Hammock Privacy Policy

Version 2.0 · Effective [date] · Last updated [date] · Prior versions: gethammock.com/legal/archive

This Privacy Policy explains how PXA LLC, a New York limited liability company doing business as Hammock (“Hammock,” “we,” “us,” or “our”), collects, uses, discloses, and protects information in connection with our websites, the Hammock platform (the Atlas web and mobile applications, the Eirene AI assistant, and the Hammock Connect integrations), and our services — finance operations and accounting, strategic finance, sales and use tax compliance, people operations and HR, business services, and technology services (together, the “Services”).

1. Who this Policy covers and our role

Hammock serves businesses (“Clients”). We handle two kinds of information, and our legal role differs for each.

Account and marketing data — Hammock is the controller (or “business”). Information we collect to create accounts, bill Clients, provide support, secure the Services, run our website, and market to prospects. We decide how and why it is processed.

Client Data — Hammock is a processor (or “service provider”). The financial records, documents, and personnel information a Client provides to us or that we access in the Client’s systems to do our work, including personal information about the Client’s employees, applicants, contractors, customers, and vendors. We process it on the Client’s behalf and under its instructions, as governed by our Terms of Service or Master Services Agreement, the Technology & Data Use Addendum, and, where applicable, our Data Processing Addendum.

If you are an employee, applicant, contractor, customer, or vendor of one of our Clients, the Client — not Hammock — is the controller of your information. Please direct privacy requests to that Client; we route any request we receive to the Client within five business days and help it respond.

This Policy does not cover the third-party services a Client connects to Hammock (for example, QuickBooks Online, Shopify, a payroll or HR platform, or a bank), which have their own privacy policies.

2. Information we collect

2.1 Account and marketing data (we are the controller)

• Account and identity data: name, business name, email, phone, role, authentication identifiers, profile details.
• Billing data: billing contacts, subscription and invoice history; payment card details are held by our payment processor (Stripe), not by us.
• Website and marketing data: information you submit in website forms (hosted by HubSpot), newsletter preferences, and business contact data from service providers and public sources.
• Usage, device, and log data: pages and features used, actions, timestamps, IP address, browser and device identifiers, app version, and diagnostic logs (see Section 9).
• Communications: messages, support requests, and what you tell our team, including inputs to the Eirene assistant.

2.2 Client Data (we are a processor)

Depending on the services a Client engages us for, Client Data may include:

• Financial and accounting data: ledgers, transactions, invoices and bills, receipts and uploaded documents, bank and card feed data (through Plaid or a Client’s bank), payroll registers, budgets, forecasts, tax filings, and sales-channel data — which may include personal information about the Client’s customers, vendors, and contractors.
• HR personnel data: for people operations and HR services, information about a Client’s employees, applicants, and contractors: names, contact details, job and compensation data, performance and employee-relations records, onboarding and offboarding records, and leave and benefits information.
• Sensitive personal information: HR and payroll work can involve Social Security and other government identification numbers, bank account details, immigration and work-authorization documents, health, medical, leave, and accommodation records, background-check results, and demographic or EEO data; finance work can involve financial account numbers. We treat these as Sensitive HR Data or financial account information, with the additional safeguards in Section 3.3.

2.3 Information from connected accounts and integrations

When a Client connects a third-party account, we receive data from it according to the scopes authorized — for example, accounting systems (QuickBooks Online, Centerbase), commerce platforms (Shopify, marketplace feeds), banking and card feeds (through Plaid), payroll and HR platforms the Client uses, and sign-in providers (Google, Apple).

2.4 Information collected automatically

Usage and log data, device and connection data, and cookies and similar technologies as described in Section 9.

3. How we handle Client Data

3.1 Only on the Client’s instructions

We use Client Data only to provide, secure, and support the Services the Client has engaged, as our agreement with the Client permits, and as described in the Technology & Data Use Addendum (Section 4 below). We do not sell Client Data or personal information, and we do not disclose identifiable Client Data to any other client.

3.2 Client-hosted by default

Much of our work happens inside the Client’s own systems — its accounting, payroll, HR, benefits, bank, and document platforms — using named accounts the Client controls and can revoke. Viewing and working with data in a Client’s system is still “processing,” and this Policy covers it. Our own systems hold work product and case notes with the minimum identifiers needed.

3.3 Sensitive HR Data and financial account information

• Sensitive HR Data stays in the Client’s own systems by default. We do not download or keep copies except as the next point allows.
• Where it does reach us (for example, an emailed attachment or a payroll setup file), it goes into a restricted, access-logged folder for that Client, limited to named personnel, and is moved to the Client’s system or deleted within 30 days after the task closes, and in all cases within 30 days after the engagement ends.
• We never use Sensitive HR Data for training, benchmarking, or any purpose other than the Services, and we do not give offshore or non-US personnel access to it.
• We ask Clients not to send Social Security numbers, bank details, or medical information by email or chat, and we provide a secure upload link instead.
• We do not record or transcribe conversations concerning individual employee-relations matters, medical or accommodation matters, or investigations.

