Log inGet started

Security and data

What we store, who sees it and where it lives

No jargon. This page describes what the product does today: what is stored, what isn't, the anonymity rules, how people log in and where data is hosted.

Data

What is stored and what isn't

We store what's needed for the person to see their trend and the company to see the team. Nothing more.

Stored

  • Check-in answers (energy, workload, mood and the other dimensions), linked to the person's account.So they see their trend and nothing is counted twice. Only ever shown aggregated.
  • Survey answers, with the team they belong to.Read as an aggregate with a threshold of 5. Open answers, without names.
  • Registration data: name, email or mobile number, site, team and role.Entered by the company or by the person when they log in.
  • Alerts, plans, recognition, courses and interest in benefits.Benefits are viewed as totals.
  • For QR access: the mobile number, the encrypted code with expiry and a fingerprint of the IP address.To limit attempts. Never the IP in clear.

Not stored

  • Screen recordings, automatic click capture or heatmaps.Disabled in usage analytics.
  • Location, clock-in and clock-out times or productivity.This isn't time tracking.
  • The person's email, calendar or messages.We don't connect to them.
  • Diagnoses or risk scores per person.They don't exist in the product. The HR assistant has them blocked.
  • The person's chat with the assistant, for HR.It's private. HR doesn't see it.

Roles

Who sees what

Four roles in the company. What each sees is fixed by the product, not by a setting that can be bypassed.

DataPersonManagerHR and admin
Individual check-in answerOnly their ownNoNo
Personal trendOnly their ownNoNo
Team score and dimensionsNoTheir team, with 5 responses or moreAll teams, with 5 responses or more
Survey resultsNoTheir scope, aggregatedAggregated, managers and staff separately
Who has answeredNoNo; only participation percentageNo; only participation percentage
Alerts and plansNoTheir team'sAll
Chat with the person's assistantOnly their ownNoNo

Anonymity

The rule of 5 and protection by difference

Threshold

Nothing is shown with fewer than 5 responses

Every cut (team, site, company and every survey) needs at least 5 responses in the period to appear. The company can raise that minimum; it can't lower it. If it isn't reached, it shows there's not enough data, with no counts.

  • Minimum of 5, fixed in the product
  • Per team, site, company and survey
  • Managers and staff, separately
See privacy and anonymity

Complementary suppression

It can't be worked out by subtracting either

If a team is hidden but its parent (the site) and its siblings are shown, subtracting would be enough to work it out. So when only one hidden cut with responses remains at a level, another small one is hidden too. It applies to the score, to each dimension and to the weekly series.

  • Calculated before anything is shown
  • Hidden cuts carry no counts
  • Answers without a team count as hidden

Access

How people log in without passwords

Two doors, depending on whether the person has corporate email.

Email invitation

For people with email. HR imports the staff or invites them; the person logs in from the invitation link.

Company QR code and SMS

The QR identifies the company, not the person. They enter their mobile number, get a 6-digit code that expires in 10 minutes and they're in. Attempts limited per phone and per address.

See more

Optional employee ID

If HR enables it, an ID from the company's list is requested along with the phone number. That way only people on the list get in. HR can disable the QR code at any time.

Analytics

We measure how the product is used, not people

To know which screens are used and what breaks, the app sends usage events to an analytics tool hosted in the European Union. It is configured with no session recording, no automatic click capture, no heatmaps and no pop-up surveys. The IP address is not sent.

Only an internal identifier travels for the user: neither the email nor the name. In the check-in the answers are buttons; that's why automatic capture is off: recording it would store what each person answered.

Hosting

Where the data lives

  • PostgresThe database is on Supabase, on PostgreSQL.
  • VercelThe application is served from Vercel.
  • EUUsage analytics is in PostHog's European region.
  • SMSAccess codes are sent with Twilio.

Each provider accesses only what it needs for its function. The full legal text is in the privacy policy.

Your rights

How to request access or deletion

If you work at a client company and want to know what data we hold about you or ask for it to be deleted, write to hola@bienestarhr.com from your email, or ask your company's HR. If you're HR and want to close the company account, write to us and the company's data is deleted with it.

When a person leaves the company, HR deactivates them and they stop counting as active. Their previous answers remain inside the period's aggregates, where they can't be identified.

Questions about security and data

Are my answers stored with my name?

They're stored linked to your account, so you can see your own trend and nothing is counted twice. But there is no screen that shows your answer to HR or your manager: only aggregated views with a threshold of 5 exist.

What happens with a team of fewer than 5 people?

It isn't shown. It counts towards its site and the company. And if hiding it would let someone work it out by subtracting from the total, another small cut is hidden too. Hidden cuts don't show counts.

Why do you ask for a mobile number for QR access?

Because it's the way to verify the person is who they say they are without corporate email or a password. The code expires after 10 minutes, attempts are limited and the code is stored encrypted with a one-way function.

Do you use screen recordings or heatmaps?

No. Usage analytics has session recording, automatic click capture and heatmaps disabled. Neither the IP address nor the email or name is sent, only an internal identifier.

How do I ask you to delete my data or my company's?

Write to hola@bienestarhr.com from your email or through your company. If you're HR and close the account, the company's data is deleted with it.

Start today

If you have a question that isn't here, write to us

hola@bienestarhr.com. We answer with what the product does, not with what we'd like it to do.

Get startedSee the FAQ
€3 per employee per month. No lock-in. No card to start.