Privacy Policy
Last updated October 30, 2026
Introduction
TeamOhana, Inc. (“TeamOhana,” “we,” “us,” or “our”) provides a cloud-based headcount planning and workforce management platform for Finance, HR, Recruiting, and business leaders (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard personal data in connection with the Service and our website, https://www.teamohana.com (collectively, the “Site”). Please read this privacy policy carefully.
This policy covers two different relationships, and distinguishes between them throughout: TeamOhana as Data Processor for personal data about our customers’ employees, contractors, and job applicants which we process strictly on that customer’s instructions; and TeamOhana as Data Controller for personal data about visitors to our website and business contacts at prospective or current customers, which we control ourselves.
For personal data we process as Data Processor, the Data Processing Agreement between TeamOhana and each customer applies in addition to this Privacy Policy and sets out our obligations regarding personal data breach notification, changes to sub-processors, audits, and assistance with data subject requests.
We may update this Privacy Policy from time to time. We will update the “Last Updated” date of this Privacy Policy when we do. Updated versions take effect when posted on the Site, subject to any additional notice required by applicable law or our agreements with customers.
You are encouraged to periodically review this Privacy Policy to stay informed of updates. This Privacy Policy describes our practices; it is not a contract with, and does not require acceptance by, employees, contractors, or job applicants whose personal data we process on behalf of our customers.
COLLECTION OF YOUR INFORMATION
We may collect information in a variety of ways. The information we may collect includes:
Customer Workforce and Applicant Data We Process on Behalf of Our Customers
On behalf of our customers, and strictly at their direction, we process personal data about their employees, contractors and job applicants. The following table describes employee and contractor data; applicant data is described below. Each customer configures which fields apply to them; several fields are optional and can be excluded at the customer’s request.
| Category | Fields | Required / Optional |
|---|---|---|
| Identity | Name | Required |
| Demographic | Gender, Ethnicity | Optional |
| Contact | Work email, Telephone number | Email required, phone optional |
| Location | Address (city, region, country) | Required |
| Employment | Employment type (contractor/full-time), Employment status (active/terminated), Department/sub-department, Reporting manager | Required |
| Compensation | Salary information | Required, for budgeting and reporting |
| Image | Photograph | Optional |
Gender and ethnicity are optional fields and may constitute sensitive or special-category personal data. Where a customer chooses to include them, we process them only for the customer-enabled purposes described in this policy, such as diversity and inclusion planning. Customers are responsible for establishing a valid legal basis for including these fields, including any consent or other condition required by applicable law. We do not use these fields for any other purpose and will exclude them at the customer’s request. Access to Customer Workforce and Applicant Data is restricted to personnel with a need to know, and that access is logged.
We receive employee and contractor data through the HRIS integrations and applicant data through the ATS integrations that each customer authorizes (using our integration provider, Merge.dev). Applicant data may include name and work email address. Data subjects in this category are employees, contractors, and job applicants of our customers, not individual visitors to our website.
Personal Data
For website visitors and business contacts at prospective or current customers, we collect personal information such as name, work email address, and telephone number that you voluntarily provide to us, for example by submitting a contact form or registering for an event. You are under no obligation to provide us with personal information of any kind; however, your refusal to do so may prevent you from using certain features of the Site.
Derivative Data
Information our servers automatically collect when you access the Site, such as your IP address, your browser type, your operating system, your access times, and the pages you have viewed directly before and after accessing the Site.
USE OF YOUR INFORMATION
This section describes how we use personal information we collect as Data Controller (see Personal Data and Derivative Data above). It does not apply to Customer Workforce and Applicant Data, which we process only as described under Purpose of Processing Customer Workforce and Applicant Data below.
We may use the personal information we collect from you to:
Operate and improve our services, including by remembering information so that you will not have to re-enter it during your visit or the next time you sign in to your account
Identify and protect our Site users and customers
Control unauthorized use or abuse of our services and the Site
Analyze use of the Site and monitor aggregate traffic patterns on the Site
Respond to your inquiries and requests
Send you advertising and marketing materials about our products, services and promotions, subject to the choices described in this Privacy Policy.
