Privacy Policy

1. Introduction

Welcomeloom, LLC ("the Company," "we," "us," or "our") operates welcomeloom.com and the Welcomeloom onboarding automation platform (collectively, the "Service"). The Company is located at 756 West Peachtree Street NW, Suite 500, Atlanta, GA 30308.

This Privacy Policy explains what information we collect through the Service, how we use it, and the choices you have. Welcomeloom's core service processes new-hire onboarding data submitted by HR teams and their employees: employment eligibility records, contact details used to initiate I-9 paperwork, equipment-request information, and IT-provisioning parameters. This data is processed solely to automate onboarding workflows on behalf of our HR-team customers. We do not use onboarding document content to train AI models.

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Contact details (name, work email, phone) when you fill out a form, request a demo, register for a trial, or subscribe to updates;
• Company information you choose to share (employer, role, team size);
• New-hire onboarding data that HR-team customers enter or import into the platform: new hire name, start date, role, work location, shipping address for equipment, and employment eligibility information used to route I-9 workflows;
• The content of any messages you send us.

2.2 Information Collected Automatically

When you visit welcomeloom.com or use the platform, we automatically collect limited technical information:

• IP address and approximate location (city/region level);
• Browser type, operating system, device class;
• Pages visited, referring URLs, time on page;
• Cookie and similar identifiers (see Section 5).

2.3 We Do Not Knowingly Collect Children's Data

The Service is directed to HR professionals and is not intended for individuals under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

Welcomeloom uses information to operate and deliver the onboarding automation service. Specifically:

• Initiate and track the four onboarding workflow tracks (I-9, equipment, IT provisioning, Day-1 scheduling) on behalf of HR-team customers;
• Route I-9 packets to new hires and communicate document-completion status to HR teams;
• Transmit equipment requests to vendors and IT-provisioning triggers to connected systems;
• Send service updates, completion reports, and (with your consent where required) marketing communications;
• Respond to inquiries and support requests;
• Detect, investigate, and prevent fraud or abuse;
• Comply with legal obligations, including applicable employment-law requirements related to I-9 handling.

We do not sell personal information for monetary value. We do not use new-hire employment eligibility data for any purpose other than completing the onboarding workflow the HR customer initiated.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (hosting, email delivery, analytics) under contractual confidentiality terms;
• HRIS, ATS, IT, and vendor systems that our HR-team customers have configured as integration targets -- only the data fields required for that integration;
• Authorities, when required by law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy.

We do not sell personal information to third parties.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, maintain authenticated sessions, and measure usage. For details and choices, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as needed for the purposes described above. Onboarding workflow records are retained for the duration of the customer relationship plus 36 months, consistent with typical I-9 retention obligations that extend beyond employment termination. Marketing-list contacts who have not engaged are purged after 24 months. Server access logs are retained 90 days, then aggregated and anonymized.

7. Security

We use administrative, technical, and physical safeguards to protect personal information, including AES-256 encryption at rest, TLS encryption in transit, role-based access controls that limit HR data visibility by function, multi-factor authentication on all platform accounts, and audit logs for every workflow action. No system is perfectly secure; we cannot guarantee absolute security.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law.

9. Georgia Residents

Georgia does not currently have a comprehensive consumer privacy statute. As a matter of policy, the Company extends the following baseline rights to all U.S. residents regardless of state of residence.

9.1 Baseline Rights

• Right to Know: request the categories of personal information we have collected about you.
• Right to Delete: request deletion of personal information you have provided.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Marketing: unsubscribe from marketing emails or opt out via the link in each marketing message.

9.2 How to Exercise

Email [email protected] with a description of your request and enough detail for us to verify your identity. We respond within 45 days.

9.3 Sector-Specific Rights

If you are protected by federal sector laws (e.g., HIPAA, GLBA, FERPA), those laws may give you additional rights with respect to data covered by them.

California Visitors

If you are a California resident, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising.

To submit a CCPA / CPRA request, email [email protected] with the subject line "California Privacy Request."

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service.

11. Contact

Questions, requests, or complaints can be sent to: