Privacy Policy — OnboardTrack

Effective date: 10 October 2026 Last updated: 13 October 2026

1. Who We Are

Wisertrack Pte. Ltd. ("Wisertrack," "OnboardTrack," "we," "us," or "our") provides OnboardTrack, an employee onboarding platform available through our website and through your own connected AI assistant (the "Service").

This Privacy Policy explains what personal data we collect, why, how we use and safeguard it, and the choices and rights available to you. For questions, or to exercise any right described below, contact info@wisertrack.com.

1.1 Who is responsible for what

When your employer or another organisation sets up an OnboardTrack account (your "organisation"), that organisation determines why and how onboarding and personnel data about you is collected — for example, which fields it asks for, who can see them, and which country-specific statutory identifiers it records. Wisertrack processes that data on the organisation's behalf and according to its instructions, configured through the Service itself.

Wisertrack is directly responsible for account-registration data, marketing-site visitor data, platform-level security data, and the content of any feedback report you send us directly (Section 3.7).

If you're an individual with a question about how your specific organisation is using your data, we'd suggest starting with your organisation's administrator — they're best placed to answer, and can involve us if needed. Organisations that need a formal data-processing arrangement in place with us can request one by writing to info@wisertrack.com.

2. How OnboardTrack Handles Data — Our Core Commitments

OnboardTrack is built around a small number of deliberate data-handling commitments:

Sensitive identifiers are designed to be masked by default. Country-specific statutory identifiers (for example, a national tax or social-security number) are shown in masked form unless someone with the right permission explicitly reveals the full value.
Access to a restricted value is designed to be logged, whether the value is revealed or only viewed masked, for the organisation's own administrators to review — not for us.
No dashboards or reports are built by us. Any summary, chart, or report you see is generated on request by your own connected AI assistant from your organisation's live data; we do not store or generate report content ourselves beyond what's described here.
We do not send reminders, scheduled messages, or automated communications beyond the sign-in and invitation emails described in Section 3.9; receipts, invoices and any renewal reminders for paid plans come from our payment provider, not from us. Anything else — a welcome note, a follow-up — is sent, if at all, by your own connected assistant using your own separately connected tools, never by us.
Feedback you send us is designed to stay visible only to the Wisertrack team, not to other members of your organisation.

3. What We Collect

3.1 Account & identity data

Email address (used for sign-in; OnboardTrack has no passwords — see Section 3.9), and, if you sign in via Google, the identifiers Google shares with us to authenticate you.

3.2 Profile & employment data

Name (first, last, and, where supplied, middle name, maiden name, other names, and name-with-initials), phone number, job title, department, employee ID, start date, and your reporting relationship (who you report to, effective-dated so history is preserved).

3.3 Organisation & access data

The organisation(s) you belong to (a single login can belong to more than one, each treated as entirely separate), your permission level within your organisation (a fixed, non-customisable set of levels), and the history of invitations and access changes affecting your account.

3.4 Onboarding & task data

Onboarding templates, stages, and tasks; which tasks are assigned to you; task status (pending, complete, skipped) and, for a skipped task, the reason given; links to documents you or others attach to a task (OnboardTrack stores the link, not the file itself — we do not host document files).

3.5 Statutory and other person-data fields

Country-specific identifiers your organisation has configured (for example, a national tax or social-security number), recorded against your profile. Sensitive fields are designed to be masked by default and access is designed to be logged (Section 2). This applies only to country-specific statutory fields; OnboardTrack does not currently support organisation-specific custom fields.

3.6 History and audit records

Meaningful actions taken on your data (for example a task completed, an invitation sent or a reporting line changed) are recorded in an activity log, kept for twelve (12) months. Information that is itself part of your record, such as the history of your reporting lines and the outcome of your onboarding tasks, is kept for as long as your organisation's account is active. Each read of a restricted statutory field is recorded in an access log, also kept for twelve (12) months.

3.7 Feedback you send us

If you or your connected assistant send us a problem report, feature request, question, or general feedback, we keep the category, summary, and any details submitted, together with which organisation and, where applicable, which person sent it. This content is not shown to your organisation's administrators or any other member, and we do not guarantee a reply or a response time.

3.8 Device & technical data

IP address, browser type, and general diagnostic or crash information needed to keep the Service reliable and secure.

OnboardTrack has no passwords. You sign in with a one-time code emailed to your address, or with Google. We record sign-in and invitation-related emails sent to you as part of operating the Service.

3.10 Your connected AI assistant

OnboardTrack's core interface is your own AI assistant (for example Claude, ChatGPT, Gemini, or another MCP-compatible tool), which you choose and connect yourself. Once connected, your assistant can read and act on the data your permission level allows, on your instruction. The assistant you connect is a separate, independent service, governed by its own privacy practices — not ours. Anything that assistant does with the data after receiving it (how it processes your request, what it may retain in its own history) is between you and that assistant's provider. See Section 6 for more on this boundary.

OnboardTrack does not receive or store your conversations with your assistant. We receive only the requests your assistant makes to OnboardTrack on your behalf and the details included in them (for example, a person to add or a task to complete). We act on those requests and keep the resulting records as described in this policy, but we do not keep a separate copy of the requests themselves, apart from the technical data described in Section 3.8.

3.11 Cookies (website only)

Our public website may use strictly necessary cookies required for basic site functionality.

3.12 What we deliberately do not collect

We do not collect passwords (there are none), do not host uploaded document files, and do not collect organisation-specific custom-field data beyond the statutory catalog described in Section 3.5, and we do not collect the content of your conversations with your AI assistant.

