Privacy Policy
Debrief ("Debrief," "we," "us") provides performance-management and HR software to employers ("Customers"). This policy explains how we handle personal information when a Customer's organization uses Debrief and when an individual ("you," an employee, manager, or administrator of a Customer) uses the service.
Debrief is a business-to-business service. For most data we process, the Customer (your employer) is the controller and Debrief is the processor acting on the Customer's instructions. If you are an employee, please also review your employer's own privacy notice.
1. Information we process
- Account & identity: name, work email, job title, department, role, reporting relationships, start date.
- Authentication: a securely hashed password (we never store passwords in plain text) and session records.
- Performance content: self reviews, manager reviews, ratings, 1:1 notes, and calibration notes you or your organization enter.
- HR requests & sensitive matters: HR tickets you file, including categories such as leave (FMLA), benefits, payroll, accommodations, and workplace concerns, and the related conversation.
- Profile photo: if you choose to upload one.
- Usage & technical data: login timestamps, IP address, and basic device/browser information used for security and reliability.
2. How we use information
- To provide the service to your organization: reviews, 1:1s, HR tickets, org management, and permissions.
- To authenticate you and keep accounts secure (including rate-limiting and lockout).
- To maintain, troubleshoot, and improve the service.
- To comply with legal obligations and enforce our terms.
We do not sell your personal information, and we do not use your organization's content to train external advertising or general-purpose AI models.
3. Sensitive information
HR tickets may include sensitive information (for example, medical-leave or accommodation requests). Access to this content is restricted server-side to the person who filed it and authorized HR/administrator roles at your organization. We apply the same access controls to calibration notes and 1:1 documentation.
4. Sharing
We share information only with: (a) authorized users within your own organization according to their role; (b) service providers that host and operate Debrief under contract (our database and edge infrastructure providers); and (c) authorities where required by law. Our sub-processors are bound to protect your data and use it only to provide their services to us.
5. Storage & security
Data is stored in managed PostgreSQL and served over encrypted connections (HTTPS/TLS). Passwords are hashed with a per-user salt. We apply role-based access controls, session expiry, and login-abuse protections. No method of transmission or storage is perfectly secure, but we work to protect your information using industry-standard measures.
6. Retention
We retain personal information for as long as your organization maintains its account, and as needed to provide the service, comply with law, resolve disputes, and enforce agreements. When a Customer's account ends, we delete or return organization data in line with our agreement with that Customer.
7. Your choices & rights
You can update your profile and password in the app. Because your employer controls most of your data, requests to access, correct, export, or delete personal information are generally directed to your employer (the controller), and we will assist them. You may also contact us using the details below. Depending on your location, you may have rights under laws such as the GDPR or CCPA/CPRA; we honor applicable rights.
8. Account & data deletion
Debrief is an employer-controlled system. Because your employer is the controller of your employment records, individual accounts are provisioned and removed by your organization's account owner and administrators, not through self-service. To have your personal data corrected or deleted, contact your employer's HR or account administrator, who can remove you from the owner console; you may also contact us and we will assist the controller. When your employer's account ends, Debrief deletes or returns the organization's data in line with our agreement with the Customer, subject to any legal or regulatory retention requirements.
9. Children
Debrief is a workplace tool and is not directed to children under 16. We do not knowingly collect information from children.
10. Changes
We may update this policy. Material changes will be posted here with a new "Last updated" date.
11. Contact
Questions or requests: privacy@debrief.team.
This document is a general template provided for transparency and is not legal advice. Debrief and its Customers should have counsel review and tailor it to their jurisdictions and practices before relying on it.