Who we are and what this covers
HR PaperTrail is a product of Brick HR, Inc. (“Brick HR,” “we,” “us”). This policy explains how we handle personal information collected through our marketing website at www.hrpapertrail.com — including its forms, blog, product pages and the pages for our IncidentTrack and CageCount products (together, the “site”).
This policy does not cover the HR PaperTrail application. Customer workspaces (addresses like yourcompany.hrpapertrail.com) hold records that our customers — employers — put there. We process that information on our customers’ behalf under their agreements with us. If you have a question about records your employer keeps in HR PaperTrail, please contact your employer.
Information we collect
Information you give us
When you ask to get started, contact us, leave your email on the site or scan our trade-show QR code, we collect what you choose to enter. Depending on the form, that can include:
- your name, email address, phone number, company name and role;
- details about your operation — industry, approximate number of employees and locations, the tools you use today and the problems you want to solve;
- anything you write in a message to us.
On the sign-in page, we use the workspace name you type to send you to your company’s HR PaperTrail address.
Information collected automatically
Like most websites, our servers receive some information whenever you visit:
- Device and log data — your IP address, browser type and version (user agent), the pages you request, and the date and time of each request.
- Attribution data — the website that referred you, the first page you landed on, campaign tags in the link you followed (for example utm_source), and the page you were on when you submitted a form.
When you submit a form, we store your IP address, user agent and attribution data with your inquiry so we can understand how people find us and spot spam.
Cookies and similar technologies
We use a small number of first-party cookies. We do not use advertising cookies.
| Name | What it does | How long |
|---|---|---|
| hr-papertrail-session | Session cookie. Keeps the site working between pages, including multi-step forms. | About a day |
| XSRF-TOKEN | Security cookie that protects forms against cross-site request forgery. | Same as the session |
| hrpt_ft | First-touch attribution: remembers where your first visit came from (referrer, landing page, campaign tags). Not set if your browser sends Global Privacy Control. | 30 days |
| hrpt_lead | Encrypted reference to an inquiry you started, so you can finish it later. | 14 days |
| hrpt_workspace | Remembers the workspace name you last entered on the sign-in page. | Until it expires or you clear it |
| _ga, _ga_* | Google Analytics — only when we have analytics turned on (see below). | Up to 2 years |
We also keep a small flag in your browser’s session storage so the logo animation plays once per visit. You can block or delete cookies in your browser settings; the site still works, though forms may ask you to try again.
How we use information
- To respond to your request, set up an evaluation or account, and follow up with you about HR PaperTrail and our related products.
- To send you a confirmation when you submit a form, and to alert our team that you reached out.
- To understand which pages, campaigns and events bring people to us, and to improve the site.
- To keep the site secure — for example, to limit repeated submissions, filter spam and investigate abuse.
- To comply with law and to protect our rights and the rights of others.
We don’t add you to a newsletter just because you contacted us. If we ever email you something you didn’t ask for, you can tell us to stop and we will.
Who we share it with
We share personal information only with service providers that help us run the site and respond to you, and only for that purpose:
- Mailgun — delivers the emails the site sends, such as your confirmation and our internal alert.
- DigitalOcean — hosts the servers and database behind the site, which we manage with Laravel Forge.
- Google Workspace — our business email, where inquiry alerts and our replies to you live.
- Google Analytics — only when analytics is turned on (see the next section).
We may also disclose information if the law requires it, to protect the safety, rights or property of Brick HR, our customers or others, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to the information transferred.
We do not sell personal information, and we do not share it for cross-context behavioral advertising.
Analytics and advertising
We may use Google Analytics to understand how visitors use the site — pages viewed, how visitors arrived, and general device, browser and approximate location information. When it’s turned on, we configure it without Google’s advertising features, and we don’t load it for browsers that send a Global Privacy Control signal. You can also opt out with Google’s opt-out browser add-on.
We don’t run advertising or retargeting pixels, session-recording tools or third-party chat widgets on this site.
Do Not Track and Global Privacy Control
Global Privacy Control (GPC). We treat a GPC signal as a request to opt out: when your browser sends one, we don’t set the first-touch attribution cookie and we don’t load analytics.
Do Not Track (DNT). There is no common standard for how websites should respond to the older “Do Not Track” browser setting, so the site does not change its behavior when it receives one. We encourage you to use GPC, which we honor as described above.
How long we keep it
We keep inquiry records — what you submitted, with its attribution and technical details — for as long as we have a business relationship or a reasonable business need, generally no more than three years after our last contact with you, and then delete or de-identify them unless the law requires us to keep them longer. Server and error logs are kept for a short period, generally no more than 90 days. Cookies expire as described in the table above.
How we protect it
The site is served only over HTTPS. Access to inquiry records is limited to authorized members of our team. Cookies that identify an inquiry are encrypted. No method of transmission or storage is completely secure, so we can’t guarantee absolute security — but we work to protect your information and will notify you if the law requires it after a breach.
Your choices and rights
- Access, correction and deletion. You can ask us what personal information we hold about you, ask us to correct it, or ask us to delete it.
- Stop hearing from us. Reply to any email from us or use our contact form and we’ll stop following up.
- Cookies and signals. Block or clear cookies in your browser, or turn on Global Privacy Control.
To make a request, contact us. We may need to confirm your identity — usually by replying from the email address you gave us — before we act on a request. We won’t treat you differently for making one.
California privacy rights
We’re based in California and write this policy with the California Online Privacy Protection Act (CalOPPA) in mind: it lists the categories of information we collect, the kinds of third parties we share it with, how we respond to Do Not Track signals, and how we’ll tell you about changes.
Shine the Light. We do not share personal information with third parties for their own direct marketing purposes.
CCPA. The California Consumer Privacy Act applies only to businesses that meet certain thresholds. Whether or not it applies to us, California residents can use the access, correction and deletion requests described above, and we won’t discriminate against you for using them. As noted, we don’t sell or share personal information for cross-context behavioral advertising.
Children
This site is for businesses. It is not directed to children under 16, and we don’t knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we’ll delete it.
Other websites
The site links to other websites, including our customers’ HR PaperTrail workspaces and third-party resources mentioned in our articles. Their privacy practices are their own; please read their policies.
Changes to this policy
We may update this policy as the site or the law changes. We’ll post the new version here and update the effective date at the top. If we make a material change to how we use personal information you’ve already given us, we’ll make that clear on this page before the change takes effect.
Contact us
Questions, requests or concerns about privacy? Send us a message through our contact form and a real person at Brick HR, Inc. will get back to you.