Privacy Policy
Last updated: 17 September 2026
This Privacy Policy explains how Softonoma ("Softonoma", "we", "us") collects, uses, stores, shares, and protects personal information. It applies to our public website at softonoma.com and to Staffly, our internal staff portal at portal.softonoma.com.
Softonoma is the data controller for the information described in this policy. If you have questions about anything here, contact us at contact@softonoma.com.
Who this policy covers
This policy covers two distinct groups, who give us very different kinds of information:
- Website visitors - anyone browsing softonoma.com or submitting our contact or newsletter forms.
- Staffly users - Softonoma employees and contractors who sign in to portal.softonoma.com to do their work. Staffly is an internal business tool. It is not offered to the general public, and accounts are created by Softonoma.
Information we collect from website visitors
We collect only what you choose to send us through the website, plus basic technical data our hosting provider records automatically:
- Contact form: your name, company name, email address, phone number, and the contents of your message.
- Newsletter form: your email address.
- Technical data: standard server and CDN logs such as IP address, browser type, referring page, and pages visited, used to keep the site secure and working.
We do not require you to create an account to browse the website, and we do not ask website visitors for payment details.
Information we collect in Staffly
Staffly is our internal portal for recruitment and business development work. For staff who use it, we hold account and profile details (name, work email address, role, and permissions), records of the work carried out in the tool such as candidates, interviews, attendance and related notes, and - only where a user chooses to connect one - information from their Google account as described in the next section.
Google user data
Staffly can connect to a user's Google account so that an interview booked in Staffly appears directly on that user's own Google Calendar, with the relevant documents attached. Connecting Google is optional and is always initiated by the user from their own profile page. Staffly works without it.
The Google permissions we request, and why
- openid and email - to confirm which Google account has been connected and show that address back to the user, so they can tell which account Staffly is using.
- https://www.googleapis.com/auth/calendar - to create the interview event on the user's own calendar, invite the interview guests, and attach the interview documents to that event.
- https://www.googleapis.com/auth/drive.file - to upload the interview documents to the user's Google Drive so they can be attached to the calendar event. This permission is limited by Google to files that Staffly itself creates. It gives Staffly no access to any other file in the user's Drive.
What we do with it
We use these permissions for one purpose only: creating and attaching documents to interview events that the user has asked Staffly to schedule. We do not read, index, collect, or store the user's existing calendar events or Drive files.
Documents that Staffly uploads to Drive for an interview are given "anyone with the link can view" permission, because the interview guests need to open the attachments from the calendar invitation. Please do not attach documents to an interview that should not be readable by someone holding that link.
What we store, and for how long
When a user connects Google, we store their Google account email address and the OAuth access and refresh tokens Google issues, so Staffly can create events later without asking the user to sign in every time. These tokens are held in our database, are reachable only by our server (never sent to a browser), are transmitted over TLS, and are encrypted at rest by our database provider.
We keep the connection until the user disconnects it, until the user's Staffly account is closed, or until Google invalidates it - whichever comes first. Disconnecting Google in Staffly, or removing Staffly's access from your Google account, deletes the stored tokens and Google account email from our database.
How to revoke access
A user can disconnect Google at any time from their Staffly profile page, or revoke Staffly's access directly from their Google Account at https://myaccount.google.com/permissions. Revoking access stops all future calendar and Drive activity. Events and files already created stay in the user's own Google account, under their control, and can be deleted there.
To request deletion of Google data we hold, email contact@softonoma.com and we will action it and confirm.
Limited Use disclosure
Softonoma's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular: we do not use Google user data for advertising, we do not sell it, we do not transfer it to third parties except as needed to provide the feature described above or where required by law, and we do not allow humans to read it except with the user's explicit consent, for security purposes, to comply with applicable law, or where the data has been aggregated and anonymised.
We do not use Google user data to develop, improve, or train generalised artificial intelligence or machine learning models.
How we use information
We use the information described above to respond to enquiries and provide proposals, to deliver and operate our services and the Staffly portal, to send newsletter updates where you have asked for them, to keep our systems secure and diagnose faults, and to meet our legal and accounting obligations. We do not sell personal information, and we do not use it for automated decision-making that produces legal effects.
Where the law requires a legal basis, we rely on your consent (newsletter), on the steps needed to enter into or perform a contract (enquiries and client work), on our legitimate interests in running and securing our business (Staffly and site security), and on compliance with legal obligations.
Sharing and service providers
We do not sell or rent personal information. We share it only with the service providers who help us run the website and the portal, under agreements that require them to protect it, and only as far as they need it:
- Website and portal hosting, and the content management system that stores our published website content.
- Our database and authentication provider, which stores Staffly accounts and records.
- Our email provider, which delivers contact-form enquiries and newsletter messages.
- Google, where a Staffly user has connected their Google account, as described above.
We may also disclose information where we are legally required to, or to establish, exercise, or defend legal claims.
Cookies and analytics
Our website uses cookies that are necessary for the site to function. Where we use analytics to understand how the site is used, it is loaded only where such measurement is permitted, and we configure it to avoid collecting more than we need. You can block or delete cookies in your browser settings; the website will still work.
Data retention
We keep enquiry correspondence for as long as needed to deal with the enquiry and for a reasonable period afterwards for our business records. Newsletter subscriptions are kept until you unsubscribe. Staffly records are kept for as long as the account is active and as required for our business and legal obligations. Google tokens are kept as described in the Google user data section.
Security
We protect personal information with measures appropriate to its sensitivity: encrypted connections (TLS) across our website and portal, encryption at rest for our databases, access controls and role-based permissions in Staffly, and restriction of credentials and tokens to server-side code. No system can be guaranteed perfectly secure, but we take these obligations seriously and review them as our systems change.
International transfers
Softonoma works with clients and staff in several countries, and our service providers may process data outside your country of residence. Where personal information is transferred internationally, we rely on the safeguards offered by those providers, such as standard contractual clauses, to keep it protected.
Your rights
Depending on where you live, you may have the right to access the personal information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent at any time where we rely on consent. To exercise any of these rights, email contact@softonoma.com. We will respond within the period the applicable law allows. You also have the right to complain to your local data protection authority.
Children
Our website and Staffly are intended for businesses and for our own staff. They are not directed at children, and we do not knowingly collect personal information from children. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as our practices or our systems change. The latest version is always published on this page, and the date at the top shows when it last changed. Material changes affecting Staffly users will also be communicated to them directly.
Contact us
Questions, requests, or complaints about this policy or our handling of personal information can be sent to contact@softonoma.com and we will get back to you.