HR guidance for employers.

At a glance

• We collect your work email address, the questions you ask, and the answers Hamilton gives.
• Your employer cannot see your questions or your answers. They see counts only. See §6.
• Hamilton never asks for your location. You choose your state from a list.
• Hamilton sends you no push notifications — news and notices wait in the app until you open them. The only notification it ever posts is the playback controls while you are listening to the podcast, and you start that.
• Voice input is transcribed on your device. No audio recording is ever uploaded or stored.
• We delete conversations 12 months after they were last used, and sooner when you leave. See §8.
• We do not sell your information, and we do not use it for advertising.

What we collect

Your account. Your email address, used to send the one-time code you sign in with, and the employer code that links you to your organisation. We also store your role (member or administrator) and the US state you have selected as your default jurisdiction.

Your questions and answers. The questions you ask Hamilton and the answers it gives, together with the topic Hamilton files them under and the state the question related to. These form your history in the app, and they are the record of what Hamilton told you and when.

Questions are stored as you wrote them. If a question contains explicit language, Hamilton hides it behind a filter when displaying it, but stores what was actually written — in HR matters the exact words are often the substance of the issue. Speech dictated with the microphone is filtered by your device before Hamilton receives it.

Your organisation's policies. If your employer provides Hamilton with their HR policies, that text is stored and used to answer questions for that employer only.

Diagnostics. Crash and performance information, so we can find and fix faults.

Security logs. Hamilton has a separate sign-in door used only by app-store reviewers, and it is open only while a submission is under review. While it is open, failed attempts against it are recorded with the network address they came from, so an attack on it can be seen. Ordinary sign-in does not use that door and is not logged this way.

Why we use it

• To answer your HR questions, using current law and your organisation's own policies.
• To sign you in and keep you signed in.
• To show you your own history and organise it by topic.
• To tell you when guidance you were previously given may be out of date.
• To give your employer the counts described in §6.
• To keep the service secure and working.

We do not sell personal information, and we do not use it for advertising or profiling.

Who we share it with

We use a small number of service providers, who process information on our behalf under contract and are not permitted to use it for their own purposes:

OpenAI processes your question to produce and verify an answer. It does so on our behalf under a data-processing agreement, and your questions are not used to train their models.

The podcast in the news tab streams directly from its host rather than through us, so playing an episode reveals your IP address and that episode to them, the same as visiting any website. Nothing identifying you as a Hamilton user is sent with it, and not playing an episode sends nothing at all.

We may also disclose information where the law requires it, or to establish or defend legal claims.

What we do not collect

• Your location. Hamilton never asks for it and cannot access it. The app contains no location feature at all. You tell us which state applies by choosing it from a list, and we store that choice so you do not have to make it again — the same as any other setting.
• Push tokens. Hamilton sends no push notifications and stores no device identifier for them. Nothing is pushed to you; news and notices wait in the app until you open that tab.
  
  On Android the app does ask for notification permission, for one purpose: the play, pause and skip controls that appear on your lock screen while you are listening to the podcast. That notification carries the episode you chose and nothing else, it appears only because you pressed play, and declining the permission costs you those controls and nothing more.
• Audio. Speech is converted to text by your own device. No recording is made, uploaded or kept.
• Contacts, photos, files, or advertising identifiers. Hamilton never asks for these.

What your employer can see

Your employer's administrators see counts only:

• how many seats are in use and how many people are active,
• how many conversations and questions there have been,
• which states questions related to — and a state is named only once at least five different people have asked from it. Below that it is counted into "Other", so a single person's state cannot be picked out.

If your employer's organisation uses Hamilton's policy review, their administrators can also see where their own written policy provides less than the law requires. That is a finding about their document, not about any person: it does not show who asked anything, or that anyone asked at all.

They cannot see your questions, the answers you received, or which questions came from you. This is enforced by the system itself, not by policy alone: the functions behind the administrator's screen do not return question text, answer text, or the identity of the person who asked, and the database prevents one person's conversations from being read by anyone else.

We designed it this way on purpose. People use Hamilton to ask about harassment, discrimination, medical leave and pay — often about the very organisation whose administrators would be looking at that screen.

Your employer's administrators can see who holds a seat, and can release a seat, which ends that person's access.

What we can see

We operate the service, so our own staff can see the same per-company counts described in §6 — seats, active people, conversations, questions, and the same five-person floor on naming a state — across the employers who use Hamilton. We use this to run the service, support it, and bill for it.

We are also the operator of the database that stores your questions and answers. We are not going to claim that is technically impossible for us to read, because it is not: someone with production access could. What we commit to is that access to production data is limited to the people who need it to operate and support the service, that we do not read your questions for any other purpose, and that we do not disclose them to your employer — including when your employer asks.

How long we keep it

• Conversations are deleted 12 months after they were last used. Using a conversation again restarts that period.
• When your seat is released — because you left, or the licence was reassigned — all of your conversations are deleted within 90 days.
• If your account is deleted, your conversations and history are deleted with it.
• Your employer may request an export of their organisation's usage at any time before then. That export does not contain anyone's questions or answers. It is how much the service was used, over what period, and under which states' rules — with a state named only once at least five different people have asked from it, the same rule as §6. It does not identify anybody.

These periods are enforced by the software on a schedule, not applied by hand on request.

Your employer's own documents are different. Handbook text they supply, and the findings comparing it to the law, are kept until they ask us to remove them — they are the employer's records about their own policy, not about any person, and no one's questions are in them.

Security-log entries (above) are kept for up to 30 days.

Diagnostics are kept for the retention period of our diagnostics provider.

Your choices and rights

• Access, correction and deletion. Contact us at owner@first-studio.dev and we will respond within 5 business days. Depending on where you live, you may have additional rights under local law.
• Your state. You choose it from a list and can change it at any time. Hamilton never asks for location access, so there is no permission to decline.
• Microphone. You can decline the microphone permission and type instead.

Because Hamilton is provided through your employer, requests about your account may need to be coordinated with them — except requests about your questions and answers, which your employer cannot access.

How we protect it

• Every record is protected by access rules enforced by the database, so you can only read your own conversations.
• Sign-in uses a one-time emailed code. There is no password to be guessed or reused.
• The keys that grant broad access exist only on our servers and are never included in the app.
• Access to production systems is limited to people who need it.

No system is perfectly secure, but we design so that a mistake in the app cannot expose another person's information.

Children

Hamilton is a workplace tool for employers. It is not directed at children and we do not knowingly collect information from anyone under 16.

Changes to this policy

If we change how Hamilton handles information, we will update this page and change the effective date above. Significant changes will be announced in the app.

Governing law

First Studio LLC is a Utah company and Hamilton is currently offered to employers in Utah. This policy is governed by the laws of the State of Utah.

Nothing in this policy limits a right you have under a law that applies to you regardless of this paragraph.

Contact

For anything in this policy — including a request to see, correct or delete your information — write to us. We respond within 5 business days.

Your HR firm. Hamilton is currently provided to employers through The Grange, and you may know the app by their name and branding. The Grange is your employer's HR consultancy; it is not the operator of this service and does not hold your questions or answers. Requests under this policy come to First Studio at the address above. For HR matters, The Grange can be reached through their contact page.

When an answer involves enough specifics to be worth a human review, Hamilton offers to put you in touch with them. That opens their contact page in your browser and sends nothing — not your question, not your answer, not your name. Anything you then choose to tell them is yours to share, and what they do with it is covered by their own privacy practices rather than this policy.