Privacy Policy

This Privacy Policy explains how Verge Inc. (“HireSide”, “we”, “us”) collects, uses, discloses and protects personal information when you use HireSide: our website at hireside.com, the HireSide web application, our iOS and Android apps, the careers and job pages we host for employers, the candidate portal, AI interviews, interview scheduling and related features (together, the “Service”).

HireSide is recruiting software used by employers. How we handle your information depends on whether you are an employer using HireSide, a candidate applying for a job through it, or someone visiting our website or contacting us. Section 2 explains our role in each case. If you are a California resident, this policy is also our notice at collection under the California Consumer Privacy Act (see section 15).

The short version

If you are a candidate, the employer you apply to is in charge of your application. We process it on the employer’s behalf and only on its instructions. You can also see, withdraw or delete your applications yourself in the candidate portal.
AI assists; people decide. AI reads CVs, suggests match scores with quoted evidence, runs structured first-round interviews and drafts messages. It never rejects or advances anyone on its own. A person on the employer’s hiring team makes every decision.
We never analyze faces, emotions, voice tone or accents, and we do not collect or use biometric data.
We do not sell personal information or share it for advertising, and we never use candidate data to train AI models without a separate, optional consent.
Optional means optional. The demographics survey, the talent pool and interview recordings each need their own consent, and you can withdraw it at any time.
You have rights to know, access, correct and delete your information, and to ask for a human review or an accommodation. Section 14 explains how.

1. Who we are

The Service is provided by Verge Inc., a company based in California, United States, at 39111 Paseo Padre Pkwy, Fremont, California 94538, United States. HireSide is a Verge Inc. product.

For any question about this policy or your information, email [email protected] or use our contact form.

This policy does not cover how an employer handles your information in its own systems (for example, after it downloads your CV or hires you), or other websites we link to, such as an employer’s own website. Their own privacy notices apply to those.

2. Our role: for employers and for ourselves

2.1 When we act for employers (service provider or processor)

Employers (our customers) use HireSide to run their hiring. When you apply for a job through HireSide, the employer that posted the job decides why and how your application is used. For that information the employer is the “business” or “controller”, and HireSide is its “service provider” or “processor”. This covers applications, CVs, screening answers, AI assessments, AI interviews, interview bookings and feedback, talent-pool membership, and anything the employer’s team records about you.

We process this information only to provide the Service to the employer, under a written agreement and on the employer’s instructions, and not for our own purposes, except where the law allows it: to keep the Service secure, to fix errors, to create de-identified or aggregated statistics, and to comply with the law. The employer’s own privacy notice also applies, and the job page tells you who the employer is.

If you are a candidate, the quickest way to exercise your rights over an application is to contact the employer. If you contact us instead, we will pass your request to the employer promptly and help it respond. The self-service tools in our candidate portal (withdraw an application, leave a talent pool, delete your data) act on the employer’s behalf.

2.2 When we act for ourselves (business or controller)

HireSide decides how the following information is used, and is responsible for it as the “business” or “controller”:

accounts of employers and their team members, and company profiles;
the candidate portal sign-in itself (your email address, name, language and sign-in links), which works across every employer you apply to;
your job-seeker profile and the CVs you keep in it, if you create one (see section 2.3);
visitors to our website, and people who contact us, request a proposal or a demo, or do business with us;
security, fraud-prevention and audit records we keep to operate the Service; and
the aggregated use of voluntary demographics answers to check that HireSide’s own AI treats groups fairly (see section 7).

2.3 Your job-seeker profile

In the candidate portal you can keep a profile of your own: a headline and summary, work history, education, certifications, skills, languages, job preferences, an optional photo and the CVs you store there. HireSide is responsible for this profile as the “business” or “controller”.

It is private. No employer can browse or search it. An employer receives information from it only when you apply for one of its jobs: the CV you choose and the details you submit are then copied into that application, which the employer controls (section 2.1).
Saved jobs and companies. The jobs you save and the companies you follow are kept in your profile so you can come back to them. They are private and are not shared with employers.
AI only helps when you ask. When you upload a CV, AI reads it to suggest entries for your profile. Nothing is added until you review and confirm it, and your photo is never sent to AI.
Never used for training. We do not use your profile or your CVs to train AI models.
You stay in control. You can edit or delete any part of your profile, and any stored CV, at any time. A CV stays in your profile until you delete it or delete your candidate profile. Deleting a CV from your profile does not remove the copy in an application you already sent.

