Legal

Privacy Policy

Hamrr is a workspace for recruitment agencies. It connects to the systems a recruiter already uses — their applicant tracking system, email account and Granola — reads what is there, prepares the paperwork around a role and, where you allow it, acts on it. This policy explains what we collect, why, where it lives, and what you and the candidates on your desk can ask us to do about it.

1. Who we are

Hamrr is a product of M3 Labs Ltd, a company registered in England and Wales. In this policy, "Hamrr", "we" and "us" mean M3 Labs Ltd.

You can reach us about anything in this policy at [email protected].

2. Two different roles we play

This distinction matters, because it decides who you go to with a request.

• For your own account, we are the controller. Your name, email, settings, subscription and usage are ours to answer for.
• For candidate and client data, we are a processor and you are the controller. The people in your pipeline are on your desk, not ours. We hold their information because you asked us to work on it, and we act on your instructions.

So a candidate asking what is held about them, or asking for it to be deleted, is asking the recruiter who holds their file — not us. We will help you answer, and we will pass on any request that reaches us directly.

3. What we collect

Account information

Your name, email address, and the sign-in identity from the provider you chose (Microsoft, Google, or email and password). Your settings, including which of Hamrr's two kinds of work (updating where a candidate is, and sending the replies it writes) you have allowed it to carry out without asking.

Data from the systems you connect

Only from systems you explicitly connect, and only while they stay connected:

• Your applicant tracking system — jobs, candidates, applications, stages, notes and contact details.
• Your email account (Google or Microsoft) — messages between you and the people on your desk, so Hamrr can see what has already been said before it drafts a reply, and can tell when a hiring manager has gone quiet.
• Your calendar, on that same account, read only — to see when you last met a hiring manager, so Hamrr can tell when one has gone quiet.
• Granola — the meeting notes you choose to bring in, so Hamrr can sort them onto candidate records.

Hamrr writes back to these systems only for what you ask of it: creating the client, hiring manager and job in your ATS when you create a role from a brief, updating where a candidate is, and sending email from your account.

Candidate information

Names, contact details, CVs, work history, notes and the outcome of each conversation. Where you upload a CV, we also generate and store a redacted copy with the candidate's name, email addresses, phone numbers, address and links removed, so a client-facing version exists. Where you paste a LinkedIn link, Hamrr reads the public profile page and keeps what it read.

Usage and billing

Records of what ran, when, and what it cost to run — including the actions Hamrr took on your behalf. Your subscription, the number of recruiters on it and the Hunt roles you run, so we can bill you correctly. Payment card details are handled by Stripe and never reach our servers.

4. What we use it for

• Running the product: reading what you connect, preparing roles, candidate records, client-safe CVs and submission packs, drafting the messages, and sending them where you have allowed that.
• Keeping a record of what was done on your behalf, so you can see and audit it.
• Billing, support, security and fraud prevention.
• Diagnosing faults and improving the product.

5. Our legal bases

What	Basis
Providing the service to you	Performance of our contract with you
Billing and account administration	Contract, and our legal obligations
Security, fault diagnosis, product improvement	Our legitimate interests in running a reliable, secure service
Processing candidate and client data	On your documented instructions, under your own lawful basis as controller

6. AI processing

Hamrr uses large language models to read context and draft text. These run on Amazon Bedrock within our own cloud account. Content sent to Bedrock is not used by the model provider to train their models.

Model output is a draft. Where a setting is on "Check with me", nothing is sent until you approve it. Where you have switched one to "Just do it", Hamrr acts without asking and records exactly what it did.

7. Who else processes your data

We use a small number of providers to run the service. Each processes data only to provide their part of it:

Provider	What for
Amazon Web Services	Hosting, storage, database, and AI models via Amazon Bedrock
Stripe	Subscription payments
Microsoft	Sign-in, and mail and calendar access where you connect them
Google	Sign-in, and mail and calendar access where you connect them
LinkdAPI	Public LinkedIn profile and activity data used when researching a candidate profile
Exa	Public web and news search used when researching a company
Cloudflare	Hosting this website, and Turnstile, which checks a person (not a bot) is using the free CV tool
Granola	The meeting notes you choose to bring in
PostHog	Product analytics in the Hamrr app, hosted in the EU: which screens are used and where people click, linked to your account email. Session recordings hide all on-screen text and everything typed, so no candidate or client data is sent
Your ATS provider	The system you chose to connect; data flows both ways at your instruction

We may also disclose information where the law requires it, or to establish or defend legal claims. If our business is sold or reorganised, data may transfer as part of that — we will tell you before it does.

8. Where your data is stored

Your workspace, including candidate records and CVs, is stored in the United Kingdom (Amazon Web Services, London region). Each customer's workspace is held separately.

Some of our providers operate internationally and may process limited data outside the UK. Where that happens, it is covered by the safeguards those providers offer under UK data protection law, including the International Data Transfer Agreement or Addendum.

