1. Who this notice is for, and who is responsible

This notice explains how Colony Labs, Inc., doing business as Scribe (“Scribe”, “we”, “us", “our”), collects and uses personal information about people who apply to work with us, work for us, or provide services to us. In certain situations, we may provide additional "just-in-time" disclosures or additional information about our data processing practices.

It covers:

• Candidates — anyone who applies for a role with Scribe, or whom we approach about one, whether or not they are hired.
• Employees — people employed directly by Scribe, and people employed through an Employer of Record (“EOR”) or professional employer organization (“PEO”) who perform services for Scribe.
• Contractors — independent contractors, contractors engaged through a contractor-of-record provider (“COR”), consultants and their personnel, and temporary or agency workers who have access to Scribe's systems or premises.

Where this notice says something applies only to one of those groups, it says so.

This notice covers what Scribe does with your information and our HR systems, our IT and security systems, and the workflow analysis described in Section 4 because Scribe, in each case, decides the purposes and the means and manner of that processing. This notice applies to the personal information we collect and process about you for our own purposes (i.e., as a “controller”) before, during, and after your working relationship with us.

If you are employed or engaged through an EOR, COR or PEO, we may also act as a “data processor” for some of your personal information and that entity is your legal employer or the party engaging you and is separately responsible for its own handling of your information. It will give you its own privacy notice.

Scribe also collects information about people who use our products as customers or website visitors. That is covered by a different notice (Scribe’s Privacy Policy at https://scribe.com/legal/privacy) and is not addressed here. This notice does not form part of any contract of employment or other contracts to provide services. We may update this notice at any time, as described in Section 11.

2. What we collect

What we hold about you depends on your role and where you are. We group it as follows.

2.1 Information you give us

• Contact and identity information such as name, personal and work email, postal address, phone number, emergency contact and beneficiary details.
• Application information such as CV or résumé, work history, education and qualifications, references you nominate, portfolio or code samples, work authorisation and visa status, notes and assessments from interviews, and our record of your application.
• Employment or engagement information such as role, title, team, manager, start and end dates, location, contract terms, and the documents you sign at onboarding.
• Payment and transaction information such as bank account details, tax identifiers and withholding elections, and expense claims. For contractors, invoices and payment details. We also collect purchase and other transaction data from corporate credit or benefits cards and travel and trip-related information like flight and accommodation details, known traveler number, airline loyalty number, and meal preferences or assisted services requests (which may reveal sensitive information and which we use only to arrange your travel).
• Benefits and dependent information such as enrollment elections, and the names and details of dependents or beneficiaries you choose to enroll.
• Feedback and sentiment information such as your responses to employee surveys and other feedback you may provide about managers and co-workers via internal tools.
• Audio, video and image information such as your profile or badge photo, and recordings or transcripts of meetings where recording is enabled.
• Public functions, political offices, and trade union information such as personal information concerning the exercise of public functions and political offices, activities and trade union tasks, as well as personal information concerning the deductions for the payment of the trade union service fees or the subscription fees to associations or political or trade union organizations.

2.2 Information we generate as you work

• Employment records such as performance reviews and goals, promotion and compensation history, equity grants, training records, absence and leave records, and records of any grievance, investigation or disciplinary process you are involved in.
• Account and access information such as your Scribe account, the systems you have access to, and authentication and access logs.
• Communications such as messages you send using Scribe systems, meeting records, and internal survey or feedback responses.
• Workflow capture and product usage information described in Section 4.

2.3 Information we collect automatically

• Device and log information such as IP address, device identifiers, operating system and browser, application and system logs, security alerts, and endpoint management data from company-managed devices.
• Building access records where you use a badge or access system at a Scribe location.
• Location and inferred location information such as IP address and approximate geolocation.

2.4 Sensitive information

Some information about you needs extra care, and some of it we only hold because the law requires it or because you volunteered it. This includes:

• government identifiers such as social security number, tax or national ID numbers, passport and visa documents, and driving licenses;
• health information, where you request an accommodation, take medical or family leave, report a workplace injury, or enroll in health benefits;
• information about your race, ethnicity, gender, veteran status or disability, where you choose to provide it for equal-opportunity monitoring;
• the results of a background check, where we run one and where local law permits it;
• trade union membership, where relevant to your employment or required for deductions; and
• account log-in credentials for Scribe systems, which we process only to authenticate you and secure our systems.

