FirstHR Privacy Policy

Effective date: September 30, 2026

This Privacy Policy explains how Helmeton Inc., a Delaware corporation doing business as FirstHR ("FirstHR," "we," "us" or "our"), collects, uses, discloses and protects personal information in connection with:

• our website, firsthr.app (the "Website");
• our human resources software, including the my.firsthr.app application (the "Service"); and
• our communications with you.

This Privacy Policy is a notice, not a contract. Our relationship with business customers is governed by our Terms of Service.

The Website and the Service are designed for businesses in the United States.

1. Our two roles

We decide how to use some information. We are responsible for personal information we collect for our own purposes:

• information about visitors to our Website;
• information about the people who sign up for and administer customer accounts;
• billing information;
• information in your communications with us; and
• information about how the Service is used and kept secure.

We process other information on behalf of our customers. Our business customers use the Service to manage information about their employees, contractors and other individuals ("End Users"). We process that information ("Customer Data") as a service provider, or processor, on behalf of the customer, which is the employer. The employer decides what information to collect, why, and for how long. Its own privacy notices and practices govern that information.

If you are an End User: please direct any questions or requests about your information to your employer. If you contact us, we will refer you to your employer and support it as our agreement and the law require.

2. Information we collect

2.1 Information you give us

• Account information: your name, work email address and password. Our authentication provider stores the password in hashed form; we cannot see it. We also collect your role and company details, such as the company name, industry, size, and country, state and city.
• Sign-up survey answers: your goals, the tools you use today and how you heard about us.
• Billing information: our payment processor, Stripe, collects and processes payment card details. We do not store full card numbers. We receive limited information, such as the card brand, the last four digits and the payment status.
• Communications: support requests, feedback and survey responses, and any other information you choose to send us.

2.2 Information collected automatically

• Device and usage information: IP address, browser type, device type, operating system, pages and features used, dates and times, referring pages, and error and diagnostic data.
• Approximate location: the city, region and country we derive from your IP address through an IP geolocation service. We use it for security alerts about unusual sign-ins, and to record where terms were accepted or a document was signed. We do not collect precise geolocation.
• Records of consent and signatures: when you accept our terms, we record the date, time, IP address, approximate location, browser information and the version accepted. When a document is signed through the Service, we record the signer, time, IP address and approximate location on the signature certificate.
• Cookies and similar technologies: see Section 6.

2.3 Information from third parties

• Sign-in providers: if you sign up or sign in with Google or Microsoft, we receive your name, email address and account identifier from that provider.
• Security and fraud prevention services: signals about whether traffic is automated or abusive.
• Advertising and analytics partners: information about your interactions with our ads and Website, as described in Section 6.

2.4 Customer Data we process for our customers

Depending on how a customer uses the Service, Customer Data may include:

• Identifiers and contact details: names, email addresses, phone numbers, addresses, emergency contacts and profile photos.
• Employment information: job title, department, manager, employment type, work location, time zone, schedule, hire, probation and termination dates and reasons, and history of changes.
• Government identifiers and work authorization: Social Security numbers, work authorization status and status fields for Form I-9 and background checks that the customer enters. It also includes identity and other documents the customer or End User uploads.
• Demographic information: gender, race or ethnicity, veteran status and disability status. A customer may record these voluntarily for equal employment opportunity reporting.
• Date of birth, and health-related information a customer chooses to record, such as allergies and dietary restrictions.
• Documents, e-signatures and records: offer letters, policies, agreements, certificates and other files, together with signature records.
• Onboarding, training and task records: assigned items, completion status, course progress and signed acknowledgments.
• Notes that the customer's administrators add.

The Service does not collect pay rates or compensation. The customer decides which of these fields to use.

3. How we use information

We use the personal information we control to:

• provide, operate, maintain and support the Website and the Service;
• create and administer accounts, authenticate users and process payments;
• send transactional messages, such as invitations, notifications, security alerts, billing notices and messages that help new customers get started;
• detect, prevent and respond to fraud, abuse, security incidents and violations of our terms, including through sign-in alerts and bot detection;
• understand how the Website and the Service are used, and improve them;
• measure and improve our marketing and advertising, as described in Section 6;
• send marketing communications, where permitted, as described in Section 7;
• comply with law and legal process, and establish, exercise or defend legal claims; and
• for any other purpose we disclose when we collect the information, or with your consent.

We use sensitive personal information only to provide the Website and the Service, to keep them secure, and for other purposes the law permits. We do not use it to infer characteristics about individuals.

We use Customer Data only to provide, secure, support and maintain the Service for the customer, on the customer's instructions and as permitted by our agreement and applicable law. We do not sell Customer Data. We do not use it for advertising, and we do not use it to train artificial intelligence models. We may create aggregated or de-identified information that does not identify any customer or individual, and use it to operate and improve our business. We maintain it in de-identified form, and we will not attempt to re-identify it except as the law permits.

4. AI features

Some features of the Service use third-party artificial intelligence providers, such as OpenAI and Anthropic (Claude), to generate suggestions, outlines and document analyses. When a user of a customer's account uses one of these features, the Service sends the relevant inputs to the provider to generate the output. These inputs can include:

• the text of a document being reviewed, up to a length limit;
• plan or course details; and
• company information such as industry, location and size.

Each provider processes these inputs to return the output to us, under its terms for business API customers. Customers decide whether to use AI features, and they should not include information in a document they do not want processed in this way.

5. How we disclose information

We do not sell personal information for money. We disclose personal information as follows:

Service providers. We disclose information to providers that process it on our behalf to operate the Website and the Service. Our current providers are:

We may add or replace providers. We will update this list when we do.

