Privacy Policy

WorkCentral by Kadir.ai (“WorkCentral,” “we,” “our,” or “us”) collects personal information to deliver HR platform services on behalf of your employer (“Employer Client”). We collect information in three ways:

Information provided by your Employer

• Full name, job title, department, and employee ID
• Work email address and work phone number
• Compensation, payroll, and benefits enrollment data
• Employment start date, status, and work location
• Performance review data and goal records
• Time and attendance records, PTO balances, and leave requests
• Documents uploaded by HR (offer letters, contracts, onboarding forms, I-9s)

Information you provide directly

• Profile information and preferences you update within the platform
• Self-service requests (time-off requests, benefits elections, expense submissions)
• Responses to surveys, performance check-ins, or engagement polls
• Documents and files you upload to the platform
• Support tickets and messages sent through in-platform communication features

Information collected automatically

• Login activity, session timestamps, and IP address
• Device type, operating system, and browser type
• Pages and features accessed within the platform
• Error logs and performance diagnostics

Information collected via the public website (workcentral.ai)

• Contact form submissions (name, email, company name, message)
• Demo request information
• Workforce Friction Index (FIS) assessment responses
• Website analytics data (via Google Analytics 4 and Google Tag Manager)

We use the information we collect for the following purposes:

Platform operations

• Providing, maintaining, and improving WorkCentral services
• Processing payroll and administering benefits on behalf of your Employer
• Managing time & attendance, scheduling, and leave requests
• Powering applicant tracking, onboarding, and document management workflows
• Generating performance reports, OKR dashboards, and learning progress tracking

AI-assisted features (when enabled by your Employer)

• Resume parsing and candidate screening via the ATS module
• Document classification and data extraction via Document AI
• Performance narrative drafting and survey summarization
• Workforce analytics, FIS scoring, and OKR progress reporting

Security and compliance

• Detecting, preventing, and investigating fraud or unauthorized access
• Maintaining audit logs for HR and regulatory compliance
• Verifying identity and enforcing role-based access controls

Communications

• Sending platform notifications, workflow alerts, and system messages
• Responding to support requests and inquiries
• Sending product update or administrative notices (not marketing without your consent)

Where applicable under data protection law (including GDPR for EEA users), we process personal data under the following legal bases:

• Contract performance — processing necessary to deliver services contracted by your Employer
• Legitimate interests — platform security, fraud prevention, product improvement, and aggregate analytics
• Legal obligation — payroll tax reporting, I-9 compliance, labor law record-keeping, and audit requirements
• Consent — where you have explicitly opted in (e.g., marketing emails submitted via the public website contact form)

For Michigan residents and U.S.-based employees, we comply with applicable federal and state laws including the Michigan Identity Theft Protection Act (MITPA), the Michigan Workforce Opportunity Wage Act, and where applicable, the California Consumer Privacy Act (CCPA/CPRA).

We do not sell your personal information. We may share information only in the following limited circumstances:

With your Employer

Your Employer is the primary data controller for HR data processed within WorkCentral. HR administrators and authorized personnel at your Employer organization can access your data in accordance with their own internal privacy policies and your employment agreement.

With sub-processors (service providers)

• Cloud infrastructure: Amazon Web Services (AWS) — hosting, compute, and object storage
• Database: Neon (serverless PostgreSQL) — encrypted data persistence
• AI processing: OpenAI API — AI-assisted features only (data is not used to train OpenAI models per enterprise data policy)
• Email delivery: Resend — transactional and notification emails
• Website analytics: Google Analytics 4 / Google Tag Manager — anonymous website usage analysis

All sub-processors are bound by data processing agreements requiring equivalent privacy and security protections.

For legal compliance

We may disclose personal information when required by law, regulation, court order, or government authority, or when necessary to protect the rights, property, or safety of Kadir.ai, our clients, or the public.

Business transfers

In the event of a merger, acquisition, or sale of all or substantially all assets, personal data may be transferred to the successor entity. We will provide notice via email or platform notification before your data becomes subject to a materially different privacy policy.

We implement industry-standard technical and organizational safeguards to protect your personal data:

• Encryption in transit: All data transmitted between your device and WorkCentral is encrypted via TLS 1.2 or higher
• Encryption at rest: Data stored in our databases is encrypted at rest using AES-256
• Access controls: Role-based access control (RBAC) ensures data is accessible only to authorized users and roles
• Audit logging: All access to sensitive HR data is logged, timestamped, and monitored
• Authentication: Session-based authentication with secure, HttpOnly cookies, CSRF protection, and optional MFA
• Infrastructure: Hosted on SOC 2 compliant AWS infrastructure in U.S. data centers
• Rate limiting & input validation: API endpoints are rate-limited and all inputs are validated to prevent injection and abuse
• Vulnerability management: We conduct regular security reviews and dependency audits

We retain personal data only as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce our agreements:

• Employee HR records: Retained for the duration of the employment relationship plus 7 years (or longer if required by applicable law)
• Payroll records: Minimum 7 years per IRS requirements and Michigan state law
• Job application data: 2 years after the position is filled (or indefinitely if the applicant is hired)
• Platform usage and audit logs: 12 months for security and analytics; longer if required for compliance investigations
• Website contact and FIS lead submissions: 3 years for sales and business development purposes
• Session data: Purged upon logout or after 30 days of inactivity

When an Employer terminates their WorkCentral subscription, HR data is retained for 90 days to allow data export and continuity, then securely deleted unless a longer retention period is required by law.