We use this information only for the purpose it was collected for. We do not use sensitive information to infer characteristics about you. Where you give us equal-opportunity information, it is voluntary, it is kept separate from decisions about you, and we use it only in aggregate.

2.5 Information from other people

• References and background checks from the referees you nominate, from other professional contacts as described in your offer letter, and from a background check provider where we use one.
• Your EOR, payroll provider, benefits carriers and insurers such as payroll, tax, enrollment and claims information.
• Recruiting sources such as recruiters and agencies, and publicly available professional profiles.

3. How and why we use your information

The table below sets out what we do with your information, who it applies to, and, with respect to people in the European Union, United Kingdom, and other places where a legal basis must be identified, the basis we rely on. Where we rely on legitimate interests, we have weighed our interest against your privacy and concluded the processing is proportionate; you can ask us for that assessment.

We do not rely on your consent for the processing described above, except where local law requires it or where we say so. Because consent is often not considered freely given in an employment relationship, where we do ask for it (e.g., for voluntary self-identification), we ask separately, and refusing or later withdrawing consent will have no adverse consequence for you.

4. Using our own products to understand how work gets done

4.1 What we do and why

Scribe builds specialized intelligence products that document and analyse how work gets done to enable AI-led transformation and unlock powerful efficiencies at the team, division and organizational level. We use them ourselves. Doing so tells us where our own processes are slow, inconsistent or duplicated, helps us write better internal documentation, and makes our products better because we are our own most demanding user.

4.2 What Scribe’s specialized intelligence platform and products like Optimize and Autocapture collect

If you are enrolled, our agentic capture products run in the background on the business applications on our approved list and records how tasks are performed. It collects:

• screenshots of the application you are working in;
• the actions you take, such as clicks and navigation; and
• text you enter into fields in those applications.

Scribe is not intended to capture anything in applications outside the approved list, which our administrators control.

We do not capture:

• personal devices; Scribe runs only on company-managed devices, and we will not ask you to install it on a personal device;
• anything outside the approved application list; and
• outside working time when required by applicable law.

Where a screenshot would show sensitive data that Scribe administrators have determined should be redacted or blurred, our Smart Privacy Screen and other redaction tools are designed to remove it automatically. Automated redaction is not perfect, so access to raw capture data is also restricted as described in Section 9.

More details on the technical operation of Scribe’s platform and products can be found in the documentation made available in our product documentation, the Scribe Trust Center at https://trust.scribehow.com/, and in Scribe Help Center articles at https://support.scribehow.com/hc/en-us.

4.3 What we do with it, and what we do not

We do not use it to evaluate you individually.

We use this information to identify the workflows our teams run and to produce insights at the level of a workflow, a team or the organisation. For example, that a particular process is performed in four different ways across a team, or that a step is a bottleneck. We use those insights to redesign processes, write documentation and improve our processes and our products.

Specifically:

• we do not produce individual productivity, efficiency or performance scores;
• it does not feed performance reviews, pay, promotion, discipline or termination decisions;
• it is not used to decide how work is allocated or assigned to particular people; and
• managers see team-level insights, not individual activity. Capture data is pseudonymized by default, is re-identified only where there is a documented reason consistent with this Section 4.3 or Section 5, and any re-identification is logged.

If we ever wanted to use this information to make or inform a decision about an individual, we would change this notice and tell you before doing so, not afterwards.

This does not prevent us from accessing capture data where we need to investigate a security incident, comply with a legal obligation or lawful request, or establish, exercise or defend legal claims, as described in Section 5. Any such access is limited to what is necessary for that purpose.

4.4 Enrollment, notice and choice

Autocapture is enabled for named individuals, not silently across the company. Before we enable it for you:

• we will tell you, and give you this notice, before capture starts;
• we will tell you which applications are on the approved list; and
• you may decline, and you may ask us to switch it off at any time, without giving a reason and without any consequence for your job, your pay or how you are assessed.

