Privacy Policy
Version 2.4 · Effective: 24 September 2026
1. Who we are
MadyHR.ai is operated by MAKZEE LTD, a company registered in Scotland under company number SC877764, with its registered office at 383 High Street, Cowdenbeath, KY4 9QW, United Kingdom.
We are registered with the Information Commissioner's Office under registration reference ZC248854.
Contact for data protection matters: support@madyhr.ai
We have not appointed a Data Protection Officer. We are not required to appoint one, and we have documented that assessment. Data protection responsibility sits with the company director.
2. The two roles we hold
This policy covers two different relationships, and the difference matters.
We are a data controller for information about the businesses that buy MadyHR and the people who deal with us directly: account holders, billing contacts, people who email our support address, people who use the chat on our public website, and visitors to madyhr.ai. Sections 3 to 9 cover this.
We are a data processor for information about your employees and job candidates that you enter into, or upload to, the MadyHR platform. In that relationship, your employer is the data controller and decides why the data is held and how long for. We act on their documented instructions. Section 10 covers this, and the detail is in our Data Processing Agreement.
If you are an employee whose employer uses MadyHR, your employer is responsible for your data and is the right place to start. See section 10.
3. What we collect as a controller
| Category | Examples | Where it comes from |
|---|---|---|
| Account data | Company name, admin name, work email, password hash | You, at sign-up |
| Billing data | Plan, payment status, invoice history, billing contact | You and Stripe |
| Support data | Emails to support@madyhr.ai and their contents | You |
| Website chat | Questions you type into the public chat on madyhr.ai | You |
| Technical data | IP address, browser type, pages visited, timestamps, error logs | Automatically |
| Marketing data | Email address, download records for guides and checklists, unsubscribe status | You |
| Advertising source | If you accepted marketing cookies: the advert or link your first visit came from (campaign tags and click identifiers), the first page you saw and the website that referred you, recorded with your account when you sign up | Your browser, with your consent |
We do not collect payment card details. Card payments are handled by Stripe (see section 7).
4. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account | Performance of a contract |
| Providing the MadyHR service and support | Performance of a contract |
| Billing, invoicing and collecting payment | Performance of a contract |
| Keeping accounting and tax records | Legal obligation |
| Security monitoring, fraud prevention, server logs | Legitimate interests: keeping the service and our customers' data secure |
| Service emails about your account, outages or changes | Performance of a contract |
| Marketing emails to account holders and customers about MadyHR | Legitimate interests, with an unsubscribe link in every message |
| Marketing emails to people who asked for our guides or resources | Consent |
| Responding to the public website chat | Legitimate interests: answering questions from prospective customers |
| Measuring our advertising with the Meta Pixel, the Reddit Pixel and the Google Ads tag, and telling Meta about a sign-up or payment from our server | Consent, given or refused through the cookie banner |
| Recording which advert or link led to your account | Consent, given or refused through the cookie banner |
Where we rely on legitimate interests, we have assessed that our interest does not override your rights, and we have documented that assessment. You can object at any time (section 8).
5. How long we keep it
| Data | Retention |
|---|---|
| Account data | For as long as your account is open, then 30 days after closure |
| Billing and accounting records | 6 years from the end of the relevant financial year |
| Support correspondence | 2 years from the last message in the thread |
| Website chat questions | Not stored by us. Each question is sent to our AI provider, Anthropic, to be answered, and Anthropic deletes API inputs and outputs within 30 days by default. See our AI Policy |
| Server and access logs | 90 days |
| Marketing contact data | Until you unsubscribe, then we keep a suppression record so we do not contact you again |
| Advertising source of an account | With the account data: for as long as your account is open, then 30 days after closure. Before you sign up, the record in your own browser expires after 30 days |
6. Where your data is held
MadyHR's application and database run in the European Union. Our infrastructure provider is Railway, and our production database, cache and application services are deployed in their EU West region in Amsterdam, Netherlands. Backups are held in the same region.
The United Kingdom recognises the European Economic Area as providing an adequate level of data protection, so no additional transfer safeguards are required for this hosting.
Some of our suppliers are based outside the UK and EEA. Where personal data is transferred to them, we rely on an appropriate safeguard: the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the supplier's certification under the UK Extension to the EU-US Data Privacy Framework. Our current suppliers and their locations are listed on our Subprocessors page.
7. Who we share it with
We do not sell personal data. We never share employee or candidate data with advertisers. The only information about customers that an advertising company receives is described below under Meta, and only with consent.
We use a small number of suppliers who process data on our behalf. They are listed, with their purpose and location, on our Subprocessors page. Each is bound by a written contract that restricts what they may do with the data.
Stripe is different. Stripe acts as an independent data controller for payment card data, not as our supplier. When you pay for MadyHR, your card details go to Stripe and are governed by Stripe's own privacy policy. We never see or store your full card number.