4. Artificial intelligence, de-identified data, and benchmarking

AI-assisted work. We use artificial intelligence, machine learning, and automation tools to assist our personnel — to read documents, extract and categorize data, draft content, and surface insights — and to power features in the Platform such as Eirene. Our personnel review AI-assisted output before it is delivered as a deliverable. AI output is not professional advice and may be inaccurate or incomplete; Clients review it before relying on it. Our third-party AI providers (listed on the Sub-processors page) process inputs only to return outputs and are contractually prohibited from using Client Data to train their own models. We do not use AI to make decisions that produce legal or similarly significant effects about individuals without human review.

De-identified data, service improvement, and benchmarking. We may create de-identified data from Client Data — with direct identifiers removed and reasonably linkable identifiers removed or generalized so that it no longer identifies any individual or Client — and use it to operate and analyze the Services, to develop and improve Hammock’s rules, prompts, categorization logic, and statistical and analytical models, and to produce aggregated analytics and anonymized benchmarks (for example, how a Client’s expense ratios compare to an anonymized peer cohort of at least ten). We do not train or fine-tune machine-learning models on Client Data or de-identified data; if we propose to, we will update the Technology & Data Use Addendum and give at least 30 days’ notice first. Sensitive HR Data is never used for service improvement or benchmarking. Compensation data is used only in aggregate within cohorts of at least ten. We maintain controls against re-identification and do not attempt to re-identify de-identified data except to test those controls. Clients may opt out of the service-improvement and benchmarking uses at any time in the Technology & Data Use Addendum, in the Platform’s Privacy & Data settings, or by emailing privacy@gethammock.com; we exclude an opted-out Client from datasets built after the opt-out and remove it from future datasets within 30 days. These uses are described in detail, and acknowledged by Clients, in the Technology & Data Use Addendum at gethammock.com/legal/technology-data-use.

Meeting recording. We use a meeting notetaking tool (Recall.ai) only with the consent of every participant, asked for at the start of each recorded meeting. The notetaking tool deletes recordings and transcripts at the end of the retention period set for the meeting (7 days by default, never more than 28); the copy of a transcript held in Hammock’s systems is retained for 90 days and deleted on request, and summaries and action items prepared from it are kept as work product with the engagement record. Leadership-evaluation and coaching conversations are recorded only with the individual’s consent, and their transcripts are also stored in the Client’s system.

5. How we use account and marketing data

To provide and operate the Services and the Platform; to authenticate users and secure accounts; to bill and administer subscriptions and engagements; to respond to requests and send service notices; to detect, prevent, and investigate fraud, abuse, and security incidents; to analyze usage and improve the Platform; to comply with law and enforce our agreements; and, for business contacts, to market Hammock consistent with applicable law and your preferences (every marketing email includes our postal address and an unsubscribe link).

Legal bases where the GDPR or UK GDPR applies: performance of a contract; our legitimate interests in operating, securing, and improving the Services and in business-to-business marketing; consent where required (for example, non-essential cookies); and compliance with legal obligations.

6. How we share information

We share information only as described here. We do not sell personal information and do not share it for cross-context behavioral advertising as those terms are defined under U.S. state privacy laws.

• Sub-processors and service providers — cloud hosting and storage, AI providers, meeting transcription, payments, transactional email and notifications, error monitoring, communications tools, and website hosting and forms, each bound by contract to protect the data and use it only to provide services to us. The current list, with what each receives and where, is at gethammock.com/legal/subprocessors; Clients may subscribe there to 30 days’ advance notice of changes.
• Connected third parties — the systems a Client directs us to work in or integrate with.
• Within a Client’s organization — other authorized users of the Client’s account, per its roles and permissions.
• Our personnel — employees and contractors who perform the Services, bound by confidentiality and data-handling obligations; offshore development personnel have no access to production Client Data.
• Legal and safety — to comply with law or lawful requests, enforce our agreements, or protect the rights, property, or safety of Hammock, our Clients, or others; where lawful, we tell the affected Client first.
• Business transfers — in a merger, acquisition, financing, or sale of assets, subject to this Policy.
• With consent — for any other purpose disclosed at the time.

7. Payments

Subscription payments are processed by Stripe; bill payments and payroll for managed-service Clients move through the Client’s own bank, payment (for example, Bill.com), and payroll platforms. Hammock does not hold Client funds and is not a signatory on or owner of any Client account; where a Client gives Hammock personnel a user role in its payment or payroll platform, it is used only to release payments the Client has approved. Hammock does not store full payment-card numbers.

