LINEN Workforce Solutions Privacy Policy

Effective date: October 24, 2026

Linen is a workforce platform made by The Moonlit Company (“Moonlit”, “we”, “us”). This policy explains what information Linen handles, why, and the choices you have. It applies to the Linen app (app.linenhr.com), employee portals and careers pages hosted on Linen, and the Linen website.

1. Who is responsible for your information

Linen handles two kinds of information, and responsibility differs for each:

• Workspace data. When a company (our “Customer”) uses Linen, it adds information about its employees, contractors and job applicants. The Customer decides what goes in and how it’s used. For this data, the Customer is the controller, and Moonlit processes it on the Customer’s behalf and under its instructions. If you’re an employee or applicant and have questions about your record, contact your employer first. We’ll help them respond.
• Account and website data. For information about the people who sign up for and manage Linen, and about visitors to our website, Moonlit is the controller.

2. Information we handle
Account information. Name, work email address, password (stored securely and never in readable form) and the role you hold in a workspace (owner, admin, manager or viewer).

Workspace data a Customer adds, which may include:

• Personal and job details: name, work and personal contact details, title, team, manager, location, start date, employment type and status.
• Compensation: pay rate and pay type. Within a workspace, only owners and admins can see pay.
• Time off: requests, balances, approvals and notes.
• Attendance: clock-in and clock-out times, and whether a person worked at the office, remotely or elsewhere. Clock-in PINs are stored only in hashed form and lock after repeated wrong attempts.
• Performance: review cycles, self and manager reviews, and ratings.
• Onboarding: checklist tasks and their status.
• Company content: announcements, comments, events, RSVPs, forms and responses, and uploaded files.
• Hiring: job postings and the applications submitted through a Customer’s careers page, including CVs and answers to application questions.

Information collected automatically. When you use Linen we record basic technical information needed to run and secure the service, such as IP address, browser type, and the time and type of requests. We don’t use advertising or cross-site tracking.

Cookies. Linen uses cookies only to keep you signed in, to remember where to return you after sign-in or email verification, and to carry an invitation link through sign-up. We don’t use cookies for advertising. The Linen website doesn’t set tracking cookies.

3. How we use information
We use information to:

• provide, maintain and secure Linen, including signing people in, enforcing roles and permissions, and sending in-app notifications;
• connect an employee’s sign-in to their record in their employer’s workspace, using the email address their employer added;
• process applications submitted through a Customer’s careers page and share them with that Customer;
• respond to support requests and product demo bookings;
• detect, prevent and investigate abuse, fraud and security incidents;
• comply with legal obligations.

We process workspace data only to provide Linen to the Customer and as the Customer instructs. We don’t sell personal information, and we don’t use workspace data for advertising.

Where the law requires a legal basis, we rely on:

• performing our contract with the Customer;
• our legitimate interests in running and securing the service;
• compliance with legal obligations;
• consent, where we ask for it.

4. How information is shared
Within a workspace. What people see depends on their role, and we check this on our servers before any data is sent. For example, managers see their own team, and employees see their own record and company-wide content.
With service providers. We use third-party service providers to help us operate Linen, such as for hosting, data storage, authentication, email delivery, security and support. They may access personal information only as needed to perform services for us, and they’re bound by contractual obligations to protect it and to use it only on our instructions. We may change our service providers at any time.

For legal reasons. We may disclose information when required by law or legal process, or to protect the rights, safety or property of Moonlit, our Customers or others.

Business transfers. If Moonlit is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal, subject to this policy.

5. Payroll providers
Linen doesn’t run payroll today. If a Customer connects a payroll provider in the future, Linen will send that provider only the information the Customer chooses to sync, and the provider’s own terms and privacy policy will apply to it.

6. How long we keep information
We keep workspace data for as long as the Customer’s workspace is active, or as the Customer directs. When a Customer closes their workspace, we delete or anonymise its data within [90] days, except where we must keep it longer by law. Backups are overwritten on a rolling schedule of up to [35] days.

Applications submitted through a careers page are kept for as long as the Customer keeps them in Linen. Account information is kept while the account is active and for a reasonable period afterwards for security and legal purposes.

7. Security
We protect information with measures appropriate to its sensitivity:

• encryption in transit;
• access controls enforced on the server;
• restricting pay data to owners and admins;
• hashing clock-in PINs, with lockouts after repeated wrong attempts;
• limiting each account to a single company workspace.

No system is perfectly secure. If we become aware of a breach affecting your information, we’ll notify the affected Customer and, where required, you and the relevant authorities.

8. International transfers
We and our service providers may process information in the United States and other countries where we or they operate. Where the law requires it, we rely on appropriate safeguards for these transfers, such as Standard Contractual Clauses.

9. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal information, to receive a copy of it, and to withdraw consent.

• Employees and applicants: please contact your employer or the company you applied to. They control your workspace record, and we’ll support them in responding.
• Account holders and website visitors: contact us at legal@moonlit.company.

We won’t discriminate against you for exercising your rights. You may also complain to your local data protection authority.

10. Children
Linen is a workplace tool and isn’t intended for anyone under 16. We don’t knowingly collect information from children. A Customer whose workforce includes minors is responsible for meeting any legal requirements that apply.

11. Changes to this policy
We may update this policy from time to time. If changes are material, we’ll notify Customers by email or in the app before they take effect. The effective date at the top shows when it last changed.

12. Contact
Questions about this policy or your information: legal@moonlit.company