Legal release status: This reference document is not yet effective or available for contractual acceptance.The licensed operator identity has been documented. Operational retention and deletion commitments, provider/AI agreements, international-transfer safeguards and release approval still require verification.
1. Who operates HR Copilot
HR Copilot is operated by SinarTech HR FZ-LLC, a Free Zone Limited Liability Company licensed by the Ras Al Khaimah Economic Zone Authority (RAKEZ), UAE. Services Licence No. 47035612. Licensed address: VUNE2810, Compass Building, Al Hulaila, Al Hulaila Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates. The licence was issued on 30 July 2026 and expires on 29 July 2027. For privacy enquiries contact info@sinartech.ae. The operator confirms its HR-related software services are within its licensed Human Resources Consultancy activity.
For privacy, access, correction, export, deletion or security enquiries, email info@sinartech.ae. Do not send passwords, authentication codes or unnecessary identity documents. We verify identity and authority proportionately before disclosing data or acting on a request.
2. Our role and customer responsibilities
Your subscribing employer or organisation ordinarily controls its HR and employee records and decides the purposes of that processing. HR Copilot processes those records on documented lawful instructions under the customer DPA. Where a customer acts for another controller, the legal roles and authority must be established for that relationship.
HR Copilot separately determines limited processing needed for its own account administration, subscription/billing records, website operation, support and security. Relevant lawful grounds depend on the activity and applicable law, including necessary contractual or legal duties and consent where required. We do not treat acceptance of service terms as consent to all employee-data processing.
For records controlled by your employer, you may contact its HR/privacy contact directly or use info@sinartech.ae for assistance with routing. Customer notices and lawful instructions do not remove HR Copilot’s own duties.
3. Information collected and used
We process account identity and business contact details; organisation and user roles; support messages; audit and security records; subscription and billing status; and service diagnostics. Workspace content supplied by customers may include employee records, contact details, compensation, leave, expenses, documents, tasks, policies, knowledge and requests.
We process these records to provide and secure workspace features, authenticate users, support customers, maintain records, deliver notifications and comply with legal duties. Payment providers process payment details under their own terms. Public website analytics, when consented to, are described in our separate Analytics Notice.
Connected Google data is optional and requires authorisation, as detailed below.
4. Google Calendar connection
An authorised user can optionally connect Google Calendar using calendar.events and calendar.freebusy permissions and basic identity information. Google describes calendar.events as permission to view and edit events on all your calendars; calendar.freebusy permits availability access. These permission capabilities are broader than creating a single meeting.
The intended HR Copilot workflow checks availability for an explicitly requested time and creates an event, attendees and a Google Meet link only after booking confirmation. The reviewed feature does not enumerate unrelated event contents for that workflow. We process connected account identity, attendee addresses, meeting times, event identifiers and links for the enabled function. Google may send invitations and retain events. Disconnecting does not cancel events already created.
5. Gmail connection and selective import
When a user authorises Gmail read-only access, HR Copilot can display metadata (sender, subject, recipients and date) for up to 20 recent Inbox messages without initially downloading their bodies. The user may then explicitly import recent or individually selected messages into a private HR review queue. Imported message contents can include text from those messages. HR Copilot does not send, modify, archive or delete Gmail messages.
Importing previous messages is separate from ongoing synchronization. The user can opt in to monitor only NEW Inbox messages after activation. The intended workflow examines messages addressed directly to the connected user, filters obvious bulk messages and uses AI to identify potentially actionable work, such as requests, follow-ups, tasks or meeting enquiries. Only relevant messages are stored for review. No reply is sent and no task, HR request, employment decision or meeting is created automatically.
Manually imported Gmail messages are also sent to the configured AI processing provider for work-action classification, after an import confirmation explaining that selected message bodies will be stored and analysed. This is separate from the explicit opt-in for ongoing synchronization. Users can pause future synchronization without deleting imported history. AI suggestions may be incomplete or incorrect; authorised users must review messages before taking action.
6. AI use and Google Limited Use commitments
Workspace Assistant sends your question, authorised workspace overview and relevant retrieved knowledge or tool results to the configured OpenAI API. These may contain HR context relevant to the request. Use only necessary information and avoid unnecessary sensitive data. Human review is required before acting on suggestions or proposed actions.
Research Chat sends user-supplied questions and conversation text. It does not automatically inject the workspace overview or internal tool results. If web search is enabled, the provider can use search tools to answer the question. Do not type confidential employee details into a public-web research request.
Explicit Gmail imports and separately enabled ongoing classification can send relevant message contents to the configured AI provider for work-action classification as described in the Gmail section. Mailbox authorisation, import confirmation and ongoing-sync opt-in serve different functions; none establishes a lawful basis for every third party whose information may appear in a message.
HR Copilot’s use and transfer of Google Workspace API information will adhere to the Google API Services User Data Policy, including Limited Use. We do not sell Google data, use it for advertising or credit profiling, or retain, use or transfer it to develop, train or improve general-purpose or non-personalised AI models. Necessary user-facing provider transfers must meet the applicable consent and protection conditions.
