Data processing notice
What data H&R uses for sign-in, the HR workspace, and candidate applications.
Signing in with Telegram
H&R stores your numeric Telegram ID, language, and session data to verify your sign-in and open your workspace. Telegram may share your name and username with the bot. H&R does not copy them into your profile. H&R does not request your phone number, email, photo, or Telegram password to sign you in. The bot sees the messages you send to it. Signing in does not give it access to other chats or your contacts.
Sessions and sign-in protection
Sign-in requests expire after 5 minutes. A necessary browser cookie keeps you signed in for up to 7 days. H&R uses the connection address to limit how often sign-in requests can be made. The session record includes the notice version and the time you agreed.
HR profile and workspace
You can add your name, job title, company, description, photo, and contact details, and choose which fields candidates can see. H&R stores vacancies, templates, drafts, filters, notification and language preferences, your plan, and usage counts. The interface saves your chosen language and theme in your browser. Account and workspace data are stored separately from candidate applications.
Candidate applications and messages
Candidates separately agree to application processing in the bot. H&R processes a candidate’s Telegram ID, name, phone number, answers, photo, CV, and any other files requested by the questionnaire. The candidate record also includes the status, HR notes, and messages. The HR user who manages the vacancy can access these records in the workspace. Messages are delivered through Telegram.
Storage and deletion
H&R data is stored on Railway in California, United States. H&R removes applications and associated files, notes, and messages from its active database after 7 days on the Free plan or 2 calendar months on Premium, measured from receipt of the application. Copies in Telegram and files downloaded to a device may remain.
Reports, restrictions, and appeals
H&R processes the participants’ Telegram IDs, report category and description, details of the reported vacancy, and an excerpt when a message is reported. The H&R owner uses this information to review reports. The user receives the decision without the reporter’s contact details. Moderation records are typically kept for up to 90 days. Message excerpts and descriptions linked to an application are removed by the application’s retention deadline. The ID and details needed to enforce an active restriction are kept while it is in effect. Users can appeal a decision through the bot.
AI features
When a recruiter requests an AI report, H&R sends some candidate answers and vacancy criteria to OpenAI. H&R masks known contact details and excludes photos and CVs. If a recruiter requests suggested questions, OpenAI receives the vacancy description and existing questions. Sign-in data is not sent for these features.