3. Information we collect

3.1 Employers and their team members

Account information: name, work email address, password (we store only a secure bcrypt hash), country, language and date-format preferences, an optional profile photo, and two-factor authentication settings.
Company profile: company name, logo, website, industry, size, country, city and description, which appear on your public careers and job pages.
Team members: the names, email addresses, roles (such as HR manager, recruiter, contributor or reviewer) and company access of people the account owner invites.
Hiring content: job posts, requirements, competencies and their scoring anchors, screening questions, interview plans, notes, pipeline decisions and the reasons for them, outcome messages, interview availability and time zone, meeting locations and interview feedback.
Assessment content: tests, evaluation forms and scorecards your team creates, your company’s locations and custom application fields, and the tags your team adds to candidates.
Sign in with Google or Apple: if you choose it, your name, email address (with Apple, possibly a private relay address) and an account identifier from that provider. We never receive your Google or Apple password.
Business information: proposals, order forms, invoices and the billing contact details we need to contract with your organization.
Communications: support requests and other messages you send us.

3.2 Candidates

Most of this information is processed on behalf of the employer you apply to (section 2.1).

Identity and contact details: name, email address, and, if you give them, phone number and country; your preferred language.
Your CV and application: the CV file you upload and what it contains (for example work history, skills, education, certifications, languages and links), the structured profile the AI reads from it, your answers to the employer’s screening questions, and where you found the job.
Assessment information: a masked version of your profile used for scoring, a match score with a verdict and a quoted piece of evidence for each job requirement, flags for the hiring team (such as a failed knock-out question, a possible duplicate application, an unverified email address or a low match), the team’s notes, your pipeline stage and its history, decisions and their reasons, and outcome messages.
AI interviews: your invitation, the mode you chose (voice or text), the transcript and its timings, the evaluation (a score per competency with quotes from your answers), and any request for extra time, an accommodation or an interview with a person. During a voice interview your audio is streamed so it can be transcribed; it is recorded only if the employer has turned recording on and you agree (section 6).
Interview integrity signals: numbers only, such as the length of pasted text or how long you were away from the interview tab (section 5.5).
Interviews with people: the time you book and your time zone, reminder preferences, reasons you give for rescheduling or cancelling, and the feedback interviewers record about you.
Tests and scorecards: your answers to a test an employer sends you, the time you took and the marks given, and the scorecards interviewers complete about you.
Extra application questions: your answers to any custom questions the employer adds to its application form, and details its team records on your application.
Consent records: which notice you agreed to or declined (its version, language and a fingerprint of its exact wording), when, and the IP address and browser used.
Talent pools: which employers’ talent pools you joined or left, match scores against new jobs, and invitations sent to you (section 8).
Voluntary demographics: only if you choose to answer: gender, age band, ethnicity (not asked in every country), disability and, in the United States, protected-veteran status (section 7).
Sign-in information: your requests for sign-in links and codes (we store only a scrambled hash of each link and code), sessions and the IP address used.

We do not ask for sensitive information in the application itself. Please do not include in your CV information the employer does not need, such as your date of birth, a photo, health details, religion or government ID numbers.

3.3 Website visitors and business contacts

Contact form: your name, email address, subject and message.
Proposal and demo requests: your name, work email, phone number, company, city and country, company size, hiring volume, the roles you hire for and your message.
Analytics: only with your consent, information about your visit to our public pages (section 10).

3.4 Information collected automatically

Log and device information: IP address, browser and device type, operating system, pages and features used, date and time, and error details.
Security information: sessions, failed sign-in attempts, rate-limit counters and two-factor challenges.
Audit records: a tamper-evident log of who did what and when (for example, a stage change, a CV download or a consent). It holds identifiers and field names, not the content of applications, typed text or email addresses.
AI run records: for every AI task, the model, the prompt version, the number of tokens, the time taken and whether it succeeded. These records do not contain the text sent to or returned by the AI.
Cookies and browser storage: see section 10.

3.5 Mobile apps

The HireSide apps are for employers, their teams and job seekers. They keep your sign-in token and preferences in your device’s secure storage. They use your camera or photo library only if you choose to take or pick a profile photo. They check for app updates through Expo’s update service, which receives your IP address and basic app and device information. The apps contain no advertising, analytics or crash-reporting tools. The job-seeker app uses your location only if you allow it, as described in section 3.6.

3.6 Location in the job-seeker app

Only if you allow it. The job-seeker app asks for your location only when you use “Jobs near me” or turn on nearby job alerts. Both are optional and off until you choose them.
Your location stays on your phone. To find hiring locations around you, the app sends an approximate position (rounded to about 100 metres for “Jobs near me” and about 1 kilometre for alerts). We use it only to answer that request: we do not store it, log it or link it to you or your account. Your phone itself works out when you are near a company, using the location features built into iOS and Android.
Nearby job alerts need location access “all the time” and notifications, so your phone can tell you when you are near a company that is hiring even when the app is closed. You get at most one alert per company per week, and none at night. You can turn alerts off in the app, or withdraw location access in your phone’s settings, at any time.
Employers never learn that you were near them. A company finds out about you only if you choose to apply.

