1. Scope and our roles
This policy applies to personal information handled by HireX Labs, Inc. ("HireX," "we," or "us") through the HireX services.
When an employer, recruiter, or staffing organization uses HireX to manage applicants, that organization generally decides why and how candidate information is used. In that context, the organization acts as the data controller or business, and HireX acts as its processor or service provider. Candidates should contact the relevant hiring organization first about an application-specific privacy request.
HireX may act as a controller or business for information used to operate our website, manage accounts, provide support, administer billing, prevent abuse, and improve the service.
Where the General Data Protection Regulation or UK GDPR applies, HireX is generally a processor for candidate and recruiting data processed on behalf of a hiring organization, and a controller for account, website, support, billing, security, and service operations data that we determine how to process.
2. Information we collect
Website visitors and prospective customers
We collect information you submit when requesting a demo or contacting us, including your name, work email, company, role, team size, scheduling preferences, timezone, and message.
Customer account and organization information
We process account details such as name, email address, password credentials, profile image, organization membership, role, permissions, preferences, authentication activity, and billing or subscription identifiers.
Candidate and recruiting information
Depending on how a hiring organization configures and uses HireX, we may process:
- Names, email addresses, phone numbers, and profile images.
- Resumes, employment and education history, skills, application notes, files, and communications.
- Vacancy applications, pipeline stages, recruiter comments, interview events, evaluations, offers, and hiring decisions.
- Written, audio, and video interview answers, including transcripts and timing information.
- Consent records, including the date, policy version, and source of consent.
Interview integrity information
During configured video interviews, HireX may record integrity events such as leaving the interview tab, copy or paste actions, page exits, camera availability, and indications that multiple monitors are connected. These events may be visible to the hiring organization.
Technical information
We may receive IP address, browser and device information, request timestamps, diagnostic logs, session identifiers, cookie preferences, and security or fraud-prevention signals.
Sources of information
Information may come directly from you, from a hiring organization, from an authorized recruiter, from integrations selected by a customer, or from your interactions with HireX.
3. How we use information
We use personal information to:
- Provide, maintain, secure, and support the HireX services.
- Manage recruiting workflows, applications, interviews, candidate portals, evaluations, scheduling, and offers.
- Authenticate users, enforce permissions, and prevent fraud, abuse, and unauthorized access.
- Process demo requests, customer communications, subscriptions, and billing.
- Generate transcripts, summaries, relevance scores, and other AI-assisted recruiting outputs.
- Comply with legal obligations and respond to valid requests or disputes.
Where applicable law requires a legal basis, processing may rely on performance of a contract, legitimate interests, compliance with legal obligations, or consent. The hiring organization is responsible for identifying the appropriate legal basis for its candidate processing.
4. AI and automated processing
HireX uses AI-assisted features to parse recruiting documents, generate job-related content and questions, transcribe interview recordings, evaluate answers, create embeddings, and help rank or match candidates to vacancies.
Candidate resume text, answers, vacancy information, or recordings may be sent to AI service providers, including OpenAI, to perform these functions. Hiring organizations can enable a setting that removes certain direct identifiers from candidate text before selected AI requests. This anonymization is configurable and is not applied universally.
AI-generated scores, summaries, and recommendations are intended to support human recruiting teams. Hiring organizations remain responsible for their employment decisions and for providing any notices or human review required by applicable law.
7. Data retention
We retain information for as long as needed to provide the services, meet contractual and legal obligations, resolve disputes, maintain security, and support legitimate business records.
HireX currently supports an automated candidate-retention period configured by the service operator, with a default of 24 months. Certain candidate records may be retained longer when the candidate is in a talent pool, has been hired, or has an active or accepted offer. Customer configuration and legal requirements may result in different periods.
When candidate erasure is completed, direct identity fields, resume text, embeddings, files, and comment content are removed or replaced. Limited tombstone, application, offer, event, answer, billing, and audit records may remain when required for integrity, reporting, legal, or historical purposes.
8. Security
We use technical and organizational safeguards designed to protect information. These include tenant and role-based access controls, encrypted connections, password hashing, secure authentication cookies, token rotation, optional multi-factor authentication, signed file-access URLs, request validation, and operational logging.
No system can guarantee absolute security. You should protect your credentials and notify us or the relevant hiring organization if you suspect unauthorized access.
9. Compliance and assurance
GDPR and data processing terms
Where GDPR, UK GDPR, or similar privacy laws apply, HireX can support customer obligations through product controls, role-based access, candidate export and erasure workflows, retention configuration, and processor-style handling of recruiting data under customer instructions.
Customer agreements should include appropriate data-processing terms, including processor obligations, confidentiality, subprocessors, security measures, assistance with data-subject requests, breach notification cooperation, deletion or return of personal data, and audit or assurance rights where required.
Customers can request data-processing terms through their HireX account or support contact. HireX uses service providers for infrastructure, database hosting, object storage, email delivery, payment processing, AI features, security, and support. Specific subprocessors may vary by environment and customer agreement.
SOC 2 Type II and ISO/IEC 27001
HireX does not make a public claim of SOC 2 Type II compliance or ISO/IEC 27001 certification unless an independent audit or accredited certification has been completed and the relevant report or certificate can be verified.
If HireX pursues SOC 2 Type II, ISO/IEC 27001, or another assurance program, this policy and any security or trust materials should be updated to describe the current status accurately, including the audit period, scope, certification body or auditor, and any customer access process for reports.
For additional security details, see the Security page.
10. Your privacy rights
Depending on your location, you may have rights to access, correct, export, delete, restrict, or object to processing of your personal information; withdraw consent; opt out of certain uses; and complain to a data-protection authority.
HireX provides authorized hiring organizations with candidate export and erasure tools. Some requests may be limited where information must be retained by law, for security, to establish or defend legal claims, or for another permitted reason.
Candidates should normally submit application-related requests to the hiring organization identified on the careers page, interview invitation, or other communication. HireX may assist that organization in responding.
California residents
Where the California Consumer Privacy Act applies, California residents may have rights to know, access, correct, and delete personal information; opt out of sale or sharing; limit certain uses of sensitive personal information; and exercise these rights without unlawful discrimination.
11. International data transfers
HireX and its service providers may process information in countries other than the country where it was collected. Where required, HireX will use an approved transfer mechanism and appropriate safeguards for international transfers, such as Standard Contractual Clauses or another legally recognized transfer mechanism.
12. Children
HireX is designed for business recruiting and is not directed to children. Hiring organizations are responsible for ensuring that their use of HireX, including recruitment of minors where permitted, complies with applicable notice and consent requirements.
13. Changes to this policy
We may update this policy when our practices, services, or legal obligations change. We will update the date above and provide additional notice when required by law. Material changes should also be reflected in candidate consent notices and relevant product interfaces.
14. Contact
Privacy contact details and the registered company address must be confirmed before this policy is published. Candidates may also contact the hiring organization responsible for the vacancy or application.
Before publication, add privacy contact email, registered company address.
If applicable law requires HireX to appoint a data protection officer or local representative, HireX will provide those contact details as required.
For product questions in the meantime, use the contact channel provided by your HireX account representative.