4.5 Product usage information

Scribe’s products record how documentation is used: which documents you create, view and complete, and when. Administrators can see this at an individual level. We use it to keep documentation current, to confirm that required reading and training has been completed, and to understand adoption. We do not use it as a performance metric.

4.6 AI processing

We use AI to turn captured workflows into documentation and process insights. We use third-party AI model providers for this, acting as our service providers under contracts that do not permit them to use your information to train their models.

No decision about you is made by an automated system without a human being involved.

5. Other monitoring

Separately from Section 4, we monitor our systems to keep them secure. This includes device management on company-managed devices, logging of access and authentication, endpoint security tooling, and email and network security filtering. We do not read your messages as a matter of routine. We may access information on company systems where we need to investigate a security incident, respond to a legal obligation or lawful request, conduct an investigation under our policies, or maintain the systems. When we do so, we will limit access to what is necessary for that purpose.

This applies to devices and accounts we provide or manage. It does not extend generally to all of your personal devices, personal accounts or personal communications except to the extent you use a personal device to access Scribe systems (for example, through an authenticator app or device management profile), and we will not ask you for credentials to a personal account.

6. Who we share your information with

• Service providers who work for us like payroll and HRIS providers, benefits carriers and brokers, our EOR partners, background check providers where used, IT and security vendors, equity administration, and professional advisers. They may use your information only to provide services to us.
• Our affiliates, where needed to administer your employment or engagement.
• Your EOR or COR, where you are employed or engaged through one, so that it can meet its obligations as your legal employer/legal contracting entity.
• AI model providers, as described in Section 4.6.
• Government authorities like tax, employment, immigration and regulatory bodies, and in response to lawful requests, subpoenas or court orders.
• Others where necessary to establish, exercise or defend legal claims, to protect the rights, property or safety of Scribe or any person, or in connection with a financing, merger, acquisition or sale.
• People you ask us to share with, and anyone else with your consent.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

7. How long we keep it

We keep your information only as long as we need it, and we set retention periods by category rather than keeping everything indefinitely.

8. Where your information goes

Scribe is headquartered in the United States and our systems are primarily hosted there. If you are outside the United States, your information will be transferred to and processed in the United States, and may be accessible to our service providers in other countries.

Where the law of your country restricts those transfers, we put a recognised transfer mechanism in place. Which one depends on where you are, and the appendices explain. In general we rely on:

• European Commission standard contractual clauses, with the UK Addendum for the United Kingdom and the Swiss adaptations for Switzerland, together with a transfer risk assessment;
• the standard contractual clauses approved by Brazil's ANPD, which are a separate instrument and cannot be replaced by the EU clauses;
• the model contractual clauses issued by Colombia's SIC, together with your authorisation;
• the model contractual clauses approved by Argentina’s data protection authority;
• contractual clauses and, where relevant, the intra-group and contractual-necessity routes available under local law; and
• your consent, where local law requires it and you have given it.

The transfer mechanism for each region is set out in the appendices.

9. How we protect it

We use technical, physical and organisational safeguards appropriate to the sensitivity of your information, including encryption in transit and at rest, access controls on a need-to-know basis, logging and monitoring, vendor security review, and staff training. Access to workflow capture data is restricted to the small number of people who need it to produce process insights, and is logged.

No system is perfectly secure. If a breach affects your information and the law requires us to tell you, we will.

10. Your rights

Depending on where you are, you may have the right to ask us to:

• tell you what information we hold about you and why, and give you a copy;
• correct information that is wrong or incomplete;
• delete information, where we do not need to keep it;
• limit or object to how we use it, including our reliance on legitimate interests;
• give you a copy in a portable format, or send it to someone else;
• withdraw consent, where we relied on it, which does not affect what we did before you withdrew it; and
• not be subject to a decision made solely by automated means that significantly affects you.

You can exercise any of these by contacting us at [email protected]. We will not treat you differently for asking. We may need to verify your identity, and we will tell you if an exception means we cannot do what you have asked. Response deadlines differ by country and are set out in the appendices.

