Hiringly Privacy Policy

The Hiringly application (app.hiringly.ai) is operated by SearchTeam One s.r.o., Company ID (IČO): 23868945, with its registered office at Pacholíkova 2310/22, Modřany, 143 00 Prague 4, Czech Republic (“Hiringly”).

Hiringly is the controller of the personal data of its customers and their users (contact, billing and operational data).

For candidate and applicant data – including applications submitted through public job postings at app.hiringly.ai/positions – the controller is the customer (employer or recruitment agency) running the recruitment process. Its name is shown next to the consent in the application form and in the confirmation email. Hiringly processes this data solely as a processor on behalf of that customer under the Data Processing Agreement (Article 28 GDPR), which forms part of the Terms of Service.

Privacy enquiries: privacy@hiringly.ai

• Client contact details (B2B): Name, email, telephone number and company name. Purpose: Performance of the contract, billing and communication.
• Candidate data (B2C/B2B): CV data, contact details, employment history, education and skills. Purpose: AI screening, generating candidate-to-position matches and preparing interview materials.
• Applications from public job postings: Name, email, telephone number, LinkedIn link, CV and cover message, the time and wording of the consent given, and a technical record of the submission (a fingerprint of the IP address and browser, not the address itself). Purpose: Assessing the application in the specific recruitment process, including AI-assisted evaluation.
• Operational and analytics data: IP address, cookies and logs (Google Analytics, Microsoft Clarity). Purpose: Ensuring security and optimising the Service.
• Optional calendar integrations: If a recruiter connects Google Calendar, we process free/busy availability and, when enabled, the data needed to create an interview event. Manual interview scheduling works without connecting a calendar.

Processing is based on: (a) Performance of a contract (Article 6(1)(b) GDPR), (b) Legitimate interest in efficient recruitment (Article 6(1)(f) GDPR), (c) Compliance with legal obligations (Article 6(1)(c) GDPR) and (d) Consent of the data subject, where required.

Applications from public job postings are processed solely on the basis of the applicant’s consent (Article 6(1)(a) GDPR).

Hiringly uses advanced AI models (OpenAI API, EU endpoint for EU data residency) to analyse structured and unstructured data from CVs.

In accordance with the EU AI Act, the system is designed to operate with a “Human-in-the-loop”. AI serves exclusively as a recommendation tool. All final decisions to hire, reject or move a candidate through the recruitment process are made exclusively by a human recruiter.

Data is processed by vetted partners under a DPA agreement pursuant to Article 28 GDPR:

• Hosting: a server in the EU, which also stores the database and files
• AI infrastructure: OpenAI (API, EU endpoint)
• Payment gateway: Stripe, Inc.
• Email delivery: Resend Labs Inc.
• Backups: Backblaze, Inc. (backups are encrypted before upload)

Where a sub-processor processes data outside the European Economic Area, this is done on the basis of an adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.

Candidate data entered into Hiringly by a recruiter is retained for the duration of the recruitment process, for a maximum of 12 months from the last contact (unless the candidate has consented to longer retention).

Applications from public job postings are retained while the consent is valid, i.e. 1 year from when it was given. Unless the applicant renews the consent, their data is deleted no later than 30 days after it expires.

Consent can be withdrawn at any time using the “Manage consent” link in the confirmation email. Withdrawal immediately and permanently deletes the application, the CV and all related personal data. Withdrawal does not affect the lawfulness of processing before it.

Erased data disappears from encrypted backups within 6 months at the latest through their regular rotation; backups are used solely to restore the service.

You have the right of access, rectification, erasure, restriction of processing, data portability and to object to processing. We handle requests within 30 days at privacy@hiringly.ai; where the data is controlled by one of our customers, we forward the request to them without undue delay and help them handle it. You also have the right to lodge a complaint with the Czech Office for Personal Data Protection (www.uoou.cz).