8. Data retention

9. Cookies and similar technologies

Our website (gethammock.com) uses only essential cookies and local storage needed to serve pages and keep forms working. Our contact and sign-up forms are hosted by HubSpot, which sets cookies when you interact with a form to associate your submission with your browser. We do not run advertising pixels or cross-site tracking on the website. If we add analytics, we will update this section and, where required, ask for consent.

The Platform (Atlas web and mobile) uses cookies and device identifiers that are essential for authentication, security, and preferences. Atlas mobile may use app analytics (Firebase Analytics) to understand how features are used; where enabled, this is disclosed in the app’s store listing and privacy settings, and it does not involve advertising identifiers. You can control non-essential cookies through your browser settings; some features require essential cookies to function.

Because we use no non-essential cookies on the website today, we do not show a cookie banner. We re-check our cookies and scripts quarterly and whenever the site changes.

10. Security

We maintain a written information security program with administrative, technical, and physical safeguards appropriate to the sensitivity of the information, designed to meet the New York SHIELD Act and other applicable law: multi-factor authentication, named individual accounts, encryption in transit and at rest in the Platform, least-privilege access, device encryption, access reviews, vendor review, logging, and an incident-response plan. No method of transmission or storage is completely secure, and we do not promise absolute security. If we confirm unauthorized access to or loss of Client Data in our possession, we notify the affected Client within 72 hours and support its notification obligations. Report security concerns to security@gethammock.com.

11. International transfers

We are based in the United States and process data in the United States. Some sub-processors may process data in other countries, as the Sub-processors page states. Where personal data subject to the GDPR, UK GDPR, or Swiss law is transferred to us or our sub-processors, we rely on appropriate safeguards — the EU Standard Contractual Clauses and the UK International Data Transfer Addendum — as set out in our Data Processing Addendum.

12. Your privacy rights

If your information is in a Client’s account or systems, contact that Client; we assist it in responding. For information where Hammock is the controller, email privacy@gethammock.com with “Privacy Request” in the subject. We verify your identity, respond within the time the law requires (45 days under U.S. state laws, 30 days under the GDPR/UK GDPR, extendable where permitted), and do not discriminate against you for exercising your rights. You may use an authorized agent.

12.1 U.S. state privacy rights

Residents of California and other states with comprehensive privacy laws may have the right to know and access, correct, delete, and obtain a portable copy of their personal information, and to opt out of sale, sharing for cross-context behavioral advertising, targeted advertising, and certain profiling. Hammock does not sell or share personal information and does not engage in targeted advertising or profiling with legal or similarly significant effects. We collect the categories of personal information described in Section 2 from the sources described there, for the purposes in Sections 3–5, and disclose them to the recipients in Section 6. Sensitive personal information (Social Security numbers, financial account information, health information) is used only to provide the Services and for the purposes permitted under applicable law; we do not use it to infer characteristics. To appeal a decision on a request, reply to our response and we will escalate it.

For Clients subject to the CCPA/CPRA, Hammock acts as a service provider: we process personal information only for the business purposes in our agreement; we do not sell or share it, retain, use, or disclose it outside the direct business relationship or for any purpose other than the Services, or combine it with personal information from other sources except as the law permits; we notify the Client if we can no longer meet these obligations; and we allow the Client to take reasonable steps to stop and remediate unauthorized use.

New York. Our security program is designed to meet the reasonable-safeguards requirement of the New York SHIELD Act, and we notify affected persons and authorities of breaches of “private information” as New York law requires.

12.2 EEA, UK, and Switzerland

If you are in the EEA, UK, or Switzerland, you have the rights under the GDPR and UK GDPR to access, rectify, erase, restrict, port, and object, and to withdraw consent at any time without affecting prior processing. Where Hammock is a processor, the Client is the controller and the point of contact. Where Hammock is the controller (account, billing, and website data), contact privacy@gethammock.com; you may also lodge a complaint with your supervisory authority. We have not appointed an EU or UK representative because our Services are directed to businesses in the United States.

12.3 Other countries

Where we serve Clients in other countries (for example, Canada or Kenya), the data-protection terms in the Client’s Data Processing Addendum apply, and we will add country-specific sections to this Policy before those engagements begin.

13. Children

The Services are for businesses and users 18 and older. We do not knowingly collect personal information from children; if you believe a child has provided information, contact us and we will delete it.

14. Third-party links and services

Links to and integrations with third-party sites and services are governed by their own policies.

15. Changes to this Policy

We review this Policy at least every 12 months and when our practices change. We post updated versions with a new “Last updated” date and archive prior versions at gethammock.com/legal/archive. For material changes we give notice by email or in the Platform at least 30 days before they take effect.

16. Contact

PXA LLC dba Hammock · 333 East Lancaster Ave, Unit 110, Wynnewood, PA 19096-1929 · privacy@gethammock.com (privacy requests) · security@gethammock.com (security) · accessibility@gethammock.com (accessibility) · legal@gethammock.com (legal notices) · support@gethammock.com (general)