Privacy Policy

1. Who we are

Laidback Inc. ("Laidback", "we", "us") is a company incorporated in Delaware, USA. We build an AI recruiter for hiring managers. This policy covers data we handle through this website (hire.laidback.so), the Laidback app, and our Slack and Microsoft Teams integrations.

2. Data you and your team give us

When you book a briefing, set up a workspace and use Laidback, we collect:

• Workspace and account info: company name, teammate names, work emails, roles.
• Briefings: what you say on your briefing call, including its notes, and the roles you are hiring for, what good looks like, and your feedback on candidates.
• Messages you send to Laidback: everything you write to it in Slack, Microsoft Teams or its own app.
• Approvals and edits: the approach you approve, and what you change or reject.
• Your LinkedIn and email: the accounts you connect so Laidback can write from them, and its conversations with candidates there.
• Optional context: anything else you choose to connect, such as GitHub, Jira, internal meeting recordings or transcripts, your ATS or your calendar, within the permissions you give.
• Product usage: what runs, when, and how it performs.
• Technical data: browser, device, IP address, basic diagnostics.

3. Data we collect about candidates

To help you hire, Laidback processes professional information about candidates and the conversations it has with them for you. See our Candidate Privacy Notice for the full breakdown.

4. How we use your data

• Run the Services: map the market, find candidates, write to them from your accounts, and report back to you
• Keep your workspace secure, authenticated and audit-logged
• Learn your bar and preferences inside your workspace
• Support you when you email us and improve the product
• Send you product updates about the workspaces and features you use
• Understand how this website is used, through the analytics described below

5. How we do not use your data

• We do not sell your data
• We do not use your workspace data to train shared models used by other customers
• We do not read your connected accounts and tools for anything other than running the Services you asked for
• We do not write to candidates until you have approved the approach

6. Legal basis (EEA and UK)

• Contract: to provide the Services your workspace signed up for.
• Legitimate interests: keeping the Services secure, preventing abuse, improving reliability and quality, understanding how this website is used, and processing professional information to help our customers hire.
• Consent: optional marketing emails. You can withdraw at any time.
• Legal obligation: tax, accounting, responding to lawful requests.

7. Service providers we use

We share limited data with vetted providers who help us run the Services:

• Google Cloud: hosting, storage, database and primary infrastructure. Each workspace is stored in its own isolated Google Cloud environment.
• Microsoft Azure and OpenAI: AI models for writing, summarizing and matching.
• Slack and Microsoft Teams: where you talk to Laidback, only when you connect them.
• Unipile and Composio: connecting your LinkedIn, email and other tools.
• Crustdata, pipe0 and other professional data providers: candidate professional information and contact details.
• mem0: what Laidback remembers for your workspace.
• Auth0: signing in.
• Google Calendar and Granola: booking your briefing call and taking its notes.
• PostHog: website analytics, product analytics and AI quality monitoring.
• Stripe: billing and payments.

Each provider is bound by a data processing agreement. The integration architecture we use is SOC 2 guarded.

8. Cookies and analytics on this website

This website sets no cookies and shows no cookie banner. It runs no advertising trackers. PostHog keeps its analytics data in memory for the length of your visit, builds no profile of you, and honours Do Not Track. It records page views, button clicks, performance and session replays of how the page is used. Replays leave out the videos and anything typed into a form.

9. Data retention

• Workspace content (briefings, messages, connected-tool data): while your workspace is active. If you close it, we delete or anonymize within 30 days, except where we're legally required to keep something.
• Candidate professional information: up to 24 months from last active use, then deleted.
• Support tickets and billing records: as long as needed for legal and tax obligations.
• Product analytics: pseudonymized, retained up to 24 months.

10. Your rights

Under GDPR, UK GDPR and similar laws you can:

• Access a copy of the data we hold about you.
• Correct anything that's wrong.
• Delete your data (subject to legal exceptions).
• Port your data in a machine-readable format.
• Object to processing based on legitimate interests.
• Restrict processing in certain cases.
• Withdraw consent at any time for consent-based processing.

To exercise any of these, email thomas@laidback.so. We'll reply within 30 days.

11. International transfers

We host workspace data in Google Cloud regions in the United States and the European Union. EU/EEA workspace data is stored in EU/EEA regions by default. Where any data is transferred outside the EU/EEA, we rely on Standard Contractual Clauses approved by the European Commission and equivalent UK safeguards.

12. California privacy rights (CCPA / CPRA)

If you're a California resident, you have the right to know what personal information we collect, request deletion, and opt out of "sharing" for cross-context behavioural advertising. We do not sell personal information, and this website does not share it for advertising. To exercise your California rights, email thomas@laidback.so.

13. Security

Data is encrypted in transit and at rest. Access to production systems is limited to a small group of engineers using SSO and hardware keys. We keep audit logs of admin actions. Report a suspected vulnerability to thomas@laidback.so.

14. Breach notification

If a breach affects your personal data, we will notify the admin of your workspace and, where legally required, the relevant supervisory authority within 72 hours of becoming aware.

15. Changes to this policy

We may update this policy. If a change is material we'll update the "Last updated" date and email the admin of your workspace. Continuing to use Laidback after the change means you accept the new policy.

16. Contact and complaints

Questions about this policy or how we handle data? Email thomas@laidback.so. If you're not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.