obligations. OAuth credentials expire or may be revoked, but revocation does not itself delete historical audit or security records. Information already sent to an integration provider is retained under that provider’s policies and account controls.

15. Your rights and connected-app controls

To exercise these rights, contact us using the details below. We may need to verify your identity before responding.

• Access, correct, or update your Personal Data.
• Request deletion or restriction of processing where permitted by law.
• Object to certain types of processing or withdraw consent where processing relies on consent.
• Request data portability where available under applicable law.
• Lodge a complaint with a relevant regulator or supervisory authority.
• Decline requested OAuth scopes, disconnect an integration, or ask us to revoke a connected app where applicable.

16. Children’s privacy

Our site and services are intended for business users and are not directed to children. We do not knowingly collect Personal Data from children in circumstances where consent from a parent or guardian would be required.

17. Third-party sites and services

Our site and services may contain links to or integrate with third-party websites and services, including OpenAI services when a user enables that connection. Third parties operate under their own terms, privacy policies, security controls, and retention practices. Review those policies and your third-party account settings before connecting or transmitting Personal Data.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above and post the updated version on this page. Material changes may also be communicated through other appropriate channels.

19. Contact us

HR MONSTER PTE. LTD.

1 North Bridge Road, #30-02

High Street Centre

Singapore 179094

Email: privacy@hr.monster

Connected-app and product support: support@hr.monster