Within a customer's account. Customer Data is visible to the customer's authorized administrators, and to End Users as the Service is designed. For example, an employee sees their own documents and tasks.

Advertising partners. If we use the advertising technologies described in Section 6, our advertising partners, such as Meta and LinkedIn, may collect information about your use of the Website. Some state laws treat this as "sharing" personal information for cross-context behavioral advertising, or as "targeted advertising." See Section 6.3 for your choices.

Legal and safety. We may disclose information to comply with law, legal process or a government request, or to enforce our terms. We may also disclose it to protect the rights, property or safety of FirstHR, our customers, End Users or others, and to detect or prevent fraud or security issues.

Business transfers. Information may be transferred as part of a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, or during due diligence for one. It remains subject to the promises in this Privacy Policy, unless you are notified otherwise.

With your consent or at your direction.

6. Cookies, analytics and advertising

6.1 What we use

• Essential technologies keep you signed in, protect the Service and make it work. The Service stores session and preference information in your browser for this purpose.
• Analytics. Our Website uses Google Tag Manager and Google Analytics to understand how visitors use the Website. Google may set cookies and collect information about your visit, including your IP address and pages viewed. You can learn how Google uses this information at policies.google.com/technologies/partner-sites, and you can opt out with the Google Analytics opt-out browser add-on.
• Advertising. We may use advertising technologies on the Website, such as the Meta Pixel and the LinkedIn Insight Tag, to measure our ads and to show our ads to people who have visited the Website. These partners may set cookies and collect information about your visit and your interactions with our ads.
• Email. Our emails may contain technologies that tell us whether an email was opened or a link was clicked. We use them to deliver and improve our communications.

6.2 Your controls

You can block or delete cookies in your browser settings. If you block some cookies, parts of the Website or the Service may not work. You can also manage ad preferences in your Google, Meta and LinkedIn account settings.

6.3 Opting out of targeted advertising

If a state privacy law gives you the right to opt out of the "sale" or "sharing" of personal information, or of targeted advertising, you can exercise it in two ways:

• email us as described in Section 16; or
• where applicable law requires us to honor it, send an opt-out preference signal, such as Global Privacy Control, from your browser.

Our Website does not respond to "Do Not Track" signals, because no standard exists for them.

7. Communications

We send transactional and account messages as part of the Service. You cannot opt out of them while you have an account, except where the Service provides a setting.

If we send marketing emails, each one will include an unsubscribe link, and we will honor your request as the law requires. You will keep receiving transactional messages after you unsubscribe.

8. Retention

We keep personal information we control for as long as the account is active and as needed afterward to:

• comply with our legal, tax and accounting obligations;
• resolve disputes;
• enforce our agreements; and
• maintain security and prevent fraud.

We keep Customer Data for as long as the customer maintains its account, or as our agreement with the customer provides. After an account ends, we may delete Customer Data under our agreement with the customer. A customer may ask us to delete its Customer Data by writing to us. We will do so within a reasonable time, unless the law requires us to keep it. Deleted information may remain in backups until they are overwritten in the ordinary course.

9. Security

We use administrative, technical and physical safeguards designed to protect personal information. These include:

• encryption in transit;
• encryption at rest provided by our hosting and database providers;
• access controls that keep each customer's data separate;
• role-based permissions;
• optional two-factor authentication; and
• alerts about unusual sign-ins.

No method of transmission or storage is completely secure, and we cannot guarantee the security of any information. Customers are responsible for their account settings and for the access they give their users.

10. Where information is stored

We are based in the United States. Our primary hosting and database infrastructure are located in the United States. Some service providers, such as content delivery networks and email, analytics and AI providers, may process information in other locations as part of their services.

The Website and the Service are designed for use in the United States. If you use them from another country, your information will be transferred to and processed in the United States. Customers that need data processing terms under the EU or UK General Data Protection Regulation must contact us before they process personal data subject to those laws.

11. Your rights and choices

Account holders can review and update much of their account information in the Service.

State privacy rights. Depending on where you live, and if the law applies to us, you may have the right to:

• know or access the personal information we hold about you;
• correct it;
• delete it;
• obtain a copy of it in a portable format;
• opt out of the sale or sharing of personal information, or of targeted advertising; and
• appeal our decision about your request.

These rights have exceptions. To make a request, contact us as described in Section 16. We will verify your request using information associated with you, and we may decline requests we cannot verify. You may use an authorized agent where the law permits. We will require proof of the agent's authority, and may ask you to verify your identity directly. We will not discriminate against you for exercising your rights. If we deny your request and your state provides a right to appeal, you may appeal by replying to our decision with "Appeal" in the subject line.

End Users should send requests about Customer Data to their employer, which controls that information (see Section 1).

12. Children

The Website and the Service are intended for businesses and are not directed to children. Account holders must be at least 18 years old. We do not knowingly collect personal information directly from children under 13. A customer may lawfully employ minors and process information about them in the Service as Customer Data, and it is responsible for doing so lawfully. If you believe a child under 13 has given us personal information directly, please contact us, and we will take appropriate steps.

13. Health information

The Service is a human resources tool. It is not designed to store protected health information about patients or clients of health care providers, and customers may not use it for that purpose. Health-related information that an employer records about its own employees, such as allergies, is Customer Data that the employer controls.

14. Third-party sites and services

The Website and the Service link to, or work with, third-party sites and services, such as sign-in providers and payment pages. Their own privacy policies govern the information they collect.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date. If we make material changes, we will provide additional notice, such as an email to account administrators or a notice in the Service. Where the law requires your consent to a change, we will ask for it.

16. Contact us

Helmeton Inc., d/b/a FirstHR Email: support@firsthr.app. Please use the subject line "Privacy request" for requests under Section 11.