3.7 Where information comes from

From you, when you create an account, apply, take an interview, book a time, fill in a form or contact us.
From the employer and its hiring team, about candidates (for example notes, decisions and interview feedback).
From Google or Apple, if you sign in with them.
From your device, automatically, as described above.
Created by the Service, such as match scores, interview evaluations and integrity reports.

We do not buy personal information, and we do not collect candidate information from social networks or other websites.

4. How we use information

To provide the Service: run accounts and teams, publish jobs and careers pages, receive applications, read and score CVs, run AI interviews, schedule interviews, run talent pools, and show employers their analytics.
To communicate: send account activation, security codes, sign-in links, application confirmations, interview invitations and calendar invitations, reminders, and the outcome and talent-pool messages that employers write and send through HireSide.
To keep the Service secure: authenticate users, prevent fraud, spam and abuse, enforce rate limits, and keep audit records.
To support fairness: produce aggregate fairness statistics from voluntary survey answers (section 7).
To help you: answer questions and fix problems. When you ask for help, authorized HireSide staff may view your account, limited to what is needed; that access is time-limited and logged.
To improve the Service: use error logs, AI run records, aggregated or de-identified statistics and, on public pages with consent, analytics. We do not use the content of applications, CVs or interviews for this, and we do not use candidate data to train AI models without a separate, optional consent.
To do business with employers: prepare proposals, contract, invoice, and send business contacts information about HireSide, which you can opt out of at any time.
To meet legal obligations: keep records, respond to lawful requests, enforce our terms, and establish or defend legal claims.

We do not use personal information for targeted advertising, and we do not build profiles of candidates for any purpose other than the employer’s hiring.

5. AI and automated decision-making

5.1 Where AI is used

Job ads: AI drafts a job description, requirements, competencies and screening questions from the employer’s notes, and checks the wording for biased language. The employer edits and approves everything before publishing.
Reading CVs: AI reads each CV into a structured profile.
Match scores: AI judges each job requirement against a masked version of the profile and must quote the evidence it relied on. The score itself is then calculated by fixed rules (section 5.4).
AI interviews: an AI interviewer asks the job’s structured questions and short follow-ups, answers questions about the role from the job ad, and scores the content of your answers afterwards (section 6).
Integrity reports: rules, and an optional cautious AI check, point out interview signals worth a person’s attention (section 5.5).
Talent pools: AI re-scores past applicants who agreed to stay in an employer’s talent pool against a new job, in the same way as applications.
Drafting messages: AI drafts outcome messages, interview plans and talent-pool invitations. A person on the employer’s team reviews, edits and sends them.

If AI is unavailable, the Service keeps working: applications are marked “Not scored” and the hiring team reviews them without AI.

5.2 A person makes every decision

HireSide never rejects, advances or hires anyone automatically. Low match scores and failed knock-out questions only add a flag. To reject or hire, a signed-in member of the employer’s team must confirm that they reviewed the application themselves, and a rejection needs a reason. Scores, interview evaluations and integrity reports never move an application. You are told of a decision only when the employer sends the outcome.

5.3 What HireSide’s AI never does

It never analyzes faces, facial expressions, emotions, personality, voice tone, pitch, pace or accent, in any country.
It does not use biometric data, and we do not create voiceprints or face templates.
It does not judge grammar, fluency or how well you speak a language.
Your name, contact details, photo, address, age and dates, gender, nationality and similar details are removed before scoring. Your location is shown to the employer as information only and never changes the score, because it can stand in for protected characteristics.
Whether you took an interview by voice or text, and any accommodation you asked for, is never given to the AI that scores it.
It never uses voluntary demographics answers, which are kept in a separate store the AI cannot read.

5.4 Scores you can check

Match scores come from a published formula, not from the AI’s opinion: must-have requirements count for 70%, nice-to-have requirements for 20% and experience for 10%, each weighted by the employer. The AI supplies only a verdict per requirement with a quote from the CV. A verdict without a quote that can be found in the CV counts as “unknown”, never as “met”.
Interview scores rate each competency from 1 to 5 against descriptions the employer wrote in advance. The AI scores the transcript three times and the middle score is used. Every score must quote your own words; without a verifiable quote it is shown as “insufficient evidence”, and scores that disagree are marked for human review.
Every AI output is logged with the model and prompt version that produced it, so it can be reviewed and explained later.

5.5 Interview integrity signals

To keep interviews fair for everyone, the text-chat interview notes a few interaction signals for the hiring team:

when text is pasted into an answer, and how many characters (never the text itself);
when you leave the interview tab or window, and for how long;
how long each answer takes to write, and very long answers written faster than typing speed;
whether the interview is open in two places at once; and
messages that try to give the interviewer instructions.

An optional AI check may also note, with a quote, an answer that reads very differently from your other answers, or a reply that does not address a question about your CV. These AI observations are marked as possibly wrong and are always low priority.

