Privacy Policy

Chroneme, Inc. (“Chroneme,” “we,” “us,” or “our”) operates the website at chroneme.com. This Privacy Policy describes what information we collect through the website, how we use it, how we protect it, and your rights regarding that information.

Chroneme, Inc. is incorporated in Delaware with its principal office at 34100 Woodward Ave #310, Birmingham, MI 48009.

Information we collect

Job applications

When you apply for a position, we collect your name, email address, phone number (if provided), LinkedIn URL (if provided), the text of your application note, your resume, and any additional files you upload. We also record the position applied for, date and time of submission, device type, and referring website. If you choose to complete the voluntary self-identification form, we collect gender, race/ethnicity, veteran status, and disability status. This demographic data is stored separately from your application and is never used in hiring decisions.

Contact form

When you submit the contact form, we collect your name, email address, organization (if provided), role category (if selected), and the text of your message.

Website analytics

We collect anonymous usage data to understand how visitors interact with the website. This includes the page visited, the referring URL, screen width, device type, scroll depth, time spent on each page, and UTM campaign parameters from the URL. We generate two anonymous identifiers by hashing your IP address and browser user agent using one-way SHA-256 hashes: a daily session identifier (which resets each calendar day) and a visitor identifier (which persists across visits to help us understand return visitor patterns). We also store a one-way hash of your IP address (12-character SHA-256 prefix) for deduplication. These hashes cannot be reversed to identify you. We do not store your raw IP address.

We determine approximate geographic location (country, city, and city-level coordinates) and the organization associated with your IP address using a locally hosted MaxMind GeoLite2 database. This lookup happens entirely on our servers; your IP address is not transmitted to any third party for geolocation. The organization field identifies the company, university, or network that owns your IP address block (from publicly available IP registration records). This data helps us understand the geographic and institutional distribution of our audience.

We do not use cookies, pixels, local storage, session storage, or any third-party tracking scripts.

Visitor engagement analysis

We analyze visitor behavior patterns, including visit frequency, recency, pages viewed, and time spent, to compute aggregate engagement metrics. We may flag visitors who view certain pages (such as our evidence or careers pages) as “high-intent” to understand which content resonates with our audience. We may also identify the organization associated with your IP address (such as a company, university, or hospital) using publicly available IP registration records. This does not identify you personally: it identifies the network you are connecting from. These metrics are accessible to administrators and are used solely for internal analytics. They are not used for advertising, targeting, or automated decision-making.

Private portal

We operate an invitation-only portal for authorized collaborators including board members, advisors, employees, and partners. If you have been granted portal access, we collect and log your activity within the portal, including: sign-in events, pages and applications accessed, documents viewed or downloaded, session duration, device type, IP address, and approximate geographic location. This data is used for security monitoring, access auditing, and understanding how the portal is used.

Portal access may be restricted from certain geographic regions to comply with U.S. export control regulations and to protect confidential intellectual property. When access is blocked or flagged due to geographic restrictions, a security notification containing your email address and location is sent to our team. Sign-in links are delivered via email (Microsoft 365) and contain a secure token valid for 15 minutes.

The terms of portal use are governed by the Confidentiality Agreement presented at sign-in.

Information we do not collect

This website does not collect health information, medical records, insurance information, Social Security numbers, financial information, biometric data, or any information from minors. We do not run Google Analytics, Facebook Pixel, or any similar third-party analytics service.

How we use your information

• Job applications: to evaluate your candidacy for current and future positions, to contact you about your application, and to communicate hiring decisions.
• Contact form submissions: to respond to your inquiry and to maintain a record of our communications.
• Analytics: to understand how visitors use the website, to measure the effectiveness of our communications, to analyze visitor engagement patterns, and to improve the website.
• Voluntary self-identification data: solely for aggregate diversity reporting. Never used in hiring decisions. Never associated with individual applications in any review process.

We do not use your information for advertising, marketing, or profiling. We do not sell, rent, lease, or trade your personal information to any third party for any purpose. We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects concerning you.

Legal basis for processing

We process personal data under the following legal bases:

• Legitimate interest: website analytics, website security, and fraud prevention.
• Consent: analytics tracking for visitors in jurisdictions that require consent (such as the EEA and UK). You may withdraw consent at any time.
• Contractual necessity: processing job applications where you have applied for a position.
• Legal obligation: where we are required to retain or disclose data by law.

Data storage and security

Personal data is stored in a hosted PostgreSQL database provided by Supabase, Inc. with servers located in the United States. Resume files are stored in encrypted cloud storage provided by the same service. The website is hosted on Google Cloud Platform (Cloud Run) in the United States. All data is encrypted in transit using TLS 1.2 or higher and encrypted at rest. Access to personal data is restricted to authorized members of the Chroneme team through role-based access controls and secure authentication.

