Privacy Policy

In short: • Recruiters use Hirecruite to invite candidates to structured interviews. Candidates respond by text, audio, or video. • An AI system generates questions, transcribes speech, and produces draft scores. A human recruiter reviews the results before any hiring decision is made. • We record interviews only with your explicit consent. Recordings, transcripts, and scores are shared with the recruiting organization that invited you. • We do not sell your personal information and we do not use your interview content to train our AI models. • You can ask to access, correct, export, or delete your personal information at privacy@hirecruite.com.

This Privacy Policy explains how Hirecruite ("we," "us," or "our") collects, uses, shares, and protects personal information in connection with our website and interview platform (the "Service"). Hirecruite is operated from Canada and is subject to Canadian privacy law. We extend equivalent protections to users in the European Economic Area (EEA), the United Kingdom, and the United States. This policy applies to two main groups: • Recruiters and hiring teams who use the Service to run interviews ("Customers"); and • Candidates who complete interviews on the Service ("Candidates"). For Candidate interview content (resumes, recordings, transcripts, scores), the inviting Customer is the data controller and Hirecruite acts as a processor on their behalf. For account information, billing, and Service usage data, Hirecruite is the controller.

We collect the following categories of personal information: 1) Account and contact information • Name, email address, role, organization name, hashed password, and profile details for Customers. • Name, email, phone, location, and resume for Candidates (typically uploaded by the inviting Customer). 2) Interview content and submissions Depending on the interview mode and the Customer's configuration, we collect: • Video recordings submitted during the interview. • Audio recordings and the speech-to-text transcripts generated from them. • Text answers, written responses, and code submissions. • Interview metadata (timestamps, question identifiers, status, attempts). 3) Integrity and proctoring signals • Multimodal proctoring signals derived from interview media (for example, indications of multiple speakers or off-screen activity). • Client-side integrity events from the interview page (tab switching, window focus loss, copy/paste attempts, developer-tools attempts, exit-fullscreen events, page reload attempts). 4) Device, usage, and technical data • IP address (and the approximate region derived from it), browser and device identifiers, language, time zone, and diagnostic logs needed to operate, secure, and improve the Service. 5) Communications • Records of your support requests and other communications with us.

We use personal information to: • Create and manage accounts and provide the Service. • Run interviews, generate transcripts, and produce draft assessments and integrity reports for the inviting Customer. • Detect, investigate, and prevent fraud, abuse, and security incidents. • Provide customer support and respond to your requests. • Maintain, debug, and improve the Service through aggregated usage analytics. • Comply with legal obligations and enforce our terms.

Hirecruite is an AI-assisted interview platform. You should be aware of the following: • Interviews are conducted and initially scored by an AI system, not a human. The AI generates interview questions, transcribes audio responses, and produces draft scores and a draft recommendation based on the responses and the resume. • Draft outputs are made available to the recruiting organization. Hiring decisions remain the responsibility of the Customer; we do not make hiring decisions on the Customer's behalf. • AI evaluation considers the content of your answers, code submissions, transcript content, and proctoring signals. It is not designed to evaluate physical appearance, accent, gender, race, or other protected characteristics, and we monitor for outcome disparities. • You have the right to request human review of an AI-generated assessment that significantly affects you, and an explanation of how the assessment was produced. To exercise this right, contact us at privacy@hirecruite.com or contact the recruiting organization directly. • We do not use your interview content to train our own AI models. We use third-party AI providers for evaluation, proctoring, and speech-to-text transcription under enterprise terms that, where applicable, do not permit those providers to use your content to train their general-purpose models. A current named list of these providers is available on request.

If your interview is configured for audio or video, we will record your responses. Before recording begins, you will be asked to provide explicit consent and you may decline. If you decline recording, you may not be able to complete that interview format and the recruiting organization may not be able to evaluate your application through the Service. Voice and video recordings, and signals derived from them (such as speaker diarization), may be considered biometric data under certain laws. We process this data only to: • Capture your interview responses for the recruiting organization to review; • Generate transcripts and AI-assisted assessments; and • Detect interview-integrity issues such as multiple speakers, off-screen activity, or cheating attempts. We do not use biometric data for identity verification, advertising, profiling outside the interview context, or sale to third parties. You may withdraw consent for further processing of your recordings at any time by contacting privacy@hirecruite.com.

Where the GDPR or UK GDPR applies, we rely on the following legal bases: • Contract to provide the Service to you or to the inviting Customer. • Consent for recording your interview, processing biometric data derived from recordings, and for non-essential cookies. You may withdraw consent at any time without affecting prior processing. • Legitimate interests to secure the Service, prevent fraud and abuse, and improve the Service through aggregated analytics, balanced against your rights and interests. • Legal obligation to comply with applicable laws and lawful requests. Where PIPEDA applies, we rely on your knowledge and consent (express where required, including for sensitive information such as biometric and recording data) and on the limited exceptions PIPEDA permits (for example, to investigate a breach of an agreement or to comply with law).

We store and process information using the following systems: • Account information, interview records, assessment results, and integrity events are stored in a managed relational database hosted with a third-party cloud provider. • Resumes, audio recordings, video recordings, and other interview media are stored in encrypted object storage in a private bucket. Files are accessed using time-limited signed URLs. • Service logs are stored in our application infrastructure for a limited period for operational, debugging, and security purposes. We protect personal information using encryption in transit (TLS), encryption at rest, role-based access controls, audit logging, and the principle of least privilege. No system is perfectly secure, but we work to apply safeguards proportionate to the sensitivity of the data.