11. Changes

We may update this notice. If a change is material (e.g., we change what Section 4 says we do with workflow information) we will tell you before it takes effect, and we will seek your consent to the extent the law requires it.

12. Contact

Questions, requests or complaints can be submitted to [email protected], or Colony Labs, Inc., 427 Brannan St, San Francisco, CA 94107, Attn: Privacy. If you live in the European Economic Area (EEA), UK or Switzerland you may also contact our representative at [email protected] with questions about your rights under the GDPR, the UK GDPR or Swiss data protection law (FADP).

Our EU Representative:

Under Article 27 of the GDPR, we have appointed an EU Representative to act as our data protection agent.

Our nominated EU Representative is :

Instant EU GDPR Representative Ltd.
Adam Brogden
[email protected] Tel +35315549700
INSTANT EU GDPR REPRESENTATIVE LTD
Office 2, 12A Lower Main Street, Lucan Co. Dublin K78 X5P8, Ireland

Our UK Representative:

Under Article 27 of the UK GDPR, we have appointed a UK Representative to act as our data protection agent. Our nominated UK Representative is:

GDPR Local Ltd.
Adam Brogden
[email protected] Tel +44 1772 217800
1st Floor Front Suite
27-29 North Street, Brighton England BN1 1EB

Our Swiss Representative:

Under Article 14 of the FADP, we have appointed a Swiss Representative to act as our data protection agent. Our nominated Swiss Representative is:

ALTRION Sagl
Contact person: Adam Brogden; [email protected]
Tel.: +41 78 229 72 57
Address: Via Luigi Lavizzari, 8
Mendrisio - Switzerland

Appendices - Country-specific and State-specific information

These appendices add to the notice above. Where an appendix says something different from the main notice, the appendix will take precedence as it applies to you.

Appendix A - California

This appendix is our notice at collection under the California Consumer Privacy Act, as amended, and applies to candidates, employees and contractors in California.

A.1 Categories, purposes and retention

The categories of personal information we collect, the purposes for each, and how long we keep them are set out in Sections 2, 3 and 7 above, and are stated by category as the regulations require. We collect the following categories as those terms are defined in the CCPA: identifiers; personal information under Civil Code section 1798.80(e); characteristics of protected classifications; commercial information; internet and other electronic network activity information; geolocation data; audio, electronic and visual information; professional and employment-related information; education information; inferences; and sensitive personal information.

We do not sell your personal information and we do not share it for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes beyond those permitted by the CCPA, and we do not collect or process it for the purpose of inferring characteristics about you.

A.2 Your California rights

You may ask us to tell you what we collect and why, give you a copy, correct it, or delete it, and you may ask us to limit our use of sensitive personal information where that right applies. We will respond within 45 days and may extend by a further 45 days, telling you if we do. You may make a request yourself or through an authorized agent, and we may need to verify your identity and the agent’s authority. We will not retaliate against you for making a request.

Appendix B - Canada

B.1 Alberta and British Columbia

We collect, use and disclose your personal employee information where it is reasonable for the purposes of establishing, managing or terminating our working relationship with you, and we are giving you this notice of those purposes in advance as Alberta and British Columbia law require. We do not rely on your consent for that processing. You may ask us for access to your personal information; we will respond within 45 days in Alberta and 30 days in British Columbia, and will tell you if we need an extension.

B.2 Quebec

If you work in Quebec: before we activate any Scribe agentic Capture for you, we will tell you and tell you whether and how to switch it off. You may access, correct and port your information, and we will respond within 30 days. You can contact our person in charge of the protection of personal information at [email protected].

B.3 Ontario

If you work in Ontario and we have 25 or more employees there, we will maintain a written electronic monitoring policy and will give you a copy within 30 days of preparing or revising it, and within 30 days of your hire.

Appendix C - European Union, United Kingdom and Switzerland

If you are in the EU, the UK or Switzerland, the following applies in addition to the notice above.

