Privacy Policy

1. Who We Are

Terio Ltd ("Terio", "we", "our", "us") provides an AI-powered HR information system designed for small and medium-sized businesses in the United Kingdom. We are the data controller in respect of personal data we collect directly from you, and a data processor in respect of employee data that our customers provide to us through our platform.

For any queries relating to this policy, please contact us at: privacy@terio.ai

2. What Personal Data We Collect

When you create an account or use our platform as an HR administrator or manager, we collect:

• Your name and email address
• Your employer and job title
• Login credentials (password stored as a secure hash, never in plain text)
• Communications you send us, including support requests

2.2 Employee data processed on behalf of customers

When our customers use Terio to manage their workforce, they provide us with data about their employees. This may include:

• Full name, job title, team, and manager relationships and reporting lines
• Employment start date, end date, probation period, and contract type
• Working hours, working pattern, and working location
• Salary, hours per week, and contract documents (where the administrator enables this)
• Annual leave entitlement, bookings, and carry-over
• Sickness absence records, including return-to-work conversations and any reasonable adjustments discussed
• Disciplinary records: investigations, warnings, suspensions, and appeals
• Grievances raised by or about an employee, deliberately restricted so the person a grievance is about can never see or act on it, even as an administrator
• Occupational Health referrals and Performance Improvement Plans
• Personal details where the administrator records them: gender, personal phone and email, home address, and National Insurance number (this last one stored so the platform itself never has access to the plaintext number, see Section 10)
• Emergency contact details
• Documents generated by or uploaded to the platform (contracts, letters, policies)
• Chat conversations with Terio’s assistant, and any HR company policy documents the customer uploads

3. Our Legal Basis for Processing

We process personal data on the following legal bases under UK GDPR: contract (to provide the service you signed up for), legitimate interests (to maintain security and improve the platform), legal obligation (where required by UK law), and consent (which you may withdraw at any time by contacting privacy@terio.ai).

For special category data such as sickness absence records, we rely on Article 9(2)(b) of UK GDPR, processing necessary for employment law obligations, acting on the instruction of our customers as data controllers.

4. How We Use Your Data

We use the data we collect to:

• Provide, operate, and maintain the Terio HR platform
• Authenticate users and maintain account security
• Process HR queries through our AI assistant
• Generate HR documents and reports on behalf of administrators
• Send service communications including security alerts and product updates
• Improve and develop our products and features
• Respond to support requests
• Comply with legal obligations

5. AI Processing

Terio uses artificial intelligence to interpret HR queries, generate responses, and draft HR documents. Relevant employee data may be provided to our AI provider (OpenAI) to generate accurate responses. This data is transmitted securely and is not retained by OpenAI beyond the duration of the request.

We do not use employee data for training AI models. Every write action, recording an absence, issuing a warning, approving leave, and so on, requires explicit confirmation from an authorised human user before any data is written or document generated; the AI never acts unprompted. Common, routine actions (for example approving a leave request, or closing the company for a date range) are increasingly handled by ordinary application code rather than sent to an AI model at all, which reduces how much employee data reaches a third-party AI provider in the first place.

Each customer is subject to a daily spending cap on AI usage, both per person and across the company, which also limits the volume of data any single account can send to an AI provider in a day.

6. Our Sub-Processors

We use the following third-party sub-processors, all contractually required to handle data securely and in accordance with UK GDPR:

• Supabase (Supabase Inc.): database, authentication, and file storage, hosted in the EEA
• Vercel (Vercel Inc.): application hosting
• OpenAI (OpenAI LLC): AI language model, data not retained for training
• Resend (Resend Inc.): transactional email delivery

7. How Long We Keep Your Data

• Account data: retained for the duration of your subscription, deleted within 30 days of account closure on request
• Employee records (profile, contract, leave history, documents): kept for the whole of someone’s employment and for 6 years after they leave. The period is a setting for each customer, and 6 years is the default
• Absence, disciplinary, investigation, and grievance records: kept for the whole of an employee’s employment and, once they leave, for a further six years, in line with standard UK employment record-keeping practice. This retention is set at the record type, not the account, so it is not affected by an administrator otherwise removing the employee sooner
• Chat conversations with Terio: kept for 2 years from the last message. Deleting a conversation only hides it from you; it is not removed, because conversations about absence, grievances and similar matters may be needed as a record
• Technical logs: retained for up to 90 days
• Billing records: retained for 7 years for UK tax compliance

8. Your Rights Under UK GDPR

You have the right to access, rectify, erase, restrict, port, and object to processing of your personal data. To exercise any right contact privacy@terio.ai. We will respond within one month at no charge.

If you are not satisfied with how we handle your data you may lodge a complaint with the Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.

9. Information for Employees of Our Customers

If your employer uses Terio, your employer is the data controller for your personal data within the platform. Direct data subject requests to your employer in the first instance.

If you believe your data has been processed unlawfully within the Terio platform, you may also contact us at privacy@terio.ai.

10. Security

• All data encrypted in transit using TLS 1.2 or higher
• Database data encrypted at rest, and National Insurance numbers additionally held in a separate encrypted secrets store rather than in the main record
• Row-level security enforced at the database itself, not just in the application, so each customer only ever accesses their own company’s data
• Role-based access controls throughout the platform: an employee sees only what concerns them, a manager only their own reporting line, and sensitive personal fields are restricted to the employee themselves, their line manager, or an administrator
• Access to our own internal admin tools is restricted to a fixed, named allowlist of Terio staff, using a one-time emailed sign-in link rather than a shared password

11. International Transfers

Our primary database is hosted in the EEA. Transfers to US-based sub-processors (OpenAI, Vercel, Resend) are made under Standard Contractual Clauses or equivalent UK-approved transfer mechanisms.

12. Cookies and Local Storage

Terio uses strictly necessary cookies to maintain your session when logged in. If you tick "Remember me" when signing in, that cookie stays on your device for longer instead of clearing when you close your browser.

If you tick "Remember me", we also store your email address in your browser’s local storage so it is filled in for you next time. This stays on your own device, is never sent to us, and you can clear it at any time by unticking the box and signing in again, or by clearing your browser’s site data.

We do not use cookies or local storage for advertising, tracking, or analytics purposes.

13. Changes to This Policy

We will notify customers by email at least 14 days before any material changes take effect. The current version is always available at terio.ai/privacy.

14. Contact

For any questions relating to this policy contact privacy@terio.ai or visit terio.ai/privacy.

Questions about this policy? Contact us at privacy@terio.ai

Terio Ltd · Registered in England and Wales · Terms of Service