Privacy Policy

StackHR is a people, payroll, and spend management platform built for African SMEs. This Privacy Policy explains how we collect, use, and protect personal data when you use our service. “Personal data” means any information that identifies or could reasonably identify a person.

By creating a StackHR account, you confirm that you have read and understood this policy. If you are an HR administrator using StackHR on behalf of your organisation, you are responsible for ensuring that your employees are aware their data is processed through this service.

When you use StackHR, we collect the following categories of personal data:

• Employee profile data: names, contact details, job titles, employment dates, and documents submitted during onboarding.
• Payroll and statutory data: bank account details, National Identification Numbers (NIN), Bank Verification Numbers (BVN), and salary information. These are collected only where required for payroll processing and compliance with Nigerian labour and tax regulations.
• Expense and spend data: receipts, claim amounts, budget allocations, and approval records.
• Account data: email addresses, organisation names, and credentials for StackHR accounts.
• Usage data: anonymised product usage logs, session information, and error reports used to improve the service.

We collect and process personal data for the following purposes:

• To operate your payroll, including calculation and disbursement of salaries and statutory deductions.
• To support compliance with Nigerian tax obligations (PAYE) and labour regulations.
• To provide leave management, expense approval, and spend tracking features.
• To communicate with account holders about the service, updates, and support.
• To improve and debug the product using anonymised usage data.

We do not process personal data for purposes beyond those listed here without your knowledge.

We take the following measures to protect personal data:

• Sensitive fields such as NIN and BVN are encrypted in transit and at rest.
• Access controls limit which staff and systems can read or modify your data.
• Each organisation's data is logically isolated from other organisations. Your data is not accessible to other customers on the platform.
• All connections to StackHR are secured using TLS (transport layer security).

No system is perfectly secure. We encourage you to use strong, unique passwords for your StackHR account and to contact us immediately if you suspect unauthorised access.

We do not sell personal data. We share data only with third parties that are necessary to operate the service:

• Payment processors, including Paystack, to initiate salary disbursements and process subscription payments.
• Cloud infrastructure providers who host the service and store data on our behalf, under data processing agreements.

We do not share your data with advertisers, data brokers, or unrelated third parties.

By default, customer data is stored within Africa. We do not transfer personal data outside the region unless necessary for infrastructure operations and in compliance with applicable data protection law.

Under Nigeria's National Data Protection Act 2023, you have the right to:

• Access a copy of personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request deletion of your data, subject to legal and operational constraints.
• Object to or restrict certain types of processing.

To exercise any of these rights, contact us at privacy@stackhr.app. We will respond within a reasonable time period.

For privacy questions or concerns, reach us at privacy@stackhr.app or hello@stackhr.app. You may also review our Data Processing Overview and Compliance Overview.