Privacy policy

Ploy HR is an HR and talent platform — hiring, employee records, attendance, leave, claims, payroll, learning and certificates — available on the web at ployhr.com and in the Ploy HR apps for iOS and Android (together, the “Platform”). It is operated by Norm Solution Co., Ltd., #150P, St. 68K, Phum Prey Sala, Sangkat Kakab2, Khan Por Senchey, Phnom Penh, Cambodia (“we”, “us”).

This policy explains what personal data we collect, why, who we share it with, and the choices you have. Where an employer, corporate partner or training center uses the Platform to manage its own staff or learners, that organisation decides how those records are used and is responsible for them; we process them on its behalf and under its instructions.

• Account data — name, email address, password (stored only as a hash), role, organisation, and two-factor authentication settings.
• Google account data — if you choose to sign in with Google: your name, email address, profile picture and Google account identifier (see section 3).
• Profile and career data — CV content, work history, education, skills, portfolio and project material, and documents you upload.
• Assessment and learning data — responses, talent scores and level bands, course enrolments, progress, and certificates.
• HR records — where an employer uses the HR features: employment details, attendance, leave, expense claims and receipt photos, payroll figures, benefits, evaluations, and approvals.
• Attendance location — when you clock in or out in the app or on the website, the device’s location at that moment (with its accuracy), so your employer can confirm the punch was made at the workplace. Location is read only when you tap to clock in or out — never in the background — and only after you allow it on your device.
• Device and notification data — a push-notification token and basic device details (model, app version) so we can send you notifications you have turned on.
• Transaction data — credit purchases, subscriptions, invoices, and unlock history. Card details are handled by our payment provider and are not stored by us.
• Technical data — IP address, browser and device information, and error diagnostics.

You can sign in to Ploy HR with your Google account (“Sign in with Google”). This section describes exactly what Ploy HR does with the data it receives from Google.

Data we access

When you sign in with Google, we request only the openid, email and profile scopes. Google then shares with us your name, your email address (and whether Google has verified it), your profile picture and your Google account identifier. We do not request or access your Gmail, Google Drive, Calendar, Contacts or any other Google service or data.

How we use it

We use this data only to create your Ploy HR account or link it to your existing account, to sign you in securely, and to show your name and profile picture to you and to the people in your organisation inside the Platform. We do not use Google user data for any other purpose.

How we share it

We do not sell, rent or trade Google user data, and we share, transfer or disclose it only to provide the Platform’s features to you:

• to the service providers that host and operate the Platform for us (our hosting, database and email providers), only as needed to run it and under contracts that require them to keep it confidential and secure;
• to your own organisation, which sees your name and email as part of the records it manages with you;
• if you are a candidate with Open to work switched on (it is on by default and you can switch it off at any time in the app): employers searching the talent pool see an anonymised profile, and an employer who unlocks your profile sees your name and the email address on your account — which, if you signed in with Google, is the address Google shared with us;
• when the law requires it.

How we store and protect it

Google user data is stored in our production database together with your account. It is encrypted in transit (HTTPS/TLS), access to it is restricted to the Platform and to authorised staff who need it to support you, and your organisation can see only its own members. Security procedures are in place to protect the confidentiality of your data. We never store your Google password — Google handles the sign-in itself and sends us only the details listed above.

How long we keep it, and how to delete it

We keep Google user data for as long as your Ploy HR account exists. When you ask us to delete your account, we delete your Google user data from our active systems within 30 days, and it is removed from backups when they are overwritten on their normal cycle. When the retention period for a type of data expires, we delete or destroy it. To request deletion, write to privacy@ployhr.com from the email address on your account. You can also remove Ploy HR’s access at any time at myaccount.google.com/permissions.

What we never do with it

• We never use Google user data for advertising, including targeted, personalised or interest-based ads.
• We never sell Google user data, or transfer it to data brokers or information resellers.
• We never use Google user data to determine creditworthiness or for lending purposes.
• We never use Google user data to build databases or lists for any purpose other than running your account.
• We never use Google user data, or data obtained through Google Workspace APIs, to develop, improve or train generalised or non-personalised artificial intelligence or machine-learning models.
• No person reads your Google user data unless you ask us to, it is needed for security, or the law requires it.

Ploy HR’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use personal data to provide and secure your account; to run the HR features your employer uses (records, attendance, leave, claims, payroll and approvals); to generate talent scores and course recommendations; to present anonymised profiles of candidates who have Open to work switched on to corporate partners, and release a candidate’s name and email after a paid unlock; to deliver courses and issue verifiable certificates; to send emails and notifications you have turned on; to process payments; to investigate abuse and keep the Platform secure; and to meet legal obligations.

We rely on the following grounds, as the law where you live requires: performing our contract with you or your organisation; our legitimate interests in operating, securing and improving the Platform; your consent, for example for device location or optional notifications, which you can withdraw at any time; and compliance with legal obligations.

Talent scores, level bands, CV parsing and course recommendations are produced with automated systems, including a third-party AI provider; content you submit for these features is sent to that provider for processing. These outputs support people’s decisions — they are not decisions with legal effect. Hiring and personnel decisions are made by the organisation concerned, not by the Platform. You can ask how a score was produced, or contest one, by writing to privacy@ployhr.com.

• Your organisation — your employer or training center sees the records it manages through the Platform.
• Corporate partners — anonymised profiles of candidates who have Open to work switched on, and their name and email after a paid unlock. Switch Open to work off to stop appearing in the talent pool.
• Service providers — hosting, email delivery, push notifications (Google Firebase Cloud Messaging and Apple Push Notification service), sign-in (Google), AI processing, payment processing, and error monitoring — each under contract and limited to what the service requires.
• Legal and safety — where required by law, or to protect the rights and safety of users and the integrity of the Platform.

We do not sell personal data.

Ploy HR serves organisations across Southeast Asia, and some of our service providers operate in other countries, so personal data may be processed outside the country where you live. When it is, we use providers bound by contract to protect it and to use it only to provide their service to us.

We keep personal data while your account is active, and afterwards only as long as needed for the purposes above — including legal, tax, accounting and dispute-resolution requirements. HR records are kept for as long as your employer instructs. Certificate verification records are kept so that issued certificates stay checkable. When data is no longer needed we delete or anonymise it; backups are overwritten on their normal cycle.

You can ask us to delete your account and its data at any time by writing to privacy@ployhr.com. Where an employer controls the records, we will pass the request to that employer.

Access is authenticated and scoped by role and organisation, so one organisation cannot read another’s records. Passwords are stored hashed, two-factor authentication is available, traffic is encrypted in transit, and access to production data and credentials is restricted. No system is perfectly secure, and we cannot guarantee absolute security.

Depending on where you live, you may ask to access your data, correct it, delete it, receive a portable copy, restrict or object to its processing, and withdraw consent you have given. Write to privacy@ployhr.com and we will answer within 30 days. Where an employer or training center controls the records, we will refer your request to that organisation. You may also complain to your local data-protection authority.

We use only the cookies needed to sign you in and keep your session secure. We do not use advertising cookies.

The Platform is not directed to anyone under 18, and we do not knowingly collect their data.

We will post updates to this policy on this page and change the date at the top; for material changes we will also tell you through the Platform or by email. Questions, requests and complaints can be sent to privacy@ployhr.com, or by post to Norm Solution Co., Ltd., #150P, St. 68K, Phum Prey Sala, Sangkat Kakab2, Khan Por Senchey, Phnom Penh, Cambodia.