C.1 Legal bases

The legal basis for each purpose is in the table in Section 3. Where we rely on legitimate interests, you may request details on the balancing assessment. Where we process special category data like health information for accommodations and leave, or trade union membership, we rely on the employment condition in Article 9(2)(b) together with the applicable national law, on your explicit consent where you have given it, or on the establishment or defence of legal claims. Where we process information about criminal convictions or offences (for example, in a background check), we do so only where authorized by applicable law.

C.2 Transfers

We transfer your information to the United States under the European Commission standard contractual clauses, with the UK Addendum or the Swiss adaptations as applicable, supported by a transfer risk assessment and supplementary measures. You may ask us for a copy of the clauses. Our systems are hosted in the United States and we do not currently offer regional hosting.

C.3 Workflow capture

Our use of agentic capture in the EU, the UK or Switzerland is subject to Scribe’s then-current data protection impact assessment, and where local law requires agreement with or consultation of a works council, union or employee representative body, we will obtain it first. We rely on our legitimate interests, not your consent, and you may object to the processing.

C.4 Rights

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right not to be subject to a solely automated decision with legal or similarly significant effects. We respond within one month and may extend by two further months for complex requests. You may complain to your local supervisory authority, or to the Information Commissioner's Office in the UK or the Federal Data Protection and Information Commissioner in Switzerland.

Appendix D — Australia

D.1 What applies

Some employee records are exempt from the Australian Privacy Principles, but that exemption does not cover candidates or contractors, and it does not affect the workplace surveillance requirements below. We apply this notice to everyone in Australia regardless.

D.2 New South Wales and the Australian Capital Territory

Agentic capture is computer surveillance under the Workplace Surveillance Act 2005 (NSW) and the Workplace Privacy Act 2011 (ACT). If you work in either place, we will give you at least 14 days’ written notice before it starts, telling you the kind of surveillance, how it will be carried out, when it starts, whether it is continuous or intermittent and whether it runs for a fixed period or ongoing. We also maintain a separate computer surveillance policy and will notify you of it in advance. If you are a new joiner, we will do this before you start work.

D.3 Rights and complaints

You may request access to and correction of your personal information; we respond within 30 days. You may complain to us and then to the Office of the Australian Information Commissioner.

Appendix E - Latin America, including Argentina, Brazil, Colombia and Panama

E.1 Argentina

We process your information under Law 25,326. The United States is not recognised by the Agencia de Acceso a la Información Pública as providing adequate protection, so we transfer your information under the model contractual clauses approved by AAIP Resolution 60/2016, or with your consent. You may request access to your information and we will respond within 10 days, and request rectification or deletion, to which we will respond within 5 business days. You may complain to the AAIP.

E.2 Brazil

We process your information under the LGPD, relying on performance of your contract, compliance with our legal obligations, and our legitimate interests. We do not rely on your consent for core employment processing. Where we process sensitive personal data we rely on legal obligation or, where required, your specific and highlighted consent. We transfer your information to the United States under the standard contractual clauses approved by the ANPD, as completed as set forth in the Scribe DPA at https://scribehow.com/legal/dpa, modified to reflect Scribe as the controller and not a processor and to reflect the details in the notice above in place of the customer agreement referenced in such DPA. You may exercise your rights under Article 18 and we will respond within 15 days.

E.3 Colombia

We process your information under Law 1581 of 2012 with your prior, express and informed authorisation, which we will ask you for separately. You are not obliged to authorise us to process sensitive information about you, including information about your health, and we will tell you which information is sensitive when we ask. You may exercise your rights by contacting [email protected] and we respond to queries within 10 business days and to claims within 15 business days, and you may complain to the Superintendencia de Industria y Comercio.

E.4 Panama

We process your information under Law 81 of 2019. We rely on the necessity of processing for your contract and on our legitimate interests, rather than on your consent, for core employment processing. We transfer your information to the United States under contractual clauses containing data protection safeguards and, where applicable, the intra-group transfer route. You may exercise your rights of access, rectification, cancellation, opposition and portability by contacting us, and you may complain to the Autoridad Nacional de Transparencia y Acceso a la Información.

Last Update: October 27, 2026