You are told about these signals before the interview starts, and the chat shows a reminder. They are never used in your score, never reject anyone, never move an application and never block the interview. Each one is shown to the hiring team with its evidence and possible innocent explanations (for example dictation software, accessibility tools, notes or a notification). We do not record the content of your clipboard, other tabs or windows, your keystrokes, your camera or your screen. Interviews ended at your request for a person are not checked. In voice interviews only the transcript is used.

5.6 Your options

At any time you can ask for:

a review of your application by a person, without AI;
an accommodation, such as extra time or a different format;
a text interview instead of voice, or an interview with a person instead of the AI interviewer;
a plain-language explanation of how AI was used and the main reasons for a result; and
reconsideration of a decision, with the chance to give your point of view.

Use the buttons on the interview page, reply to any email sent to you through HireSide, or contact the employer or us. Asking for any of these never counts against you.

5.7 Laws on AI in hiring

Laws on AI in hiring are developing quickly. We design HireSide so that employers can meet them, and we will update the Service and this policy as they take effect. In particular:

California: the California Privacy Protection Agency’s regulations on automated decision-making technology start to apply in 2027, and California’s civil-rights rules on automated-decision systems in employment already apply. HireSide keeps a person in every significant decision, gives candidates notice before AI is used, keeps records of AI outputs, and supports requests for information about how AI was used and for human review.
New York City (Local Law 144): employers that use an automated employment decision tool must have an independent bias audit and notify candidates in advance. HireSide provides employers with data to give to an independent auditor; that data is not itself a bias audit.
Other US states, such as Illinois and Colorado, require notices, explanations or anti-discrimination safeguards for AI in hiring. Employers are responsible for the notices their location requires, and HireSide’s disclosures and records are designed to support them.
European Union: the EU AI Act treats AI used in recruitment as high-risk and already prohibits emotion recognition at work. HireSide does not recognize emotions, tells candidates when they are talking to an AI, keeps logs and keeps people in control. We are preparing for the Act’s obligations for high-risk systems as they come into application.
GDPR and UK GDPR: no candidate is subject to a decision based solely on automated processing.

5.8 Calendars and online meetings

An employer’s team member can connect their own Google or Microsoft account to HireSide. We then use it only to create, move and delete the Google Meet or Microsoft Teams meetings for the interviews they host, and to read when they are busy (start and end times only, never what their events are) so candidates are not offered those times. The meeting event in their calendar contains the candidate’s name, the interview and a link to the application. The access tokens are stored encrypted, and they can disconnect at any time in Settings, which deletes them. If you are a candidate, you join such an interview with the link. Google or Microsoft processes the meeting under the employer’s account with them.

HireSide’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use that information for advertising, do not sell it, do not let people read it except where needed for security, to comply with the law or with the user’s permission, and do not use it to train AI models.

6. AI interviews and recordings

Before the interview you see what happens, what is evaluated and what is not, and you are asked to agree to the AI interview. You start with one practice question that is never scored. The interviewer tells you at the start that it is an AI.
Voice interviews run in your browser. Your audio is sent through our real-time voice provider to a speech-to-text provider that turns it into text, and the interviewer’s replies are turned into speech by a text-to-speech provider. Only the text of what you say is used; no features of your voice are measured. Our speech-to-text provider is instructed not to use the audio to improve its models.
Recordings: the audio is recorded only if the employer turns recording on and you give a separate consent. If you do not want to be recorded, you can take the interview by text instead. A recording contains the audio of both you and the AI interviewer, is stored in our private cloud storage, and can be played only by the employer’s team (each playback is logged). It is deleted 90 days after the job closes, and in any case no later than 365 days after the interview, or sooner if you or the employer ask for deletion.
Interviews on WhatsApp: where the employer offers it, you can take the interview by WhatsApp message or voice note instead. You start it yourself by sending a start code to the employer’s WhatsApp number. Your messages, voice notes and phone number pass through our messaging gateway and are stored with your application like any interview. Voice notes are turned into text by our speech-to-text provider, only the words are used, and the audio file is not kept by HireSide. WhatsApp is a service of Meta, and its own terms and privacy policy apply to your use of WhatsApp. We only reply to people who send a start code, and we never message you on WhatsApp otherwise, apart from one reminder if an interview you started is left unanswered.
Transcripts and scores are kept with your application (section 11).
Technical problems: if the connection fails early in the interview, you get one automatic retake.

7. The voluntary demographics survey

After you apply, some employers show a short, optional survey that helps check that hiring is fair. It may ask about gender, age band, ethnicity, disability and, in the United States, protected-veteran status. The questions depend on the country: for example, ethnicity is not asked in France. Every question can be skipped and has a “Prefer not to say” answer.