Meta receives website measurement information only if you accept marketing cookies. Meta Platforms Ireland Limited acts as a separate controller for what it does with that information. If you accepted, then when you create an account or pay for a subscription we also tell Meta about it directly from our server (Meta's "Conversions API"), so an advert is credited even if your browser blocked the pixel. That message carries your email address only in scrambled form (a one-way SHA-256 hash, which Meta can match to an account it already knows but cannot turn back into the address), the IP address and browser you used, and for a payment the amount. It never carries your name or anything from your account's HR records. Section 9 and our Cookie Policy explain the rest.
Reddit receives the same kind of website measurement information, on the same terms: only if you accept marketing cookies. Reddit acts as a separate controller for what it does with that information and may process it in the United States. Section 9 and our Cookie Policy explain exactly what it receives.
Google receives website measurement information through the Google Ads tag, on the same terms: only if you accept marketing cookies. Google Ireland Limited acts as a separate controller for what it does with that information. It is told when an account is created or a subscription is paid for, with no email address or name. Section 9 and our Cookie Policy explain exactly what it receives.
OpenFreeMap (openfreemap.org) supplies the map images on our sponsor licence register pages. Like any site your browser loads content from, it receives your IP address and the standard information a browser sends with a request. It sets no cookies, and we send it nothing about you.
We may also disclose data where we are legally required to, or to establish or defend legal claims.
8. Your rights
If we are the controller of your data, you have the right to:
- ask for a copy of the personal data we hold about you
- have inaccurate data corrected
- have your data erased, where we no longer have a reason to keep it
- restrict how we use your data while a dispute is resolved
- object to processing we carry out on the basis of legitimate interests
- receive your data in a portable format
- withdraw consent, where we rely on it, at any time
Email support@madyhr.ai and we will respond within one month. There is no charge.
You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first, but you do not have to.
9. Cookies
We use cookies that are strictly necessary to run the service, such as keeping you logged in. These do not need your consent.
The only other cookies are those of the Meta Pixel, the Reddit Pixel and the Google Ads tag, which measure how well our advertising works. They are set only after you agree; if you decline or never answer, none of them is ever loaded. Inside your account we do not report the pages you visit to them; we report only a completed payment and, to Meta, the start of a checkout. We never pass any of them names or employee records, and the only email address that leaves us is the hashed one sent to Meta, as described in section 7. You can change your choice at any time using the Cookie settings link in the footer. Details are in our Cookie Policy.
10. Employee and candidate data: our role as processor
If your employer uses MadyHR, we hold information about you on their behalf. This can include your name and contact details, job title and start date, salary, right to work evidence, sponsorship records, sickness records, attendance, leave, documents such as contracts and certificates, training and course records, and bank details where your employer uses MadyHR for that purpose.
Policies and contracts your employer asks you to accept. If your employer sends you a document to read and accept or sign in MadyHR, we record, on their behalf, when you opened it and when you accepted it, which version of the document it was, the words you confirmed, the name you typed if you signed, and the IP address and browser or device you used. If you accept on paper, your employer records the date and uploads a scan of the signed copy. Any question you ask about the document, and the reply, is kept with it. This record exists so your employer can show that you received the document. It cannot be edited afterwards, and it is kept for as long as your employer keeps your other records.
Your employer decides what is held, why, and for how long. We do not use this information for our own purposes. We do not use it to train AI models. We do not sell it or share it with anyone except the suppliers listed on our Subprocessors page.
If you want to see, correct or delete your data, contact your employer, not us. They are the controller and they have the tools inside MadyHR to deal with your request. If you contact us directly, we will pass your request to your employer and help them respond, but we cannot act on it ourselves.
AI features
MadyHR includes AI features: the "Ask Mady" assistant, document and letter drafting, and drafting the wording of compliance reminders. Our AI Policy describes each one.
These run on the Anthropic Claude API, under Anthropic's Commercial Terms and a written data processing agreement. Under those terms, data sent through the API is not used to train Anthropic's models, and Anthropic deletes API inputs and outputs from its systems within 30 days by default.
We limit what is sent. National Insurance numbers and bank account details are never sent to the AI service.
Anthropic processes data in the United States. This transfer is covered by an appropriate safeguard, set out on our Subprocessors page.
Security
We protect employee data with access controls that keep each employer's data separate from every other employer's, role-based permissions inside each account, encryption in transit and at rest, encryption of particularly sensitive fields, audit logging of access to records, and time-limited links for document downloads so that files are never available at permanent public addresses.
Access to production systems is restricted to authorised personnel who need it to operate and support the service, and who are bound by confidentiality obligations.
11. Changes to this policy
We will update this page when our processing changes, and we will change the version number and date at the top. If a change materially affects you, we will tell you by email.
12. Contact
MAKZEE LTD
383 High Street, Cowdenbeath, KY4 9QW, United Kingdom
support@madyhr.ai
ICO registration: ZC248854