Privacy Policy

This Privacy Policy explains how HR MONSTER PTE. LTD. (UEN 202538262Z), 1 North Bridge Road, #30-02, High Street Centre, Singapore 179094 collects, uses, discloses, transfers, and protects Personal Data when you visit or use our website, interact with us in connection with the site or our services, or otherwise engage with us where this policy is made available.

This policy also applies when you install or use the HR Monster Browser Importer browser extension, connect HR Monster to ChatGPT or another compatible OpenAI service, or use an approved integration that exchanges data with HR Monster through the Model Context Protocol (MCP).

Where we provide services to a business customer as a processor or intermediary, this policy does not fully describe that customer-controlled processing. In those cases, the Customer Agreement and any data processing addendum govern, and the customer remains responsible for its own privacy notices to employees, workers, applicants, and other end users.

This policy also covers the HR Monster Employee App for Android and iOS. The Employee App section below describes mobile features; your employer remains responsible for explaining its own employment-related processing.

By using the site, Employee App, extension, connected app, or by providing Personal Data to us, you acknowledge that you have read and understood this Privacy Policy.

HR Monster acts as a controller for website visitors, prospects, business contacts, newsletter recipients, marketing leads, and job applicants.

Where customers upload or manage data about their own employees, candidates, contractors, or business contacts inside the product, HR Monster generally acts as a processor or intermediary on behalf of that customer.

When a user connects a third-party app such as ChatGPT, HR Monster processes authorization records and user-directed requests so the integration can access the customer tenant within the permissions granted by that user. OpenAI or another integration provider may separately act as a controller or processor under its own terms and privacy policy.

For this policy, Personal Data means information that identifies or can reasonably identify an individual, including definitions under the Singapore Personal Data Protection Act 2012 (PDPA) and, where applicable, the GDPR, UK GDPR, or similar laws.

Processing means any operation performed on Personal Data, including collection, storage, use, disclosure, transfer, deletion, or other handling.

We generally do not seek to collect sensitive personal data unless it is necessary and lawfully permitted.

• Contact and business information such as name, job title, company, email address, and phone number.
• Account and usage information such as login records, product activity, device details, browser type, IP address, and page interactions.
• Communication information such as support requests, meeting notes, demo requests, and other correspondence with us.
• Marketing and preference information such as newsletter signups, content downloads, event responses, and communication preferences.
• Recruitment information such as CVs, application history, interview notes, and related hiring materials.
• Browser extension data imported from supported pages, workflow inputs, local cache, sync state, and run history needed to provide extension functionality.
• Connected-app data such as OAuth client and authorization details, requested and granted scopes, token and revocation records, MCP tool requests, selected action parameters and results, and operational identifiers or logs used to secure and diagnose the connection. We do not receive your ChatGPT or OpenAI account password.

• Directly from you when you contact us, create an account, book a demo, apply for a job, or otherwise interact with us.
• Automatically through cookies, analytics tools, log files, device information, and similar technologies.
• From third parties such as partners, referral sources, customers, public sources, and service providers.
• Through user-initiated browser extension imports, local storage, and session sync needed to authenticate, process supported pages, and submit workflow inputs.
• From ChatGPT, OpenAI, or another integration provider when you connect HR Monster and ask the integration to retrieve information or perform an action using the permissions you granted.

Where processing relies on consent, you may withdraw that consent at any time, subject to applicable law and contractual restrictions.

• Operate, maintain, secure, and improve the website, extension, and services.
• Respond to inquiries, support requests, demo requests, and customer communications.
• Send service notices, updates, marketing communications, and product information where permitted.
• Manage our commercial relationship with prospects, customers, partners, and vendors.
• Recruit and assess job applicants.
• Protect our rights, detect abuse or misuse, and comply with legal or regulatory obligations.
• Authenticate extension users, import supported pages, submit workflow inputs, and display workflow runs or history.
• Authorize connected apps, enforce tenant and scope permissions, execute user-requested searches or actions, return the requested results, revoke access, prevent abuse, and diagnose failed requests.

If you use the HR Monster Browser Importer extension, the extension may process content from the active browser tab only after you choose an import or workflow action. This may include candidate profile information, selected page content, page URL, page title, workflow inputs, extension session state, cached user profile data, and recent workflow history.

The extension stores session, profile, and workflow history data in extension-local browser storage and sends imported content to HR Monster over HTTPS to provide the selected workflow.

We do not sell extension data, use extension data for advertising, or transfer extension data for purposes unrelated to the extension’s single purpose.

Our use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.

The HR Monster app for ChatGPT is a user-directed connection. When you connect it, the authorization screen identifies the HR Monster permissions requested by the app. Read permissions may allow permitted tenant data to be retrieved. Write permissions may allow records to be created or updated, workflows to be executed, or leased agent tasks to be processed when you request those actions.

Information needed to fulfil a request may pass between OpenAI and HR Monster, including your instruction, selected HR Monster data, tool parameters, and the result of the requested action. OpenAI processes information it receives under its own terms, privacy policy, account settings, and retention controls. Do not include data in a prompt or action unless you are authorized to disclose and process it through both services.

You can choose not to approve requested permissions, disconnect the app in the connected-app settings provided by OpenAI, or contact HR Monster support to request server-side revocation where applicable. Disconnecting stops new requests but does not automatically delete data already retained by either provider under its applicable policy, customer agreement, or legal obligations.

The connection uses OAuth 2.0 with PKCE and HTTPS. Access remains subject to the user’s HR Monster role, tenant boundaries, the scopes granted during authorization, and any additional product-level permission checks.