We maintain data processing agreements with all sub-processors that handle personal data on our behalf. No system is completely secure. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities within 72 hours of becoming aware of the breach, or as otherwise required by applicable law.

Data sharing

We do not sell personal information. We share personal data only with the following categories of recipients, and only as necessary to operate the website and process applications:

• Supabase, Inc. (database and file storage, United States)
• Microsoft Corporation (email delivery via Microsoft 365, United States)
• Google Cloud Platform (website and API hosting, United States)
• MaxMind, Inc. (GeoLite2 geolocation database, United States): we use a locally hosted copy of the MaxMind GeoLite2 database to determine geographic location and organization from IP addresses. Your IP address is not transmitted to MaxMind; all lookups are performed on our servers using a downloaded database file.

We may also disclose personal data if required by law, regulation, subpoena, court order, or other legal process, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

A current list of sub-processors is available upon request by emailing privacy@chroneme.com. We will provide reasonable advance notice before engaging new sub-processors that process personal data.

Data protection assessments

Where required by applicable law, we conduct data protection impact assessments before initiating new processing activities that may result in a high risk to individuals’ rights and freedoms.

Data retention

• Job applications and resumes: 2 years from the date of submission, unless you request earlier deletion or are hired (in which case your application becomes part of your employee record).
• Voluntary self-identification data: retained for as long as the associated application, then deleted.
• Contact form submissions: 1 year from the date of submission.
• Analytics data: 1 year, after which individual records are deleted and only aggregate statistics are retained.
• Portal activity logs (sign-ins, document access, session data): 1 year.
• Rate-limiting data (IP addresses used to enforce request limits): stored temporarily in memory and not persisted to disk.
• Application logs (server-side): 30 days, after which they are automatically deleted.

International data transfers

All data is processed and stored in the United States. If you are located outside the United States, including in the European Economic Area (EEA), United Kingdom, or Switzerland, your data will be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other legally recognized transfer mechanisms, to ensure that your data is protected when transferred internationally. By using this website or submitting information to us, you acknowledge this transfer.

Your rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete information.
• Delete your personal data (“right to be forgotten”).
• Restrict or object to the processing of your data.
• Receive a copy of your data in a structured, machine-readable format (data portability).
• Withdraw consent at any time where processing is based on consent.
• Lodge a complaint with your local data protection authority.
• Opt out of the sale or sharing of personal information (we do not sell or share personal information, but you may exercise this right for the record).

To exercise any of these rights, email privacy@chroneme.com. We will verify your identity and respond within 30 days (or sooner if required by applicable law). We will not discriminate against you for exercising your privacy rights.

United States state privacy laws

Residents of California (CCPA/CPRA), Colorado (CPA), Connecticut (CTDPA), Virginia (VCDPA), Utah (UCPA), Texas (TDPSA), and other states with comprehensive privacy laws have additional rights as described above. We do not sell personal information. We do not use personal information for targeted advertising. We do not process sensitive personal information beyond what is described in this policy. To exercise your rights under any state privacy law, contact privacy@chroneme.com. If we deny a privacy request, you may appeal by emailing privacy@chroneme.com with the subject line “Appeal.”

Categories of personal information (CCPA disclosure)

Sensitive personal information

Voluntary self-identification data (race/ethnicity, disability status, veteran status) constitutes sensitive personal information under CPRA and certain state privacy laws. We process this sensitive personal information solely for the purpose of aggregate diversity reporting as described in this policy. We do not use sensitive personal information to infer characteristics about you or for any purpose beyond what is disclosed here.

European Economic Area and United Kingdom

If you are located in the EEA or UK, the General Data Protection Regulation (GDPR) and UK GDPR apply to your data. Our legal bases for processing are described above. You have the right to lodge a complaint with your local supervisory authority. For GDPR-related requests, contact privacy@chroneme.com.

Do Not Track

Some browsers transmit a “Do Not Track” (DNT) signal. We do not currently respond to DNT signals. However, our analytics system does not use cookies or cross-site tracking. Session identifiers are anonymous and expire daily. Visitor identifiers are non-reversible hashes that cannot be linked to your identity.

Children

This website is not directed at individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has submitted information through this website, contact us at privacy@chroneme.com and we will delete it promptly.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the effective date at the top of this page and, where required by law, notify you by email or through a prominent notice on the website. Your continued use of the website after any changes constitutes acceptance of the revised policy.

Contact

For questions about this privacy policy or your personal data, contact us at privacy@chroneme.com.

Chroneme, Inc.
34100 Woodward Ave #310
Birmingham, MI 48009
United States