Privacy Policy

What this policy covers

This policy covers mambahr.com, our public website: the pages you browse, the demo request form, and the field guides you can download.

It does notcover the MambaHR application itself. Employee data that a customer puts into the MambaHR product is handled under that customer’s written agreement and data processing terms, where MambaHR acts as a processor on the customer’s instructions. If you are an employee of a MambaHR customer asking about your own HR records, your employer is the right place to start.

Information you give us

You only ever type into this website when you ask us for something. When you request a demo, download a field guide, or join the waitlist, we collect:

• Your name
• Your work email address
• Your company name
• Your company size band (a range, not a headcount)

If you email us, we keep that correspondence so we can reply and keep track of the conversation. We do not ask for, and this website does not collect, any sensitive category of personal information: no government identifiers, no financial account details, no health information.

Information collected automatically

We run our own first-party analytics so we can see which pages are useful and which are not. For each visit we record:

• Pages viewed, page titles, time on page, and how far down the page you scrolled
• The referring site and any UTM campaign parameters in the link you followed
• Screen size and browser language
• Device type, browser, and operating system, derived from your user agent
• Clicks on calls to action, such as a demo button
• Approximate location (country, region, city) and network operator, derived from your IP address

We do not store your IP address. It is used in the moment to derive the approximate location and network above, and to rate-limit abuse, then discarded. What we keep is a salted, truncated one-way hash of it, which lets us recognise repeat requests in a session without holding the address itself.

We also classify obvious bots and crawlers from the user agent so they do not pollute the numbers.

Cookies and local storage

Our own analytics do not use cookies. They use two opaque random identifiers stored in your browser:

Neither identifier contains your name, your email, or anything derived from them. Clearing your browser’s site data for mambahr.com removes both, and you become a new visitor.

Two third parties may set their own cookies: Cloudflare Turnstile, which checks that form submissions come from a person rather than a script, and Google Analytics, where enabled. Cookies used by our admin tools are limited to signed-in MambaHR staff.

The same information, in the statutory categories

California law describes personal information in fixed categories. Mapping ours onto them, so a reviewer can tick the boxes without reading between the lines:

We do not collect the categories the law treats as sensitive: no government identifiers, no financial account details, no precise geolocation, no biometric or health data, and nothing about race, religion, union membership, sexual orientation, or the contents of your communications. We do not infer characteristics about you or build a profile.

Why we use it

We use the information above to:

• Reply to your demo request and send you the guide you asked for
• Send the confirmation email for a request you submitted
• Understand which pages help people and which do not, so we can improve them
• Keep the forms free of spam and automated abuse
• Keep the site secure and available

We do not use this information to make automated decisions about you, and we do not profile you for advertising.

Who processes it for us

We keep the list short on purpose. Each of these companies processes data on our instructions, under contract, and all of them process it in the United States.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either. We will disclose information if the law requires it, and we would tell you unless we were legally prohibited from doing so.

How long we keep it

Analytics data expires on a schedule, enforced by an automated sweep that runs every day:

• Sessions identified as bots are deleted after 30 days
• All other analytics sessions are deleted after 180 days

Demo requests, field-guide requests, and email correspondence are business records. We keep those while we are in contact with you and for as long as we may need them for our legitimate business and legal purposes. Ask us to delete them and we will.

Your choices and your rights

You can, at any time and regardless of where you live:

• Ask what personal information we hold about you
• Ask us to correct it
• Ask us to delete it
• Ask us to stop emailing you, or use the unsubscribe link in any email
• Clear your browser’s site data to reset the analytics identifiers above

California residents have rights under the CCPA, as amended by the CPRA, to know, delete, and correct personal information, to opt out of its sale or sharing, and not to be treated differently for exercising them. We honour all of these whether or not we currently meet the statute’s business thresholds, because they are the right default. As set out above, we do not sell or share personal information, so there is nothing to opt out of.

We honour Global Privacy Control and Do Not Track signals. If your browser or extension sends either, we record nothing: no identifier is created, no analytics beacon is sent, and no third-party analytics script is loaded for your visit.

To exercise any of these, email hello@mambahr.com with “Privacy request” in the subject line, from the address you gave us or telling us which address to look up. We will respond within 45 days. You may use an authorised agent; we will ask for proof of their authority.

Security

Data is encrypted in transit and at rest, access on our side is restricted to the people who need it, and administrative access is logged. No system is perfect, and we will not claim otherwise. If you believe you have found a vulnerability in this website, email hello@mambahr.com and we will get back to you quickly.

Children

This is a website for people who buy business software. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, email us and we will delete it.

Changes to this policy

If we change how we handle personal information, we will update this page and move the date at the top. If a change is significant, we will say so plainly rather than quietly editing the text.

How to reach us

MambaHR, Inc., San Francisco, California.
Everything reaches the founders at hello@mambahr.com. For a privacy or deletion request, put “Privacy request” in the subject so we can start the clock on it properly.