Legal Bases for Processing (Data Controller)
If you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases for the personal information we process as Data Controller: our legitimate interests in operating, securing, and improving the Site and the Service, responding to inquiries, and communicating with business contacts; your consent, where required, such as for non-essential cookies, which you can withdraw at any time from the Cookie Declaration on our website; and compliance with our legal obligations. For Customer Workforce and Applicant Data, we process personal data on the instructions of our customers, who are responsible for establishing the legal basis for that processing.
Purpose of Processing Customer Workforce and Applicant Data
We process personal data on behalf of our customers solely to deliver the Service our customer has contracted for:
Workforce planning and management - real-time headcount planning, approval, and tracking.
Compensation and budget management - budget forecasting and cost tracking.
HRIS/ATS integration - synchronizing with the customer’s existing HR systems as a single source of truth.
Workforce analytics - organizational insights, including diversity and inclusion planning where the customer has enabled it.
We do not use Customer Workforce and Applicant Data for our own marketing or advertising, and we do not sell it or share it with advertisers, ad networks, or data brokers.
We do not train or fine-tune AI models on customer data. Where AI features are used, inference is performed within AWS Bedrock, and customer data is not transmitted to the developers of the models. Our AI features do not make automated decisions about individuals; human intervention is required for any decision.
DISCLOSURE OF YOUR INFORMATION
We may share information we have collected about you in certain situations. Your information may be disclosed as follows:
By Law or to Protect Rights
With respect to Customer Workforce and Applicant Data we process on behalf of our customers, we disclose it to public authorities only where we are legally required to do so, including to meet national security or law enforcement requirements, and, where legally permitted, we will notify the affected customer before doing so.
With respect to personal data we collect as Data Controller, if we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation. This includes exchanging information with other entities for fraud protection and credit risk reduction.
Sub-processors
We may share your information with sub-processors that perform services for us or on our behalf. Current sub-processors include:
Critical to Service operation: AWS Cloud (infrastructure and data storage; also AI inference via AWS Bedrock), Merge.dev (HRIS/ATS integration), Auth0 (authentication), ClickHouse (analytics datastore)
Supporting: Grafana (application logs), PostHog (user session metrics and recordings)
Before engaging any sub-processor to process personal data, we require that sub-processor to provide a level of privacy and security protection consistent with our own obligations to our customers. A current, detailed sub-processor list is maintained at https://trust.teamohana.com/subprocessors.
Google Sign-In
Where a customer’s users sign in to the Service using Google single sign-on, we receive basic profile information from Google, such as name and email address, through our authentication provider, Auth0, solely to authenticate the user and provide access to the Service. TeamOhana’s use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
Sale or Bankruptcy
If we reorganize or sell all or a portion of our assets, undergo a merger, or are acquired by another entity, we may transfer personal data to the successor entity, provided that the successor entity is bound to protect that personal data at a level no less protective than this Privacy Policy and our agreements with our customers. We will notify affected customers of such a transfer. Customer Workforce and Applicant Data is processed on behalf of our customers and is not an asset of TeamOhana; if we go out of business or enter bankruptcy, it will be handled in accordance with our agreements with those customers.
DATA PRIVACY FRAMEWORK
TeamOhana, Inc. complies with the EU–U.S. Data Privacy Framework (“EU–U.S. DPF”) and the UK Extension to the EU–U.S. DPF as set forth by the U.S. Department of Commerce. TeamOhana has certified to the U.S. Department of Commerce that it adheres to the EU–U.S. DPF Principles with regard to the processing of personal data received from the European Union in reliance on the EU–U.S. DPF and from the United Kingdom and Gibraltar in reliance on the UK Extension to the EU–U.S. DPF.
If there is any conflict between this Privacy Policy and the applicable DPF Principles, the DPF Principles govern. To learn more about the DPF program, visit https://www.dataprivacyframework.gov/.
For personal data received in reliance on the applicable DPF, we provide individuals with the opportunity to opt out of disclosure to third parties, other than agents acting on our behalf, or use for a purpose materially different from the purpose for which the data was originally collected or subsequently authorized. Where required by the applicable DPF Principles, we obtain affirmative express consent before disclosing sensitive personal data to third parties or using it for a different purpose. To exercise these choices, contact privacy@teamohana.com. Where we process personal data on a customer’s behalf, we work with that customer to give effect to applicable choices.