9. How long we keep it

• While your account is open, we keep your workspace so the product works — the history is what tells Hamrr who has gone quiet and what has already been said.
• When you close your account, we delete your workspace within 30 days, except where we must keep something longer by law.
• Billing records are kept for six years, as UK tax law requires.
• You can ask us to delete specific records at any time, and we will, unless doing so would break something you still rely on — in which case we will tell you.

10. Your rights

Under UK data protection law you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything that is wrong;
• delete it, or restrict what we do with it;
• provide it in a portable form;
• stop processing it where we rely on legitimate interests.

Write to [email protected] and we will respond within one month. If you are unhappy with how we have handled it, you can complain to the UK Information Commissioner's Office at ico.org.uk.

11. If you are a candidate

If a recruiter is using Hamrr to work on your application, your information is held on their instructions, not ours. They decide what is held and for how long, so requests about your data should go to the recruitment agency you are dealing with.

If you contact us instead, we will pass your request on to them promptly and tell you we have done so.

12. Security

• Data is encrypted in transit and at rest.
• Credentials for the systems you connect are encrypted separately, and are only decrypted at the moment they are used.
• Each customer's workspace is isolated from every other.
• Access by our staff is limited to what is needed to run and support the service.

No system is perfectly secure. If a breach affects your data, we will tell you and the Information Commissioner's Office where the law requires it.

13. Cookies

This website (hamrr.ai) uses no cookies beyond what it needs to work, and no advertising cookies or third-party tracking. While you browse it, your browser notes the site that sent you and the first page you opened, in session storage that clears when you close the tab. That note only reaches us if you send the contact form, as a line at the end of your message. The Hamrr app uses the cookies and local storage needed to keep you signed in and remember your settings, and PostHog's first-party cookie to measure how the product is used (see section 7). We do not use advertising cookies anywhere.

14. Google user data

This section covers information Hamrr receives from Google when you choose to connect your Google account. It applies in addition to the rest of this policy.

What Hamrr asks Google for, and why

• Your name, email address and profile — to know which Google account you connected.
• Gmail: read your messages — the messages between you and the people on your desk, so Hamrr can see what has already been said before it drafts a reply, and can tell when a hiring manager has gone quiet.
• Gmail: send email — to send the replies Hamrr drafts, from your own address, only when you have approved them or switched that setting to "Just do it".
• Google Calendar: read your events (read only) — to see when you last met a hiring manager, so Hamrr can tell when one has gone quiet. Hamrr never creates, edits or deletes events or calendars.

Hamrr uses this information only to provide and improve those features inside the product for you. It is not used for anything else.

Limited Use

Hamrr's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We do not sell your Google user data.
• We do not use it for advertising, including retargeting, personalised or interest-based advertising.
• We do not use it to train generalised AI or machine-learning models. The models that draft text for you run on Amazon Bedrock in our own cloud account, and content sent to them is not used by the model provider to train its models.
• Our staff do not read your Google user data unless you ask us to in order to support you, it is needed to investigate a fault or abuse, or the law requires it.
• We share it only with the providers named in section 7 that need it to run the service, such as Amazon Web Services for hosting and for the AI models, and where the law requires it.

How it is stored and protected

Your Google sign-in credentials are encrypted separately from everything else and are only decrypted at the moment they are used. Data is encrypted in transit and at rest, held in the United Kingdom, and kept separate from every other customer's workspace. See sections 8 and 12.

How long we keep it, and how to remove it

• Disconnect Google from the Connections page at any time. Hamrr then deletes the stored Google credentials and stops reading or sending from that account.
• Revoke access from Google's side at any time at myaccount.google.com/permissions.
• Close your account and we delete your workspace, including anything derived from your Google data, within 30 days, except where we must keep something longer by law.
• Ask us to delete specific records at any time at [email protected].

15. The free client-safe CV tool

Our guide to client-safe CVs lets anyone, without an account, upload one CV and get back a copy with the candidate’s name and contact details taken off. When you use it:

• What we receive. The CV (a PDF), the candidate’s name as you typed it, and your IP address.
• What we do with it. Hamrr reads the CV once to find the details to remove (using AI models on Amazon Bedrock, as in section 6), makes the client-safe copy and sends both pages back to your browser.
• What we keep. Nothing from the CV. It is not saved, not added to any workspace and not used to train any model. Our logs record only that a CV was processed, its number of pages and how many details came off.
• Your IP address is counted for 24 hours so each person can make a few CVs a day, then it is deleted.
• The human check. Cloudflare Turnstile checks that a person is using the tool. Cloudflare processes your browser and connection data for this under its own privacy policy.
• The candidate’s permission. Before you upload, you confirm you have the candidate’s permission to process their CV. For that CV, you decide why it is processed; we only make the copy you asked for.

16. Changes and contact

If we change this policy materially, we will update the date at the top and tell account holders by email before the change takes effect.

Questions, requests or complaints: [email protected].