Depending on your location and applicable law, you have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete personal data
• Deletion: Request deletion of your personal data, subject to legal retention requirements
• Portability: Receive your data in a structured, commonly used, machine-readable format
• Restriction: Request restriction of processing in certain circumstances (e.g., while accuracy is disputed)
• Objection: Object to processing based on legitimate interests
• Opt-out: Unsubscribe from marketing emails at any time via the unsubscribe link or by contacting us
• Non-discrimination: We will not discriminate against you for exercising any of these rights

To exercise any privacy right, contact us at legal@kadir.ai or write to: Kadir.ai LLC, 1897 Van Courtland Dr, Troy, Michigan 48083. We will respond within 30 days.

The WorkCentral public website (workcentral.ai) uses cookies and similar tracking technologies:

Essential cookies

Required for the website to function correctly, including session management and security tokens. These cannot be disabled.

Analytics cookies

We use Google Analytics 4 and Google Tag Manager (GTM-TPTKGF89) to understand how visitors use our website — including pages visited, session duration, and general geographic region. No personal identifiers are shared with Google Analytics. Data is anonymized at collection.

No third-party ad cookies

We do not use third-party advertising or retargeting cookies on the WorkCentral website or platform.

Managing cookies

You can control or disable cookies through your browser settings. Disabling analytics cookies will not affect your ability to browse the public website. The authenticated WorkCentral platform uses session cookies only — no third-party tracking cookies are placed within the HR platform.

WorkCentral is an enterprise HR platform designed exclusively for use by adults in professional employment contexts. We do not knowingly collect or process personal information from individuals under the age of 16. If you believe a minor’s data has been inadvertently submitted to our platform, please contact us immediately at legal@kadir.ai and we will promptly investigate and delete the information.

We may update this Privacy Policy periodically to reflect changes in our practices, technology, legal requirements, or business operations. When we make material changes, we will:

• Update the “Last updated” date at the top of this page
• Notify Employer Clients via email at least 30 days before material changes take effect
• Post a banner or notification within the WorkCentral platform dashboard for active users

We encourage you to review this Privacy Policy periodically. Your continued use of WorkCentral after changes take effect constitutes acceptance of the updated policy.

For privacy questions, requests, or concerns, please contact us through any of the following:

Kadir.ai LLC — Legal
1897 Van Courtland Dr, Troy, Michigan 48083
Email: legal@kadir.ai
Website: https://workcentral.ai

We aim to acknowledge all inquiries within 5 business days and resolve them within 30 days.

This End User License Agreement (“Agreement”) is a legal agreement between you (“User”) and Kadir.ai LLC (“Company,” “we,” “our,” or “us”) governing your use of the WorkCentral application (“App”). By downloading, installing, or using the App, you agree to be bound by this Agreement. If you do not agree, do not install or use the App.

Subject to this Agreement, Kadir.ai grants you a limited, non-exclusive, non-transferable, revocable license to access and use the App solely for internal employment-related purposes as permitted by your Employer’s active subscription to WorkCentral.

You may not:

• Upload malicious files, scripts, or code to the platform
• Attempt to circumvent or bypass security controls or role-based access
• Attempt privilege escalation or unauthorized access to other users’ data
• Use the App to harass, discriminate against, or harm other individuals
• Reverse-engineer, decompile, or disassemble any component of the App
• Use the App in violation of applicable employment or data protection laws

Violation may result in immediate termination of access and may give rise to legal liability.

All intellectual property rights in the App — including software, design, content, trademarks, and the WorkCentral and Kadir.ai names and logos — belong exclusively to Kadir.ai LLC. This Agreement grants you a license to use the App, not ownership of it. No rights are transferred beyond the limited license expressly stated here.

The App is provided “AS IS” and “AS AVAILABLE.” Kadir.ai disclaims all warranties of any kind, express or implied, including warranties of merchantability, fitness for a particular purpose, non-infringement, and uninterrupted or error-free availability.

To the maximum extent permitted by applicable law, Kadir.ai shall not be liable for indirect, incidental, special, consequential, or punitive damages, lost profits, lost data, employment decisions made by your Employer, or data inaccuracies resulting from information provided by your Employer.

Our total aggregate liability shall not exceed the amount paid by your Employer to Kadir.ai for use of the App during the 12 months preceding the claim.

This Agreement terminates automatically if: (a) your Employer revokes your access or terminates their WorkCentral subscription; (b) you materially breach this Agreement; or (c) Kadir.ai discontinues the App. Upon termination, you must immediately cease all use. Sections D, E, F, and H survive termination.

This Agreement is governed by the laws of the State of Michigan, United States, without regard to conflict of law principles. You represent that you are not located in a country subject to a U.S. Government embargo and are not named on any U.S. Government prohibited party list.

Kadir.ai may update this Agreement periodically. When material changes are made, you will be notified through the App or by your Employer. Continued use after the effective date of changes constitutes acceptance of the updated Agreement.