Our personnel do not routinely review connected Google information. Human access is limited to specific user-authorised support, necessary security or legal purposes, or other access permitted by Google’s rules.
Provider retention is distinct from provider use for training. OpenAI’s published API controls describe default abuse-monitoring and Responses application-state retention, with configuration-dependent exceptions. Our actual account controls, provider agreements and compatible data-minimisation/deletion design require verification before final adoption. We do not promise zero provider retention.
7. Third-party processors and sharing
Service delivery uses Render for application hosting; Supabase for database, authentication and relevant storage; Resend for email delivery/receiving features; Stripe for billing/payments; and OpenAI API for enabled AI functions. Connected Google services and optional Google Analytics/Microsoft Clarity involve additional recipients according to the feature and choice used. The provider register distinguishes service processors from providers’ independent purposes and customer-authorised services.
Authorised organisation users can access records according to their roles. Provider access must be limited to the permitted service purpose and appropriate contractual duties. Disclosure may also occur to meet lawful obligations, respond to security threats or establish/defend legal claims, with applicable protections. We do not sell personal data to data brokers.
The provider register and DPA schedules identify current functions, known processing regions and evidence still needed. Provider legal entities, onward-processing/support locations and executed agreements must be verified before final activation.
8. Security and access controls
We use safeguards designed to protect personal information, including HTTPS connections, service-side handling of Google tokens, encrypted refresh tokens, role-based and organisation-scoped access controls and logged operations. No security measure guarantees that data will never be compromised.
Users can disconnect Google within HR Copilot or revoke access through their Google Account. Disconnecting prevents future use of the authorisation, but may not erase data previously imported into the HR Copilot workspace.
9. Storage, retention, deletion and disconnecting
Retention must be limited to the purposes and lawful instructions for the record. Active workspace records, employee documents, integration imports, access/acceptance evidence, security logs, billing records and backups have different purposes and deletion dependencies. The linked retention schedule describes those categories and the work needed to adopt tested time limits.
Fixed export, primary-deletion and backup-expiry periods have not yet been operationally verified or adopted for this proposal. Subscription cancellation, workspace removal, mailbox disconnection and individual deletion requests are different operations. Contact info@sinartech.ae to verify authority and agree the appropriate export/deletion handling; retaining a record requires a justified purpose and applicable legal basis.
Disconnecting Gmail stops future mailbox access but does not automatically delete prior imports. Signed-in users can delete their own unconverted imported Gmail copies in Integrations even after disconnection; ongoing synchronisation must first be paused. Converted HR Requests are organisation records, and legacy imports without verifiable attribution or backup copies require privacy support. Calendar disconnection does not remove created Google events.
Where retention is legally required, access and use must be limited to that purpose. Backup copies awaiting verified expiry must remain protected; applicable deletion instructions must be reapplied before restoration into normal service. Revoking Google authorisation does not erase copies already held by HR Copilot or provider records.
10. International processing
Customer information is processed outside the UAE. Configuration inspected on 24 October 2026 placed Production application hosting in Oregon, United States and the Production database in Frankfurt, Germany. Provider support, backups, email, billing, AI and optional analytics can involve other locations; the complete onward-processing inventory remains to be verified.
Applicable transfer safeguards must be assessed for the actual recipient, destination, processing and legal regime. A provider’s EU region, a general customer agreement or an organisation representative’s checkbox does not itself establish every required transfer mechanism or employee consent. Contact info@sinartech.ae for the relevant transfer information and customer-specific requirements. This proposal does not promise UAE-only residency or automatic adequacy.
11. Your rights and choices
Depending on applicable law and circumstances, rights can include information/access, correction, export/portability, deletion, restriction or objection, withdrawal of consent where processing relies on it, and safeguards concerning significant automated decisions. Exercise a right through info@sinartech.ae or your employer for employer-controlled HR records.
Requests require proportionate identity/authority verification, secure delivery and assessment of applicable exceptions and others’ rights. A request will be routed to the responsible controller where appropriate; HR Copilot assists with service processing and responds for its own controller activities. Statutory deadlines and complaint routes depend on the applicable regime. Individuals retain the right to approach the competent data-protection authority.
Customers can manage access; connected users can revoke Google permissions, pause Gmail synchronisation and use the disclosed import-deletion controls. Optional website analytics choices can be changed through Analytics preferences. No automated employment decision should replace legally required human review.
12. Updates and contact
Publication version: 2026-10-24-verified-1. This updated reference edition identifies the operator and its licensed address from the RAKEZ licence. An effective customer agreement requires separately recorded publication and valid customer acceptance; historical releases and actual acceptance receipts remain separately identifiable. Material new processing purposes will be disclosed before they begin, with consent where required.
Contact info@sinartech.ae for privacy and deletion requests. See the Terms, DPA, provider register, retention schedule and Analytics Notice for related information. These pages do not establish that every operational or contractual adoption requirement has been completed.