Privacy Policy

Simplified Summary (Plain Language):

Hirevire helps connect employers and job seekers. We collect information like your name, email, resumes, and interview responses to provide our services. We use third-party tools for things like video storage and delivery, payments, and analytics. Some of these tools, including Cloudflare, operate globally and may store or process data across multiple data centers worldwide. Video and audio responses are deleted within 90 days by default. Where the employer has turned it on, your answers are also scored or summarized by AI, and the employer still makes the hiring decision. Our founders can open a customer workspace in read-only mode to handle a support request, and every one of those visits is logged. We keep your data safe and don't sell it. You can delete your account and data by emailing us. We follow GDPR rules. Also, our customers (employers) also save your data and their own privacy policies will apply to how they use it.

Full Privacy Policy

1. Introduction

This Privacy Policy describes how CRAFTWELL STUDIOS PRIVATE LIMITED ("we," "us," or "Hirevire") collects, uses, and shares information about you when you use our platform, Hirevire.com (the "Service"). We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (GDPR).

2. Information We Collect

We collect the following types of information:

Interviewee Data:

• Email address
• Phone number
• Recorded video/audio answers
• Files uploaded in response to questions (including resumes, which may contain sensitive information)

Customer Data:

• Email address
• Organization name
• Phone number
• Language preferences

Optional OAuth Data:

With your explicit consent, we may collect information from Google (via Google OAuth) or Microsoft (via Microsoft OAuth) solely for the purpose of sending emails on your behalf. This is optional and you can choose not to use this feature. We do not share, transfer, or disclose user data obtained through Google or Microsoft OAuth with any third parties. Furthermore, we do not retain user data obtained through Google or Microsoft Workspace APIs to develop, improve, or train generalized AI and/or ML models.

3. How We Collect Information

We collect information through:

• User registration
• Uploaded resumes and responses
• Website interactions
• Optional Google and Microsoft OAuth, with your explicit consent, for sending emails on your behalf

4. Purposes of Data Processing

We use your information for the following purposes:

• Providing the Service
• Facilitating communication between employers and job seekers
• Improving our platform
• Analytics and platform usage analysis
• Transactional emails
• Transactional SMS notifications
• Payment processing
• Affiliate marketing
• AI scoring and evaluation of responses, where the employer has enabled it
• Optionally, sending emails on your behalf, with your explicit consent, through Google or Microsoft OAuth

5. Legal Basis for Processing (GDPR)

Our legal basis for processing your personal data includes:

• Performance of a contract (to provide the Service)
• Legitimate interests (to improve our platform, conduct analytics, and communicate with you)
• Consent (where required by applicable law, including for the optional use of Google/Microsoft OAuth to send emails on your behalf)

6. Third-Party Integrations (Sub-Processors)

We use the following third-party services to operate our platform. We have Data Processing Agreements (DPAs) in place with all providers to ensure your data is protected.

7. Customer-Directed Integrations

Employers can connect their Hirevire workspace to tools they already use. When an employer switches one of these on, we send candidate data to that tool on the employer's instruction:

• Applicant tracking systems: Ashby, Manatal, Recruitee
• Automation platforms: Zapier, Make, Pabbly Connect, and any webhook endpoint the employer configures
• Google Drive: storing responses and uploaded files in the employer's own Drive account

The employer chooses these destinations. We do not engage them as our own sub-processors. Once your data reaches them it is covered by that employer's agreements and privacy policy, not this one. Ask the employer which integrations they have enabled if you want to know where your responses go.

8. Video Data Storage & Delivery

Candidate video and audio responses submitted through our platform are stored and delivered using services provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). In some cases, video storage is also handled by Bunny.net (Vienna, Austria).

• Video content is stored and delivered using Cloudflare's global edge network, with infrastructure distributed across multiple data centers worldwide.
• Cloudflare processes video and related data solely for the purpose of storage, encoding, delivery, and AI processing on our behalf.
• Cloudflare may collect technical metadata (e.g., delivery logs, performance data) for network operation and security purposes only. This data is not sold or shared commercially.
• Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF), the Swiss-U.S. DPF, and the UK Extension to the EU-U.S. DPF.

9. AI Evaluation of Responses

Employers can enable AI scoring for a job. Where an employer has enabled it, your recorded answers and uploaded files are processed by our AI provider (OpenAI) to produce a transcript, a summary, a score, or a rating against criteria the employer set.

• Hirevire does not make hiring decisions. Scores and summaries go to the employer, who decides whether to advance or reject an application.
• We do not use your responses to train AI models, and our AI providers do not train on data submitted through our account.
• You can ask the employer whether AI scoring was used on your application. Your rights to access your data and to object to processing are set out in the User Rights section below.

10. International Data Transfers

Some of our sub-processors operate on global infrastructure or are located outside the European Economic Area (EEA) or the United Kingdom (UK). When we transfer personal data internationally, we ensure appropriate safeguards are in place:

• EU-U.S. Data Privacy Framework (DPF): Where sub-processors are certified under the EU-U.S. DPF (including Cloudflare, Stripe, and others), transfers rely on this framework.
• Standard Contractual Clauses (SCCs): For transfers to processors not covered by an adequacy decision, we rely on the European Commission's Standard Contractual Clauses.
• UK International Data Transfer Agreements (IDTAs): For transfers from the UK, we use IDTAs or the UK Addendum to the EU SCCs as appropriate.

You may request a copy of the relevant transfer safeguards by contacting us at [email protected].

11. Data Retention

Video and audio responses are deleted within 90 days of submission by default. Where an employer has agreed a different retention period with us, that period applies to their workspace instead.

Other information, including account details, email address, organization name, and uploaded files, is retained until the account is deleted.

Deletion applies to our systems. If an employer has downloaded your responses or sent them to their own tools, those copies are covered by that employer's retention practices, not ours.

12. Data Security

We implement the following security measures:

• Encryption at rest and in transit
• Access controls
• Automated code audits for security, performed regularly to industry standards

13. Support Access to Customer Workspaces

Our founders can open a customer workspace in read-only mode to investigate a support request or a fault. Access is limited to what the request requires.

• The access is read-only. Nothing is edited, deleted, or exported through it.
• Every access is logged, including who opened the workspace, when, and the reason.
• Customers can request the access log for their own workspace by emailing [email protected].

14. User Rights (GDPR)

You have the following rights regarding your personal data:

• Right to access: You can request a copy of your data.
• Right to rectification: You can correct inaccurate data.
• Right to erasure: You can request deletion of your data.
• Right to restriction of processing: You can limit how we use your data.
• Right to data portability: You can receive your data in a portable format.
• Right to object: You can object to our processing of your data.

To exercise these rights, please contact us at [email protected].

15. Cookies and Tracking Technologies

We use cookies and similar technologies for analytics and authentication. You can manage your cookie preferences through your browser settings.

16. Data Breach Notification

In the event of a data breach, we will notify affected users and relevant authorities as required by GDPR.

17. Privacy Impact Assessments (PIAs)

We acknowledge the importance of PIAs and are in the process of implementing regular PIAs due to the sensitive nature of data we process.

18. Children's Privacy

Our Service is not intended for children under 13 or 16. We do not knowingly collect data from children.

19. Customer Data and Privacy

As part of our Service, your data may also be stored and processed by our customers (employers). Each customer has their own privacy practices and policies, which govern their use of your data. We are not responsible for our customers' privacy policies or their compliance with applicable laws. We recommend that you review the privacy policies of the specific employer(s) you interact with through our Service to understand how they will handle your data.

20. Contact Us

If you have any questions about this Privacy Policy, please contact us at [email protected].

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the updated policy on our website.