In compliance with the EU–U.S. DPF and the UK Extension to the EU–U.S. DPF, TeamOhana commits to resolve complaints about our collection or use of personal data received in reliance on these frameworks. Individuals with inquiries or complaints should first contact us at privacy@teamohana.com. We will respond to complaints from individuals within 45 days of receipt.
TeamOhana commits to cooperate with the panel established by the EU data protection authorities (“DPAs”), the UK Information Commissioner’s Office (“ICO”), and the Gibraltar Regulatory Authority (“GRA”), and to comply with their advice regarding unresolved complaints concerning our handling of human resources data received in reliance on the EU–U.S. DPF and the UK Extension to the EU–U.S. DPF. This independent recourse mechanism is available to individuals at no cost.
TeamOhana’s contact for DPF complaints and communications from these authorities is privacy@teamohana.com.
TeamOhana remains responsible for personal data transferred under the DPF to a third party acting as our agent where that third party processes it inconsistently with the applicable DPF Principles, unless TeamOhana proves it is not responsible for the event giving rise to the damage. TeamOhana is subject to the investigatory and enforcement powers of the Federal Trade Commission. Under certain conditions, you may invoke binding arbitration for complaints not resolved through the other DPF mechanisms, as described in Annex I of the applicable DPF Principles.
INTERNATIONAL DATA TRANSFERS
Personal data processed on behalf of our customers is stored and processed in the United States (AWS us-west-2, Oregon, with backup replication to AWS us-east-1, Virginia). We use applicable lawful mechanisms for transfers of personal data to the United States, including the applicable Data Privacy Framework where our participation is active and the transfer falls within its scope, and Standard Contractual Clauses incorporated into our Data Processing Agreements, supplemented by the UK Addendum where applicable. Our participation in a Data Privacy Framework does not limit our contractual obligations under those agreements.
TRACKING TECHNOLOGIES
Cookies
We and our service providers, including analytics providers such as PostHog and advertising partners, use cookies and similar technologies on the Site to ensure functionality, evaluate website usage, personalize content and ads, and serve relevant marketing content. Some of these cookies track visitors across websites, and our advertising partners may combine the information they collect with other information you have provided to them or that they have collected from your use of their services. A cookie banner provided by our consent management provider, Cookiebot (Usercentrics), lets you review the cookies in use, grouped as Necessary, Preferences, Statistics, and Marketing, and manage your choices. If you are in the European Economic Area or the United Kingdom, we set only necessary cookies until you choose, and you can deny cookies or select categories. Elsewhere, you can opt out of the sale or sharing of your personal information through the banner. You can change or withdraw your choices at any time from the Cookie Declaration on our website. We honor the Global Privacy Control (GPC) signal. Most browsers are set to accept cookies by default. You can remove or reject cookies, but be aware that such action could affect the availability and functionality of the Site.
Website Analytics
We use analytics providers, including PostHog, to analyze and track use of the Site and the Service and better understand usage. These providers may receive personal data such as IP address and usage activity in the course of providing this service to us. We do not use PostHog for third-party advertising or remarketing.
You should be aware that getting a new computer, installing a new browser, upgrading an existing browser, or erasing or otherwise altering your browser’s cookie files may also clear certain opt-out cookies, plug-ins, or settings.
THIRD-PARTY WEBSITES
The Site may contain links to third-party websites and applications of interest, including external services, that are not affiliated with us. Once you have used these links to leave the Site, any information you provide to these third parties is not covered by this Privacy Policy, and we cannot guarantee the safety and privacy of your information. Before visiting and providing any information to any third-party websites, you should inform yourself of the privacy policies and practices (if any) of the third party responsible for that website, and should take those steps necessary to, in your discretion, protect the privacy of your information. We are not responsible for the content or privacy and security practices and policies of any third parties, including other sites, services or applications that may be linked to or from the Site.