Special category and sensitive information. Ethnicity and disability are special-category data under the GDPR and sensitive personal information under California law. We store survey answers only if you tick the consent box and send at least one answer.
Kept apart. Your answers are stored separately from your application. They are never shown to the hiring team, never given to the AI and never used to score or decide on your application. Skipping the survey has no effect.
Aggregate reports only. Answers are reported only as statistics about groups of at least 5 people, with further safeguards so that no individual can be singled out. Employers see those statistics for their own jobs. We also use them, across employers and only in aggregate, to check that HireSide’s AI does not disadvantage any group.
Withdrawal. You can withdraw your consent at any time by contacting us or the employer, and your answers are then deleted. They are also deleted when your application or candidate profile is deleted, and in any case after 4 years (section 11).

8. Talent pools

When you apply, you can choose to stay in that employer’s talent pool so it can contact you about other suitable jobs. It is optional and applies to that one employer only; employers never see each other’s talent pools.
Your place in a talent pool lasts 12 months from your consent. You can join again from the candidate portal.
The employer may re-score your latest application against a new job, in the same masked, evidence-based way as a new application.
An invitation to apply is written or approved by a person at the employer. It never submits an application for you: applying is always your choice.
You can leave a talent pool at any time, from the candidate portal or with the link in any talent-pool email. Leaving takes effect immediately.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the past 12 months. We disclose personal information only as follows:

To the employer and its hiring team. An application is visible to the employer you applied to and to the team members it gives access to. It is never shown to other employers.
To our service providers (sub-processors), listed by category below. They may use personal information only to provide their services to us, under contracts that require them to protect it.
For legal reasons, when we believe in good faith that the law, a court order or valid legal process requires it, or that it is needed to protect the rights, property or safety of our users, the public or HireSide. Where the law allows, we will tell the affected employer or person first.
In a business transfer, such as a merger, acquisition or sale of assets, under confidentiality terms and subject to this policy. We will give notice before personal information becomes subject to a different privacy policy.
With your consent or at your direction.

9.1 Service providers (sub-processors)

Category	What they do for us	Information involved
Cloud hosting and storage (Amazon Web Services, United States)	Servers, database and private file storage	All Service data, including CVs and interview recordings
AI language models, through the OpenRouter gateway (currently models from OpenAI)	Drafting job ads, reading CVs, judging requirements, running and scoring AI interviews, integrity checks, drafting messages	Job content, CV contents, masked profiles, interview transcripts
Real-time voice (LiveKit)	Connecting the browser and the AI interviewer during voice interviews, and producing recordings where consented	Interview audio
WhatsApp messaging gateway (VergeServer), once WhatsApp interviews are available	Connecting the employer’s own WhatsApp number to HireSide and carrying WhatsApp interview messages	Phone numbers, messages and voice notes of WhatsApp interviews
Speech-to-text and text-to-speech (Deepgram, Cartesia; Soniox as an alternative)	Turning speech into text and the interviewer’s words into speech	Interview audio and text
Calendars and online meetings (Google, Microsoft)	Creating Google Meet or Microsoft Teams meetings in a connected interviewer’s own calendar, and reading when they are busy	Candidate name, interview time, job and the application link; busy times of the interviewer
Email delivery (Twilio SendGrid)	Sending account, security, application, interview and outcome emails	Email addresses and email content
Sign-in providers (Google, Apple)	Sign in with Google or Apple, if you choose it	Sign-in identity
Website analytics (Google Analytics)	Measuring visits to our public pages, only with consent	Pages visited, device and approximate location from IP address
Content delivery and network security (such as Cloudflare, Font Awesome and Google Fonts)	Delivering scripts, icons and fonts, and protecting the Service	IP address and browser information
Mobile app updates (Expo)	Delivering updates to the mobile apps	IP address and basic app and device information
Identity verification (not yet in use)	If introduced and turned on by an employer, checking an identity document with a specialist provider such as Veriff or Persona	The check result and a reference. We will update this policy before this processes any data.

We select AI providers and settings intended to stop the data we send from being used to train their models, where such options are offered. The current list of named sub-processors is available at hireside.com/subprocessors and from [email protected]. We tell employers before we add or replace a sub-processor, as set out in our data processing addendum.

10. Cookies, Do Not Track and Global Privacy Control

HireSide sets only the cookies the Service needs to work. They are always on:

Name	Purpose	Duration
`hireside_session`	Keeps employers and team members signed in. It holds a random token; our server keeps only a hashed copy.	30 days, or until you sign out
`hireside_cand_session`	Keeps candidates signed in to the candidate portal.	30 days, or until you sign out
`hireside_csrf`	Protects forms against forged requests from other websites.	1 year
`hireside_consent`	Remembers whether you accepted or declined analytics.	180 days
`hs_survey`	Lets the demographics survey after an application find that application, without putting anything personal in the page address.	48 hours

Analytics (optional). Only if you accept, our public pages (including public careers, job and application pages) load Google Analytics, which sets its own cookies (_ga and _ga_*) and records the pages you visit and information about your device. It is configured with advertising features turned off, and it does not receive what you type into forms or the files you upload. It never runs in the employer app, the candidate portal or AI interviews. Until you accept, the analytics script is not loaded at all. Google Analytics data is kept for 14 months. You can change your choice at any time with the “Cookie settings” link at the foot of any public page; declining also deletes the analytics cookies.