We do not sell your personal information and we do not share it for cross-context behavioural advertising. We share personal information with: • The recruiting organization that invited you (Candidate interview content, transcripts, scores, and integrity reports). • Subprocessors that help us operate the Service, under written contracts that require confidentiality and appropriate safeguards. Categories of subprocessors include: – Database, authentication, and infrastructure hosting providers – Object storage and content delivery providers – AI and machine-learning providers (for interview evaluation and proctoring) – Speech-to-text transcription providers – Transactional email providers – Analytics and security monitoring providers A current named list of our subprocessors is available on request at privacy@hirecruite.com. • Professional advisers (legal, accounting, auditors) bound by confidentiality. • Authorities and other parties when required by law, regulation, valid legal process, or to protect rights, safety, and security. In the event of a corporate transaction (merger, acquisition, financing, or asset sale), personal information may be transferred to the successor, subject to this policy.

Hirecruite is based in Canada. Our subprocessors are based primarily in the United States and may process data globally. As a result, your personal information may be transferred to, stored in, and processed in countries other than your own, including the United States. Where personal information is transferred from the EEA, the United Kingdom, or Switzerland to a country that has not been determined to provide an adequate level of protection, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and equivalent UK and Swiss mechanisms. You may request a summary of the safeguards in place by contacting privacy@hirecruite.com. For Canadian data, we make information about how to obtain access and how to make a complaint regarding cross-border processing available on request.

We retain personal information only as long as necessary for the purposes described in this policy and as required by law. Indicative retention periods: • Interview recordings, transcripts, and AI-generated scores 12 months after the interview is completed, unless the recruiting organization configures a shorter or longer period or you request earlier deletion. • Resumes for the duration of the recruiting organization's account plus 90 days, unless deletion is requested earlier. • Account information for the duration of your account, plus a 30-day grace period after deletion. • Server, security, and audit logs up to 90 days for routine logs; security-related logs may be retained longer where necessary to investigate incidents. • Backups encrypted backups are rotated and overwritten on a defined schedule (typically within 35 days). Where a Candidate requests deletion, we will delete personal information from active systems promptly and from backups in the ordinary course of backup rotation. Some information may be retained for limited additional periods to comply with legal obligations, resolve disputes, or enforce our agreements.

Subject to applicable law, you have the right to: • Access obtain a copy of the personal information we hold about you. • Rectification correct inaccurate or incomplete information. • Erasure / deletion request that we delete your personal information. • Restriction ask us to limit how we process your information. • Portability receive your information in a structured, commonly used, machine-readable format. • Object object to processing based on legitimate interests. • Withdraw consent at any time, where processing is based on consent, without affecting prior processing. • Human review request human review and an explanation of an AI-generated assessment that significantly affects you. • Lodge a complaint with your local data protection authority (see "Region-Specific Disclosures" below). To exercise any of these rights, email privacy@hirecruite.com. We will acknowledge your request promptly and respond within the time required by applicable law (generally 30 days, extendable where permitted). We may need to verify your identity before fulfilling a request. If you are a Candidate, you may also contact the recruiting organization that invited you, as they control much of the data you submit.

Canada (PIPEDA and provincial laws). You may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca, or with the equivalent authority in Quebec, Alberta, or British Columbia. Our Privacy Officer can be reached at privacy@hirecruite.com. EEA, United Kingdom, and Switzerland (GDPR / UK GDPR / FADP). You may lodge a complaint with the data protection authority in your country of residence, place of work, or place of the alleged infringement. Where we are required to designate an EU/UK representative and have not yet listed one in this policy, contact privacy@hirecruite.com and we will provide the current designated representative. California (CCPA / CPRA). California residents have the right to know, delete, correct, and obtain a copy of their personal information; to opt out of "sale" or "sharing" of personal information (we do not sell or share for cross-context behavioural advertising); and to limit the use and disclosure of sensitive personal information. In the past 12 months we have collected the following categories of personal information from California residents: identifiers, professional and employment-related information, internet and network activity, audio and visual information (interview recordings), inferences (AI-generated assessments), and sensitive personal information (voice recordings and the contents of interview communications). We do not knowingly use sensitive personal information for purposes other than those permitted by the CCPA without offering a "Limit the Use of My Sensitive Personal Information" choice. Illinois (Artificial Intelligence Video Interview Act). If you participate in a video interview and AI is used to evaluate it, you will be notified in advance, given an explanation of how the AI works and what general types of characteristics it uses to evaluate candidates, and asked for your consent. On a verified deletion request, we will destroy your interview video within 30 days and instruct subprocessors to do the same.

We use the following categories of cookies and similar technologies: • Strictly necessary to keep you signed in, maintain session state, and protect the Service against abuse. These cannot be disabled. • Functional to remember preferences such as theme. • Analytics to understand aggregated usage and improve the Service. Where required, we ask for your consent before setting these. You can control non-essential cookies through our cookie banner (where shown) and through your browser settings. Disabling cookies may impair some Service features.

If we become aware of a security incident affecting your personal information, we will notify the relevant data protection authority and affected individuals where required by law and within the timelines those laws require for example, without undue delay and, where feasible, within 72 hours of becoming aware under the GDPR, and as soon as feasible under PIPEDA where there is a real risk of significant harm. Notifications will describe the nature of the incident, the information affected, the steps we are taking, and any actions you can take.

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, contact privacy@hirecruite.com and we will take appropriate steps to delete it.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where the changes are material, provide additional notice (for example, by email or through the Service). We encourage you to review this policy periodically.

For questions about this Privacy Policy, to exercise your privacy rights, or to reach our Privacy Officer: Email: privacy@hirecruite.com We will acknowledge your request promptly and respond within the time required by applicable law.