3.13 Billing data

If your organisation subscribes to a paid plan or buys credits, we keep its plan, billing period, subscription status and plan history, the credits granted to it and used, and the customer and subscription references our payment provider gives us. Card and other payment details are collected and processed by our payment provider, not by us; we never receive or store card numbers. The provider handles that data under its own privacy policy and sends receipts and invoices directly.

4. How We Use Your Data

We use the data described above to: provide, operate, and maintain the Service, including responding to your connected assistant's requests according to your permission level; authenticate you at sign-in; send sign-in codes and invitation emails; administer subscriptions and credits; maintain the audit history described in Section 3.6; respond to feedback and support requests; improve reliability and usability; and meet legal obligations that apply to us and enforce our Terms of Service.

We do not sell personal data, and we do not use onboarding or personnel data to build advertising profiles or share it with data brokers.

Service providers who help us operate the Service — including infrastructure/hosting and transactional email delivery providers, described categorically here rather than by name to reduce unnecessary security exposure. Organisations that need the full specific vendor list for their own due-diligence can request it at info@wisertrack.com.
Our payment provider, which processes subscription and credit-pack payments for organisations that buy them and sends their receipts and invoices. Like our other providers it is described by category here; its name appears on every receipt.
The AI assistant you choose to connect (Section 3.10) — only the data your permission level allows, only in response to your own requests, and only after you've completed that assistant's own connection/authorisation step.
Your organisation's administrators, for data entered as part of your onboarding or employment, governed by your organisation's fixed permission levels and any reporting relationships configured within it.
Authorities, only where required by valid legal process and only to the extent required.
A successor entity, in the event of a merger, acquisition, or asset sale, subject to the same privacy commitments described here.

We do not share data with advertising networks.

6. A Note on Third-Party AI Assistants

OnboardTrack's design puts your own AI assistant at the centre of how you use the Service — this is intentional, and central to how the product works, not an incidental integration. Because of that, it's worth being explicit:

The Service is designed to control what data an assistant can see or change, based on your organisation's permission levels and the specific capabilities we expose.
We do not control what that assistant's own provider does with a request or a response once it leaves our systems as part of answering you — that is governed by the terms and privacy practices of the assistant you chose to connect, not by us.
Explanations, summaries, or dashboards your assistant generates from OnboardTrack data are produced by that assistant, not by us, and are not something we warrant the accuracy of. See our Terms of Service for how this affects what you can rely on.

7. Where Your Data Is Processed

Your data may be processed in more than one location by our infrastructure providers, depending on configuration. Where personal data moves across borders, we use reasonable, industry-standard contractual and technical safeguards with our service providers to protect it in transit and at its destination.

8. Data Retention

We keep personal data for as long as your organisation's account is active. When the account is closed, we delete its data within ninety (90) days, except as listed below or where the law requires us to keep it.

Activity log and access log: twelve (12) months, then deleted.
Records of acceptance of our Terms of Service and this Privacy Policy (who accepted which version, and when): six (6) years.
Billing records: for as long as Singapore tax and accounting law requires us to keep them, which is currently five (5) years after the end of the financial year to which they relate. Receipts and invoices held by our payment provider are kept under its own retention practices.
Backups: deleted data may remain in routine backups for up to fourteen (14) days before it is overwritten.

Where we honour a deletion request (Section 9), we use an anonymisation-based approach: personally identifying fields are irreversibly anonymised, while underlying records we're required to retain remain intact in anonymised form.

9. Your Choices & Rights

Depending on where you live, you may have rights that include access, correction, deletion, restriction, portability, objection, and withdrawal of consent, as described in general terms below. OnboardTrack does not currently offer a self-serve export or delete tool inside the Service — to exercise any of these rights, contact your organisation's administrator (if the data in question is theirs to manage) or write to us directly at info@wisertrack.com, and we will action or support the request as appropriate.

Depending on where you live, you may also have the right to raise a concern with a relevant privacy regulator in your jurisdiction.

On employment-related data specifically: where an organisation uses OnboardTrack to record its employees' or candidates' onboarding, personal, and statutory data, the organisation itself is responsible for having a valid basis for collecting and processing that data under the laws applicable to it, and for giving its people appropriate notice. We do not treat an individual's use of the Service, on its own, as sufficient to justify that processing — that responsibility sits with the organisation configuring and deploying the Service, consistent with the controller/processor allocation described in Section 1.1.

10. Security

We use reasonable, industry-standard efforts designed to protect personal data, including masking of restricted values, logging of access to them, role-based access enforcement, and an audit history of meaningful actions (Section 3.6). No system can be guaranteed 100% secure, and we make no absolute warranty to that effect, but security is treated as a first-order design requirement.

11. Children's Privacy

OnboardTrack is a workplace tool intended for use in connection with employment and is not directed at children. We do not knowingly collect personal data from children below the age at which local law requires parental consent. If we become aware that we've inadvertently collected such data, we will take reasonable steps to delete it.

12. Trademark Notice

Any third-party names, logos, or trademarks that may appear on our website or within the Service (for example, in connection with the AI assistants you can connect) are the property of their respective owners. None of these references imply any sponsorship, endorsement, or affiliation between Wisertrack and those owners.

13. Cookies (Public Website)

Our public website uses only strictly necessary cookies required for basic site functionality. We do not use third-party advertising or cross-site tracking cookies on the website.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app/website notice, with reasonable advance notice where the change reduces your rights, and the "Last updated" date above will be revised. Continued use of the Service after a change takes effect constitutes acceptance of the revised policy.

15. Contact Us

Wisertrack Pte. Ltd. Email: info@wisertrack.com