Browser storage. We keep a few preferences in your browser, such as light or dark mode and how a list is displayed. During a text interview, the browser briefly keeps a random session identifier and the integrity signals for the answer you are writing, so they survive a page reload. This information stays on your device until it is sent with your answer or the tab is closed.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a request to opt out of the sale or sharing of your personal information and as a refusal of analytics: no analytics are loaded and no banner is shown. You can still opt in from the “Cookie settings” link.

Do Not Track. There is no agreed standard for how websites should respond to “Do Not Track” browser signals, so we do not respond to them separately. We honor Global Privacy Control as described above. Apart from Google Analytics when you consent, we do not allow third parties to collect information about your online activities over time and across websites through the Service.

11. How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, or as long as the employer instructs for candidate data, unless the law requires us to keep it longer. We are adding settings that let each employer set its own retention period for applications; until then, the periods below apply.

Information	How long we keep it
Employer accounts, company profiles, team logins and job posts	While the account is open. When an owner deletes the account, it is scheduled for deletion and permanently erased after 30 days, with its jobs, applications, recordings and team logins. Signing in during those 30 days cancels the deletion.
Applications, CVs, profiles, match scores, notes, answers, interview transcripts and evaluations, integrity signals, bookings and interview feedback	Until the candidate deletes them in the candidate portal, the employer asks us to delete them, or the employer’s account is erased, whichever comes first. Employers are responsible for asking us to delete candidate data when their own legal retention period ends.
Candidate portal profile and consent records	Until you delete your candidate profile. Deletion is immediate and also removes your applications, CVs, recordings, survey answers and talent-pool data at every employer.
Interview recordings (only where consented)	90 days after the job closes, and never more than 365 days after the interview. Deleted at once if the application, the candidate profile or the employer account is deleted.
Voluntary demographics answers	Up to 4 years, the longest record-keeping period that applies in our markets, then deleted. Deleted earlier if you withdraw your consent or the application is deleted.
Talent-pool membership	12 months from your consent, unless you leave earlier or join again.
Sign-in links and sessions	Candidate sign-in links expire after 15 minutes (24 hours for the link in an application confirmation) and can be used once; their records are deleted a day after they expire. Password-reset links expire after 1 hour and two-factor sign-in attempts after 10 minutes. Sessions last up to 30 days.
Audit records	At least 4 years, to meet record-keeping duties for hiring decisions. They contain identifiers and actions, not the content of applications.
AI run records	As long as needed to operate, secure and account for the Service. They contain no personal content.
Contact messages, proposal requests and business records	As long as needed to handle the request and any business relationship that follows, and as long as tax and accounting law requires for contracts and invoices.
Server logs and backups	For a limited period for security, troubleshooting and disaster recovery, then deleted or overwritten.

12. Security and breach notification

We use technical and organizational measures designed to protect personal information, including:

encryption in transit (HTTPS) for every page and app connection, and private cloud storage for CVs and recordings, which are never publicly accessible and are encrypted at rest by our storage provider;
strict separation between employers: every request is checked against the employer it belongs to, so one employer cannot see another’s candidates;
passwords stored only as bcrypt hashes, sign-in tokens stored only as hashes, and two-factor authentication secrets encrypted;
optional two-factor authentication, rate limits on sign-in and other sensitive actions, and single-use, short-lived sign-in links for candidates;
protection against cross-site request forgery and clickjacking, and checks on uploaded files;
access controls within each employer account (full or view-only access), and staff access limited to what is needed, time-limited and logged; and
a tamper-evident audit log of important actions, such as decisions, CV downloads and recording playback.

No system is perfectly secure, and we cannot guarantee the security of information. We do not claim any security certification.

Breach notification. If we become aware of a security breach that affects personal information, we will act promptly to contain it, notify affected employers without undue delay so they can meet their own obligations, and notify affected individuals and authorities where the law requires. To report a security concern, email [email protected].

13. International transfers

HireSide is operated from the United States, and our servers are in the United States. Our first market is Pakistan, and employers and candidates may be in many other countries. When you use the Service, your information is transferred to, stored in and processed in the United States, and in other countries where our service providers operate. Those countries may not have the same data-protection laws as yours.