SECURITY OF YOUR INFORMATION
We use administrative, technical, and physical security measures to help protect your personal information, consistent with our SOC 2 Type 2 and ISO 27001:2022 certifications. All data at rest and in transit is encrypted using industry-standard algorithms. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse. Any information disclosed online is vulnerable to interception and misuse by unauthorized parties. Therefore, we cannot guarantee complete security if you provide personal information.
DATA RETENTION POLICY
We will retain your information in accordance with applicable law and, in general, for no longer than necessary for the purposes for which your information was processed by us. Personal data processed on behalf of a customer is retained for the duration of the customer relationship. Following termination or expiration of the applicable agreement, we return or delete customer personal data in accordance with the applicable agreement and our Data Processing Agreement, unless retention is required by law, regulation, or documented legal hold. Any data retained for legal reasons is isolated and protected from further processing except as required by law. Backup copies are deleted or overwritten in accordance with our documented backup-retention schedule.
Analytics data held in PostHog is retained for no more than 90 days. Other personal data we collect as Data Controller, such as contact-form submissions, is retained for no more than 30 days, unless a longer period is required by law.
Customers may request deletion of their data by making a request in writing to security@teamohana.com, including sufficient detail to validate the request. Employees and contractors of a customer should direct deletion requests to their employer (see Employee and Contractor Rights below), and website visitors and business contacts may use the process described under Website Visitors and Business Contacts below. In the event that a data deletion request is received, TeamOhana will verify the request before processing it.
POLICY FOR CHILDREN
We do not knowingly solicit information from or market to children under the age of 13. If you become aware of any data we have collected from children under age 13, please contact us using the contact information provided below.
CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online, with the exception of the Global Privacy Control (GPC) signal, which we honor as a request to opt out of the sale or sharing of personal information. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Policy.
OPTIONS REGARDING YOUR INFORMATION
Employee and Contractor Rights
If you are an employee, contractor, or job applicant of a TeamOhana customer, please direct requests to access, correct, amend, or delete your personal data to that customer - it controls the relationship and the request. TeamOhana supports our customers in fulfilling such requests within the timeframes required by applicable law and our Data Processing Agreement. If a request reaches us directly, we will forward it to the relevant customer. Contact: security@teamohana.com.
Website Visitors and Business Contacts
If you are a website visitor or a business contact whose personal data we control, wherever you are located, you may request access to, correction of, or deletion of your personal data, object to our processing of it, or ask us to stop contacting you, by emailing security@teamohana.com. We will verify your identity and respond within the timeframes required by applicable law. If you are located in the European Economic Area or the United Kingdom, you may also withdraw any consent you have given at any time, and you have the right to lodge a complaint with your local data protection supervisory authority.
California Consumer Privacy Rights
TeamOhana adheres to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA).
In the past 12 months, we have collected the following categories of personal information from website visitors and business contacts: identifiers (such as name, email address, telephone number, and IP address) and internet or other electronic network activity (such as browsing and usage data and cookie identifiers). We collect this information directly from you or automatically through cookies and similar technologies, use it for the purposes described in this Privacy Policy, retain it as described under Data Retention Policy, and disclose it to the service providers described in this Privacy Policy.
Our use of marketing cookies on the Site may be considered a “sale” or “sharing” of personal information under California law. You can opt out at any time by selecting “Do not sell or share my personal information” in our cookie banner or by using the Global Privacy Control signal, which we honor. We do not sell or share the personal information we process on behalf of our customers, and we do not use or disclose sensitive personal information except as permitted by the CCPA.
California residents have the right to know what personal information we collect, use, and disclose; to request deletion or correction of their personal information; to opt out of the sale or sharing of their personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. To exercise these rights, email security@teamohana.com. We may verify your identity when required or permitted for the type of request you submit. We do not require identity verification for requests to opt out of the sale or sharing of personal information. You may use an authorized agent to submit a request on your behalf, subject to applicable authorization requirements. If you are an employee or contractor of a TeamOhana customer, we process your personal information on that customer’s behalf as a service provider; please direct your request to your employer.
California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.
CONTACT US
If you have questions or comments about this Privacy Policy, please contact us at:
TeamOhana, Inc.
2261 Market Street STE 22606, San Francisco, CA 94114-1612
United States
Security inquiries: security@teamohana.com