1. Introduction
Your privacy matters to us. This policy describes the types of information we collect, how we use and protect it, and the choices you have. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Service. This policy applies to all users of HireDesk AI, including free and paid subscribers.
2. Information we collect
We collect information in the following categories:
- Account data. When you register, we collect your name, email address, company name, and authentication credentials. If you sign in through a third-party provider (such as Google), we receive the profile information that provider shares.
- Content you submit. This includes job descriptions, resumes, candidate information, and any other materials you upload or create through the Service.
- Payment data. Payments are processed by Stripe. We do not store full credit card numbers. Stripe provides us with limited billing metadata such as the last four digits of your card, card brand, expiration date, and billing address.
- Usage and log data. We automatically collect information about how you interact with the Service, including pages visited, features used, timestamps, IP addresses, browser type, operating system, and referring URLs.
- Cookies and device data. We use essential cookies to maintain your authenticated session. See Section 10 for details.
3. How we use your information
- Operate and improve the Service. We use your information to provide, maintain, and enhance features, fix bugs, and develop new functionality.
- Process payments. We use billing information to manage subscriptions, process charges, and send invoices.
- Communicate with you. We send transactional emails related to your account, such as signup confirmations, password resets, billing receipts, and important service updates. We do not send unsolicited marketing email.
- Security and fraud prevention. We use log and usage data to detect and prevent unauthorized access, abuse, and other harmful activity.
- Legal compliance. We may process your information as necessary to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
4. Candidate and third-party data
When you upload resumes, applications, or other personal information about candidates or employees, you act as the data controller (or equivalent under your jurisdiction) for that data. Cognitech Insights processes this data on your behalf as a data processor, solely to provide the Service. You are responsible for ensuring you have a lawful basis to submit this data and for complying with applicable privacy and employment laws. Do not submit sensitive personal data (such as health information, racial or ethnic origin, or biometric data) unless you are legally permitted and have obtained any required consent.
5. Sharing with third parties
We do not sell your personal information. We share data only with trusted sub-processors that help us deliver the Service:
- Anthropic — AI inference provider. Your inputs are sent to generate AI outputs (see Section 6).
- Stripe — Payment processing and billing.
- Supabase — Authentication, database hosting, and file storage.
- Email provider — Transactional email delivery (account notifications, receipts).
We may also disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of Cognitech Insights, our users, or the public. In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we will notify you beforehand if your data will become subject to a different privacy policy.
6. AI processing
Content you submit may be sent to our AI provider (Anthropic) to generate outputs such as job descriptions, interview questions, screening summaries, and related materials. We do not use your inputs or outputs to train AI models, and our agreement with Anthropic prohibits them from doing so without your separate consent. You should avoid submitting unnecessary sensitive personal data in your prompts. AI-generated outputs may be inaccurate or incomplete — always review them before use.
7. Data retention
- Account data is retained for the life of your account plus 30 days after deletion to allow for recovery and resolve any outstanding issues.
- Content and outputs you create through the Service are deleted when your account is deleted, unless retention is required by law.
- Payment records are retained as required by applicable tax and financial regulations.
- Usage and log data is retained for up to 12 months for security and analytics purposes, then aggregated or deleted.
8. Security
We implement industry-standard measures to protect your information, including encryption in transit (TLS) and at rest, role-based access controls, and regular security reviews. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a data breach that affects your personal information, we will notify you and any applicable authorities as required by law.
9. Your rights
Depending on your location, you may have the following rights regarding your personal information:
- EEA and UK residents (GDPR). You have the right to access, rectify, erase, restrict processing of, and port your personal data. You may also object to processing based on legitimate interests. To exercise these rights, contact us at the address below.
- California residents (CCPA). You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information as defined by the CCPA. We will not discriminate against you for exercising your rights.
To exercise any of these rights or to ask a question about your data, email us at [email protected]. We will respond within the timeframe required by applicable law (typically 30 days).
10. Cookies and tracking
We use essential cookies to maintain your authenticated session and remember your preferences. These cookies are strictly necessary for the Service to function and cannot be disabled. We do not use third-party advertising cookies or cross-site tracking pixels. If we introduce optional analytics cookies in the future, we will update this policy and provide you with a choice before setting them.
11. International data transfers
Your information is stored and processed in the United States. If you are located outside the United States (including in the European Economic Area or the United Kingdom), your data will be transferred to the US. We rely on Standard Contractual Clauses or other lawful transfer mechanisms to safeguard personal data transferred from the EEA or UK to the United States.
12. Children's privacy
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child under 18, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at [email protected].
13. Changes to this policy
We may update this Privacy Policy from time to time. If a change is material, we will provide reasonable notice (for example by email or an in-product notice) at least fourteen (14) days before the effective date when practicable. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.
14. Contact
Cognitech Insights LLC
Fort Worth, Texas
Email: [email protected]