Legal
Humentra — Privacy Policy
This Privacy Policy explains how Aslase ("Humentra", "we", "us") handles personal data when you visit humentra.ai, contact us, book a demo, or use the Humentra AI-native HCM platform (the "Platform").
1. Who We Are and What This Policy Covers
Humentra acts in two roles.
As a controller for data about website visitors, prospects, demo requests, newsletter subscribers, job applicants to Humentra itself, and customer account administrators.
As a processor (service provider) for HR data our enterprise and public-sector customers upload or generate in the Platform, such as candidate, employee, and workforce data. In that case the customer organisation is the controller, its own privacy notice applies, and we process the data only on its documented instructions under a Data Processing Agreement (DPA).
If you are a candidate or employee of one of our customers, please contact that organisation first about your data. We will assist them in responding to you.
2. Information We Collect
| Examples | Source | |
|---|---|---|
| Contact and demo requests | Name, work email, phone, company, job title, country, message | You, via forms or email |
| Account data | Login credentials, user role, language preference, SSO identifiers | You or your organisation's administrator |
| Customer HR data (processor role) | CVs, applications, assessment responses including text, speech and video, skills, career goals, succession and performance information, referrals, onboarding documents, tasks | Customer organisations, candidates and employees, integrated systems such as Workday, SAP SuccessFactors, Oracle HCM, Microsoft 365, and LinkedIn |
| AI interaction data | Prompts, chats with AI agents, AI-generated summaries, scores, and recommendations | Generated through Platform use |
| Usage and device data | IP address, browser, device type, pages viewed, timestamps, logs, error reports | Automatically, via cookies and similar technologies |
| Business and billing data | Billing contact, invoices, contract details | Customer organisations |
We do not intentionally collect special-category data (such as health, religion, or biometric data). Some customers may configure the Platform to process such data, or it may appear in uploaded documents — customers are responsible for having a lawful basis for it. Where video or speech assessments are used, we do not use them for biometric identification.
3. How We Use Information and Our Legal Bases
| Legal basis (where GDPR-style laws apply) | |
|---|---|
| Provide, host, secure and support the Platform | Performance of contract; legitimate interests |
| Respond to enquiries and arrange demos | Steps before entering a contract; legitimate interests |
| Send product updates and marketing to business contacts | Consent where required; otherwise legitimate interests, with opt-out in every message |
| Monitor, debug and improve the website and Platform | Legitimate interests |
| Prevent fraud, abuse and security incidents | Legitimate interests; legal obligation |
| Billing, accounting and tax | Performance of contract; legal obligation |
| Comply with law and enforce our terms | Legal obligation; legitimate interests |
For customer HR data, we act only on the customer's instructions. The customer determines the legal basis for recruiting, assessment, development, succession, and mobility processing.
4. AI Processing and Automated Decision-Making
Humentra uses AI to screen and match candidates, run assessments, map skills, suggest development paths, match employees to internal opportunities, flag succession risk, and power AI agents.
Human oversight. AI produces recommendations, rankings, summaries, matches, and checks. Authorised people at the customer organisation remain responsible for hiring, promotion, succession, and other significant decisions. The Platform is not designed to make decisions with legal or similarly significant effects without human review.
Configurable controls. Customers decide where AI is used, what it may automate, and where human review is required.
No training on customer data. We do not use customer HR data to train general-purpose AI models shared across customers. Any product improvement using customer data happens only in aggregated or de-identified form, or with the customer’s written agreement.
Third-party AI models. Some AI features use models provided by sub-processors. They process data only to return results to us and are contractually barred from using it to train their own models.
Fairness. We test AI features for accuracy and bias and document their intended use. Customers are responsible for complying with employment, anti-discrimination, and AI laws that apply to their use, such as the EU AI Act for high-risk employment uses and New York City Local Law 144 for automated employment decision tools.
Candidates and employees who want an explanation of an AI-supported outcome, or a human review, should contact the employer or recruiting organisation.
5. Sharing and International Transfers
We do not sell personal data or share it for cross-context behavioural advertising. We share it only with:
- Sub-processors that help us run the service, such as cloud hosting, AI model providers, email, analytics, and support tools.
- Integrated systems the customer chooses to connect, such as Workday, SAP SuccessFactors, Oracle HCM, Microsoft 365, Teams, Azure, Dynamics 365, and LinkedIn. Their own terms govern data held in those systems.
- Professional advisers, auditors, and insurers under confidentiality duties.
- Authorities where required by law, or to protect rights, safety, and security.
- A successor in a merger, acquisition, or asset sale, subject to this policy.
Customers may be offered data residency options. When data moves to a country without equivalent protection, we use safeguards such as the EU Standard Contractual Clauses, the UK Addendum, or mechanisms recognised under UAE, Saudi Arabian, and other applicable laws.
6. Retention and Security
| Retention | |
|---|---|
| Customer HR data | As set by the customer; deleted or returned within 30 days after contract end, except backups that expire within 90 days |
| Account data | Life of the account plus 12 months |
| Prospect and demo data | 24 months after last contact, or until you object |
| Usage logs | 12 months |
| Billing records | As required by tax law, typically 5–10 years |
We protect data with encryption in transit and at rest, role-based access, SSO and multi-factor authentication, logging and monitoring, staff confidentiality and training, and regular security testing. No system is perfectly secure. If a breach affects your data, we will notify the customer and, where required, authorities and affected individuals within the timeframes set by law.
7. Your Rights
Depending on where you live, including under the EU and UK GDPR, the UAE PDPL, the Saudi PDPL, and US state laws such as the CCPA, you may have the right to access, correct, delete, or port your data; restrict or object to processing; withdraw consent; object to direct marketing; and not be subject to decisions based solely on automated processing.
Email us, and we respond within the time the law requires, typically 30 days, and may need to verify your identity. Requests about customer HR data are passed to the relevant customer. You may also complain to your local data protection authority.
8. Cookies
We use strictly necessary cookies to run the site and Platform, and, with your consent where required, analytics and marketing cookies. You can manage preferences through our cookie banner or your browser settings.
9. Children
The website and Platform are for businesses and adults. We do not knowingly collect data from children under 16. Customers that recruit younger workers or interns are responsible for any extra safeguards required.
10. Changes
We may update this policy. We will post the new version with its effective date and notify customers of material changes in advance.
11. Contact Us
If you have any questions, concerns, or require clarification, please contact us at info@aslase.com. Our team will be happy to assist you with your inquiries.