Privacy Policy

Who we are

ChalkHR is a brand of SmallCloud Technologies Incorporated, a Canadian federal corporation under the Canada Business Corporations Act (corporation number 10391301 ). When this policy refers to "we", "us", or "our", it means SmallCloud Technologies Incorporated, operating as ChalkHR.

The registered office address is available on request. Email privacy@chalkhr.com.

ChalkHR provides apps for Microsoft Teams, starting with ChalkHR Polls & Surveys — a poll and survey tool that runs inside Teams and on the web at polls.chalkhr.com.

Roles under data protection law

When your organization installs and uses ChalkHR Polls & Surveys, your organization is the controller of personal data submitted in the product (employee identities, poll content, votes, and related workplace data). We are the processor. That processing is governed by our Data Processing Agreement.

We are the controller of personal data we collect for our own purposes on chalkhr.com (marketing site analytics, support emails sent to us, and AppSource listing interactions).

What data we collect

We collect the minimum information needed to provide the service:

• Identity data from Microsoft Entra ID — When you sign in through Teams or the web, Microsoft provides us your name, email address, Microsoft tenant ID, and user object ID. We do not collect or store your password.
• Poll content — Questions, answer options, votes, and open-text responses that you create or submit within ChalkHR Polls & Surveys.
• Bot interaction data — When the ChalkHR bot is installed in a Teams channel or chat, we store the conversation reference so we can send poll cards and updates. We also cache team and channel names so creators can target a conversation.
• External voters — If a poll is shared with a public link in "anyone" mode, the voter may provide a display name and optional email.
• Usage preferences — Any settings you configure within the app (e.g., notification preferences).

We also collect limited usage analytics — page views, referring site, device and browser type, and approximate location — through Google Analytics on chalkhr.com and polls.chalkhr.com, and through PostHog on chalkhr.com and inside the Polls app. Production error reports go to Sentry (tagged with user object ID and tenant ID). Application logs go to Axiom (may include user ID, name, and tenant ID). We do not collect device fingerprints or advertising profiles.

How we use your data

• To provide the service — Authenticate you, display your polls, record votes, and deliver bot messages in Teams.
• To enforce plan limits — Track usage against your organization's plan (free or paid).
• To send proactive messages — Deliver poll reminders, scheduled posts, and results via the Teams bot.
• To operate, secure, and improve the service — Diagnose errors, review aggregate usage, and keep the product reliable. We do not use this data for advertising.

We do not sell your personal data. We do not use your data for advertising, profiling, or any purpose unrelated to providing ChalkHR services.

Data storage and security

Production poll data is stored in PostgreSQL hosted by PlanetScale. The application runs on Cloudflare Workers. All connections use TLS encryption in transit. A summary of technical and organisational measures is on our Security page and in Annex II of the DPA.

Data is organized by Microsoft tenant ID, so each organization's data is logically separated.

Data location: The production database is in AWS us-east-1 (Northern Virginia, United States). The Polls API Worker is placed in AWS us-east-2 (Ohio, United States). Static assets and other Cloudflare services run on Cloudflare's global edge network. There is no EU or UK hosting region today.

Data sharing and subprocessors

We do not sell, rent, or share your personal data with third parties for their own marketing. Customer personal data is processed only by the subprocessors listed below, solely to deliver the Service. The live list also lives on chalkhr.com/security. We will update that page at least 30 days before a new production subprocessor starts processing customer personal data. Organizations with a DPA may object as described there.

International data transfers

SmallCloud Technologies Incorporated is incorporated in Canada. Canada has been recognized by the European Commission as providing adequate protection for personal data. Production hosting and several subprocessors are in the United States, which is not covered by that adequacy decision.

For customer personal data we process as a processor, transfers from the EEA, UK, or Switzerland are governed by the DPA, including the EU Standard Contractual Clauses (Module Two) and the UK International Data Transfer Addendum. We rely on our subprocessors' own DPAs, Standard Contractual Clauses, and — where they participate — the EU-US Data Privacy Framework.

Cookies and tracking

ChalkHR uses first-party Google Analytics (GA4) cookies on chalkhr.com and polls.chalkhr.com. These cookies store a random client identifier so we can distinguish sessions. We do not use advertising pixels or sell data to advertisers.

chalkhr.com and the Polls app also use PostHog for page views and events (including AppSource button clicks on the marketing site, and in-app events such as viewing results). PostHog and Google Analytics both run only on the production hosts, not on staging or preview environments.

Authentication state is managed through Microsoft Entra ID tokens, not analytics cookies.

Notice to end users

ChalkHR is designed for use by organizations. When your employer or organization installs ChalkHR in Microsoft Teams, your organization's administrator controls:

• Who can access ChalkHR within the organization
• Whether the ChalkHR bot is available in specific channels or chats
• Whether to uninstall ChalkHR, which removes the organization's access

If you have questions about your organization's use of ChalkHR, please contact your Teams administrator first. For data requests that your administrator cannot resolve, contact us directly.

Data retention

We retain your data for as long as your organization uses ChalkHR. Poll data (questions, options, votes, responses) is kept until the poll is deleted by its creator or your organization asks us to delete the tenant.

Uninstalling the ChalkHR bot from Teams removes that installation's access to the Service. It does not automatically delete poll data or stored conversation references used for messaging. If your organization requests full data deletion, we will delete production data associated with your tenant ID, subject to short-lived backups described in the DPA.

Your rights

If we process your data as a processor, your organization (the controller) is the primary contact for access, correction, deletion, and export requests. We will assist them as required by the DPA.

Where we are the controller, or your administrator cannot help, you may ask us to:

• Access your data — request a copy of data we hold about you or your organization.
• Correct inaccurate data — your name and email are synced from Microsoft Entra ID on each sign-in.
• Delete your data — request deletion of your account or your organization's data.
• Export your data — request a machine-readable export of your poll data. Export is currently fulfilled manually.

Email privacy@chalkhr.com. We aim to respond within 30 days.

California residents (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with additional rights:

• Right to know — You may request the categories and specific pieces of personal information we have collected about you.
• Right to delete — You may request deletion of your personal information.
• Right to non-discrimination — We will not discriminate against you for exercising your CCPA rights.
• No sale of personal information — We do not sell, and have never sold, personal information to third parties.

To exercise these rights, contact privacy@chalkhr.com. We will respond within 45 days as required by the CCPA.

Anonymous polls

When a poll is created as "anonymous", voter identities are not displayed to other users. However, vote records are still stored with user IDs internally for deduplication (one vote per user). We do not expose anonymous voter identities through the UI or API.

Children's privacy

ChalkHR is a workplace tool designed for use by organizations with Microsoft Teams. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. We will update the "last updated" date at the top of this page. For significant changes, we will notify affected organizations through the app or Teams bot.

Contact

For privacy questions, data requests, the DPA, or concerns:

SmallCloud Technologies Incorporated
Ontario, Canada
The registered office address is available on request.
Email: privacy@chalkhr.com