Privacy Policy.

Laidback Inc. ("Laidback", "we", "us") is a company incorporated in Delaware, USA. We build an AI recruiting coworker for in-house hiring teams. This policy covers data we handle through our website (laidback.so), the Laidback workspace app, and our Slack, Microsoft Teams and WhatsApp integrations.

When you set up a workspace and use Laidback, we collect:

• Workspace and account info: company name, teammate names, work emails, roles.
• Briefs and calibration: the roles you're hiring for, what "good" looks like, your feedback on candidates.
• Messages you send to me: everything you write to Laidback in Slack, Teams, WhatsApp or the web app.
• Approvals and edits: which drafts you approve, edit or reject, so I learn your bar.
• Connected-tool data: the specific ATS, calendar, mailbox, CRM and channel data you connect and give me permission to read or write.
• Product usage: which habits run, when, how they perform.
• Technical data: browser, device, IP address, basic diagnostics.

To help you source, Laidback processes publicly available professional information about candidates (name, headline, work history, education, skills, location, public profile photo). See our Candidate Privacy Notice for the full breakdown of how we handle that data.

• Run the Services: source candidates, draft messages, run habits, write summaries back to your tools
• Keep your workspace secure, authenticated and audit-logged
• Learns the bar and preferences inside your workspace, so drafts get sharper over time
• Support you when you email us and improve the product
• Send you product updates about the workspaces and features you use
• With your consent, show relevant ads and measure marketing on our website

• We do not sell your data
• We do not use your workspace data to train shared models used by other customers
• We do not read your connected Slack, Teams, WhatsApp, ATS or mailbox for anything other than running the Services you asked for
• We do not send outbound messages or write to your ATS without a human on your team approving it (default behaviour, configurable per habit)

• Contract: to provide the Services your workspace signed up for.
• Legitimate interests: keeping the Services secure, preventing abuse, improving reliability and quality, and processing publicly available professional information to help our customers hire.
• Consent: optional marketing cookies and marketing emails. You can withdraw at any time.
• Legal obligation: tax, accounting, responding to lawful requests.

We share limited data with vetted providers who help us run the Services:

• Google Cloud: hosting, storage, database and primary infrastructure. Each workspace is stored in its own isolated Google Cloud environment.
• Google Cloud & OpenAI: AI model hosting for drafting, summarizing and matching.
• Anthropic: AI model hosting for drafting, summarizing and matching.
• Slack, Microsoft, Meta (WhatsApp Business): the messaging platforms Laidback plugs into, only when you connect them.
• Professional data providers: for publicly available candidate professional information.
• Langfuse: AI observability and quality monitoring.
• PostHog: product analytics.
• Stripe: billing and payments.

Each provider is bound by a data processing agreement. The integration architecture we use is SOC 2 guarded. With your consent, we also use Google Analytics, Google Ads, Meta and LinkedIn on our marketing site. Manage those from our Cookie Policy.

• Workspace content (briefs, messages, calibration, connected-tool data): while your workspace is active. If you close it, we delete or anonymize within 30 days, except where we're legally required to keep something.
• Candidate professional information: up to 24 months from last active use, then deleted.
• Support tickets and billing records: as long as needed for legal and tax obligations.
• Product analytics: pseudonymized, retained up to 24 months.

Under GDPR, UK GDPR and similar laws you can:

• Access a copy of the data we hold about you.
• Correct anything that's wrong.
• Delete your data (subject to legal exceptions).
• Port your data in a machine-readable format.
• Object to processing based on legitimate interests.
• Restrict processing in certain cases.
• Withdraw consent at any time for consent-based processing.

To exercise any of these, email privacy@laidback.so. We'll reply within 30 days.

We host workspace data in Google Cloud regions in the United States and the European Union. EU/EEA workspace data is stored in EU/EEA regions by default. Where any data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses approved by the European Commission and equivalent UK safeguards.

If you're a California resident, you have the right to know what personal information we collect, request deletion, and opt out of "sharing" for cross-context behavioural advertising. We do not sell personal information. To opt out of sharing for ads, use our Cookie Policy. To exercise your California rights, email privacy@laidback.so.

Data is encrypted in transit and at rest. Access to production systems is limited to a small group of engineers using SSO and hardware keys. We keep audit logs of admin actions. Report a suspected vulnerability to security@laidback.so.

If a breach affects your personal data, we will notify the admin of your workspace and, where legally required, the relevant supervisory authority within 72 hours of becoming aware.

We may update this policy. If a change is material we'll update the "Last updated" date and email the admin of your workspace. Continuing to use Laidback after the change means you accept the new policy.

Questions about this policy or how we handle data? Email privacy@laidback.so. If you're not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.