From the European Economic Area and Switzerland, we rely on the European Commission’s Standard Contractual Clauses (and their Swiss equivalent), with additional safeguards where needed.
From the United Kingdom, we rely on the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses.
From Pakistan and other countries, we protect transfers with contracts and the safeguards in this policy, and we will adopt any transfer mechanism that local law requires.

You can ask for a copy of the safeguards we use by emailing [email protected].

14. Your rights and how to use them

Depending on where you live, you may have the right to know what personal information we hold about you and to get a copy, to correct it, to delete it, to object to or restrict some uses, to take it with you, to withdraw consent, and to opt out of the sale or sharing of personal information (we do neither). Whatever the law where you live, we honor the requests described in this section.

14.1 How to make a request

Email [email protected] with your request.
Employers and team members can view and correct account information in Settings, and account owners can delete the whole account in Settings (it is erased after 30 days).
Candidates can sign in to the candidate portal to see their applications, withdraw an application, update their profile, leave a talent pool, or delete their candidate profile and all of its data immediately.
Our contact form.

14.2 Requests about an application

Because the employer controls your application (section 2.1), we will pass requests about it to the employer and help it respond. We will tell you when we have done so. If the employer must keep some information by law, it or we will tell you what and why.

14.3 Verifying your identity

To protect you, we verify requests before acting on them. Usually we ask you to confirm the request from the email address linked to your account or application, or to sign in. For a request to know specific pieces of information or to delete sensitive information we may ask for more. We use the information you give us for verification only for that purpose.

14.4 Authorized agents

You may use an authorized agent to make a request for you. We will ask the agent for your signed permission, or a valid power of attorney, and we may ask you to verify your identity directly with us, unless the law does not allow it.

14.5 Timing, fees and appeals

We confirm requests within 10 business days and respond within 45 days. If we need more time, up to another 45 days, we will tell you why. Requests are free unless they are clearly unfounded or excessive. If we decline a request, we will explain why. If you disagree, you can appeal by replying to our decision or emailing [email protected] with the subject “Appeal”; we will answer within the period the law sets and tell you how to contact your regulator.

14.6 No discrimination

We will not deny you the Service, charge you a different price, give you a different quality of service, or treat your application differently because you exercised a privacy right. Employers may not retaliate against candidates through HireSide for doing so.

15. California privacy notice

This section applies to California residents and is our notice at collection under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). It covers information we handle as a business. Where we act as a service provider for an employer, the employer’s notice applies, and we help it respond to your requests.

15.1 Notice at collection

In the past 12 months we have collected the categories of personal information below. We disclose each category for a business purpose to the recipients shown and do not sell or share any of them.

Category	Examples	Sources	Purposes	Disclosed to	Retention
Identifiers	Name, email address, phone number, IP address, account and sign-in identifiers	You; the employer; Google or Apple; your device	Providing the Service; communications; security; legal	The employer (for candidates); service providers	Account: until deletion plus 30 days. Application: see section 11.
Customer records (Cal. Civ. Code § 1798.80(e))	Name, contact details, education and employment history in a CV, billing contact	You; the employer	Providing the Service; contracting and invoicing	The employer; service providers	See section 11
Characteristics of protected classifications	Only if you choose: gender, age band, ethnicity, disability and veteran status in the voluntary survey, or anything you include in your CV	You	Aggregate fairness monitoring only; never scoring or decisions	Service providers (hosting). Employers see only group statistics.	Up to 4 years, or until you withdraw consent
Commercial information	Proposals, order forms, invoices, service usage	You; your organization	Contracting, billing and support	Service providers	As long as the relationship lasts and tax and accounting law requires
Internet or other network activity	Logs, pages visited, analytics (with consent), interview integrity signals	Your device	Security; improving the Service; fair interviews	The employer (integrity signals); service providers	Limited periods; integrity signals with the application
Audio and visual information	Voice interview audio (recorded only with consent), profile photos, company logos	You	Voice interviews; account display	The employer (recordings); service providers	Recordings: 90 days after the job closes, 365 days at most
Professional or employment-related information	CV contents, screening answers, interview transcripts and evaluations, interview feedback, decisions	You; the employer	Providing the employer’s hiring process	The employer; service providers	See section 11
Job-seeker profile (only if you create one)	Headline, summary, work history, education, certifications, skills, languages, job preferences, an optional photo and the CVs you store	You, including entries AI suggests from your own CV that you confirm	Keeping your profile; applying for jobs when you choose to	Service providers; an employer only when you apply to it	Until you delete it (section 2.3)
Inferences	Match scores, requirement verdicts, interview scores, integrity flags, talent-pool rankings	Created by the Service	Supporting the employer’s human decisions	The employer	With the application
Sensitive personal information	Account sign-in credentials; racial or ethnic origin and health (disability) information, only from the voluntary survey	You	Signing in securely; aggregate fairness monitoring	Service providers	Credentials: while the account exists. Survey: see above.