The Employee App lets you sign in to your employer’s workspace and use the employee services enabled for your account. The information available or requested depends on your employer’s configuration. HR Monster processes customer-controlled employee records on behalf of the employer as described in Our role above.

The app uses account identifiers and authentication credentials to sign you in. Depending on the features enabled, it retrieves or submits personal and contact details, employment information, identity documents and profile images, banking details, attendance records, leave balances and requests, expense claims and receipts, workflow inputs and attachments, notifications, and payroll or payslip information.

When you choose Clock in or Clock out, the app requests foreground location permission and attempts to capture your current location for that attendance action. It sends available coordinates, accuracy, capture time, and a device-provided simulated-location indicator with the attendance request to help verify the workplace and apply your employer’s attendance rules. The app does not continuously track your location or request background location access. If location is unavailable or permission is declined, it records the capture status; the attendance outcome depends on your employer’s rules.

Camera access is used to scan a QR sign-in code. When you choose an image for a profile, identity document, receipt, or request attachment, the selected image is uploaded to provide that feature. These features do not require microphone recording. You can change camera, photo, and location permissions in your device settings; declining a permission may prevent the related feature from working.

Employee records and submissions are handled within the employer’s workspace according to account permissions, including review by authorized HR staff or approvers. Service providers involved in operating the service are described in How we share Personal Data below. If you choose to save or share a payslip, the device’s sharing interface passes the file to the app or destination you select, whose own privacy practices then apply.

The app stores preferences and some cached service data on your device. With Remember me enabled, native sign-in tokens are stored using the operating system’s secure credential storage. Attendance and payroll query results are excluded from the app’s persistent query cache, but downloading a payslip creates a PDF in the app’s temporary cache. Copies you save or send elsewhere are separate from that cache. Signing out or uninstalling the app does not delete employment records held by your employer or copies you have shared.

Retention of customer-controlled employee records is governed by the applicable customer agreement, employer instructions, and legal obligations, as described in Data retention below. For access, correction, or deletion of employment records, contact your employer or HR team. You can also contact privacy@hr.monster about privacy requests and support@hr.monster for app support. Requests remain subject to identity verification and any applicable record-retention obligations.

We are committed to complying with the PDPA and, where applicable, other privacy laws such as the GDPR, UK GDPR, and similar regimes. The rights and obligations available to you may vary depending on your location and the context in which we process your Personal Data.

We use cookies and related technologies to operate the site, understand traffic and usage patterns, remember preferences, improve performance, and support security. You can control cookies through your browser settings, though some site features may not work properly if cookies are disabled.

We do not sell Personal Data. Browser extension and connected-app data is used to provide, secure, and support the requested functionality and is not used by HR Monster for third-party advertising.

• With service providers and subprocessors who help us host, secure, analyse, communicate, support, or operate the site, integrations, and services.
• With OpenAI or another integration provider when you choose to connect that service and direct it to retrieve data or perform an action in HR Monster.
• With professional advisers, auditors, insurers, and business partners where necessary.
• In connection with corporate transactions such as mergers, acquisitions, financing, or restructuring.
• With legal, regulatory, or governmental authorities where required or where necessary to protect rights or safety.

We may transfer Personal Data outside the country where it was collected. Where required by law, we use appropriate safeguards such as contractual protections or other lawful transfer mechanisms, including standard contractual clauses where applicable.

We use reasonable technical and organisational measures to protect Personal Data against unauthorised access, use, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

For extension-related data, we use HTTPS in transit and local extension storage or sync mechanisms as needed for functionality.

For connected apps, we use HTTPS, scoped OAuth authorization, PKCE, tenant-aware access checks, and revocable credentials. You remain responsible for protecting your HR Monster and third-party accounts and for reviewing permissions before approval.

We retain Personal Data for as long as necessary for the purposes described in this policy, to comply with legal or contractual obligations, resolve disputes, enforce agreements, or support legitimate business needs. When data is no longer required, we delete or anonymize it where reasonably practicable.

For the browser extension, certain local cache or run-history data may remain until you log out, clear extension storage, or remove the extension.

For connected apps, authorization records, tool requests, results, and security or diagnostic logs may be retained according to the applicable Customer Agreement, tenant settings, operational needs, and legal obligations. OAuth credentials expire or may be revoked, but revocation does not itself delete historical audit or security records. Information already sent to an integration provider is retained under that provider’s policies and account controls.

To exercise these rights, contact us using the details below. We may need to verify your identity before responding.

• Access, correct, or update your Personal Data.
• Request deletion or restriction of processing where permitted by law.
• Object to certain types of processing or withdraw consent where processing relies on consent.
• Request data portability where available under applicable law.
• Lodge a complaint with a relevant regulator or supervisory authority.
• Decline requested OAuth scopes, disconnect an integration, or ask us to revoke a connected app where applicable.

Our site and services are intended for business users and are not directed to children. We do not knowingly collect Personal Data from children in circumstances where consent from a parent or guardian would be required.

Our site and services may contain links to or integrate with third-party websites and services, including OpenAI services when a user enables that connection. Third parties operate under their own terms, privacy policies, security controls, and retention practices. Review those policies and your third-party account settings before connecting or transmitting Personal Data.

We may update this Privacy Policy from time to time. When we do, we will revise the effective date above and post the updated version on this page. Material changes may also be communicated through other appropriate channels.

HR MONSTER PTE. LTD.

1 North Bridge Road, #30-02

High Street Centre

Singapore 179094

Email: privacy@hr.monster

Connected-app and product support: support@hr.monster