We do not collect precise geolocation, biometric information or education records protected by federal law.

15.2 No sale or sharing

We do not sell personal information or share it for cross-context behavioral advertising, including personal information of consumers under 16, and we have not done so in the past 12 months. Because we do neither, there is nothing to opt out of; we still honor Global Privacy Control signals (section 10).

15.3 Sensitive personal information

We use sensitive personal information only for purposes the CCPA permits without offering a right to limit: to provide the Service you request, to keep it secure, and, for voluntary survey answers you consent to give, to monitor fairness in aggregate. We do not use it to infer characteristics about you. If we ever use it for another purpose, we will offer you the right to limit that use.

15.4 Your California rights

Right to know and access: the categories of personal information we collected about you, the sources, the purposes, the categories of recipients, and a copy of the specific pieces of information.
Right to delete personal information we collected from you, subject to legal exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing (we do neither).
Right to limit the use of sensitive personal information (we use it only for permitted purposes).
Rights about automated decision-making technology, as they take effect under California regulations (section 5.7).
Right not to be discriminated against for using these rights (section 14.6).

Submit requests as described in section 14: by email to [email protected], in your account settings, or in the candidate portal. Authorized agents may submit requests as set out in section 14.4.

15.5 Notice of financial incentive

We do not offer any financial incentive or price or service difference in exchange for personal information.

15.6 Shine the Light

California Civil Code § 1798.83 lets California residents ask which personal information a business disclosed to third parties for their own direct-marketing purposes. We do not disclose personal information to third parties for their direct marketing.

If the GDPR, the UK GDPR or the Swiss data-protection act applies, the following also applies.

16.1 Controller and processor

Verge Inc. is the controller for the information described in section 2.2, and a processor for employers for the information described in section 2.1. For candidate data, the employer’s privacy notice sets out its lawful bases, and requests should go to the employer first.

16.2 Lawful bases where we are the controller

Contract: to provide accounts and the Service to employers and their teams.
Legitimate interests: to keep the Service secure, prevent fraud and abuse, keep audit records, improve the Service with aggregated information, and market HireSide to business contacts. We balance these interests against your rights, and you can object.
Consent: for optional analytics cookies, and for the use of voluntary demographics answers, which are special-category data processed on the basis of your explicit consent. You can withdraw consent at any time without affecting earlier processing.
Legal obligation: to keep records and respond to lawful requests.

Where an employer uses interview integrity signals, it relies on its legitimate interest in fair, cheat-resistant assessment. The signals are disclosed before the interview, and you can ask for an interview with a person instead.

16.3 Your rights

You have the right to access, rectify and erase your personal data, to restrict or object to processing, to data portability, to withdraw consent, and not to be subject to a decision based solely on automated processing that significantly affects you (HireSide never makes such decisions). You also have the right to complain to a data-protection authority, in particular where you live or work; in the UK this is the Information Commissioner’s Office.

16.4 Representatives

We do not currently offer the Service to, or monitor the behavior of, people in the European Union or the United Kingdom, so we have not appointed a representative under Article 27 of the GDPR or the UK GDPR. We will appoint one before that changes.

17. Pakistan

Pakistan is HireSide’s first market. We handle personal information in line with the Prevention of Electronic Crimes Act, 2016 (PECA), as amended, which among other things protects information systems and data against unauthorized access, and we cooperate with lawful requests under it.

Pakistan’s draft Personal Data Protection Bill has not yet been enacted. We monitor its progress and will comply with it, and with any related rules, when it takes effect, including any requirements on consent, data localization or cross-border transfers. The information of users in Pakistan is currently stored in the United States (section 13).

18. Other places

Residents of other US states with comprehensive privacy laws (such as Colorado, Connecticut, Texas and Virginia) have rights similar to those in section 15, including the right to appeal a refused request (section 14.5). Elsewhere, where local law gives you more rights than this policy describes, you have those rights too, and employers configure HireSide to meet their local notice and consent requirements, with our support as their processor.

19. Children

HireSide is not directed to children. Employer accounts are for adults. Candidates must be at least 16 years old, or older where local law sets a higher minimum working age. We do not knowingly collect personal information from anyone under 16, and we do not sell or share the personal information of anyone under 16. If you believe a child has given us personal information, contact [email protected] and we will delete it.

20. Changes to this policy

We may update this policy, for example when we launch a feature, change a service provider or when the law changes. We will post the new version here and change the “Last updated” date. If a change is material, we will tell employers by email or in the Service before it takes effect, and we will ask for your consent where the law requires it.

21. Contact us

Questions, requests or complaints about privacy:

Verge Inc. (HireSide)
39111 Paseo Padre Pkwy, Fremont, California 94538, United States
Privacy: [email protected]
Contact form: hireside.com/contact