Privacy

Who we are

HireX is a staffing platform run by the HireX team. It is used by that team and by the partner brokers they work with, who get an account by invitation or by creating one from the sign-in page. Write to support@hirex-ai.com with anything on this page, including a request to see or delete what we hold.

What we collect

• Account details. Your name, email address and phone number, and whether you are a HireX manager or a partner broker.
• The work itself. Requests, candidate records and their CVs, rates, availability and interview times — whatever you or the team enter into the platform.
• Messages. What you write in the platform’s threads, including anything you ask the assistant.
• A record of actions. Who changed what and when, and the notifications we sent you. It is how a partner and the team can agree on what happened.
• Calendar availability, and only if you connect one: the intervals your calendar reports as busy, and the interview entries this platform writes there itself.

What we do not read from your calendar

We never ask your calendar provider for event titles, descriptions, attendees, locations, or the contents of any event we did not create. We ask only the free/busy question — Microsoft’s getSchedule and Google’s calendar.freebusy, the narrowest calendar read each of them offers — and we keep three fields from the answer: when a block starts, when it ends, and whether it is busy or tentative.

Those intervals are fetched when you open a calendar screen, held in memory for at most a few minutes so that scrolling a week is not a request per scroll, and then dropped. They are never written to our database.

What we write to your calendar

When you book an interview, we put one entry in your own default calendar: the candidate’s first name and the request title in the subject, a link back to HireX in the body, and no attendees. We do not invite anyone through your calendar and we do not touch any other entry in it. If you granted read access only, nothing is written at all.

Calendar connections

The tokens that let us ask your provider those questions are stored encrypted (AES-256-GCM), so a copy of our database is not a set of live keys to anybody’s diary. Disconnecting in HireX blanks them and stops all access immediately. To remove the grant at the source, use your Google account permissions or your Microsoft account permissions.

Automated processing

Two things here are read by a language model: the text of a request, so that it can be turned into structured fields for the team to correct, and a CV, for the same reason. The assistant you can talk to in the platform is the third. That content is sent to a commercial model provider to get an answer back, under API terms that do not allow it to be used to train their models. Nothing it produces reaches a partner unreviewed: a parsed candidate stays a draft until someone on the team has checked the fields and confirmed them.

Who else sees it

Nobody buys this data and nobody advertises against it. Beyond the people you are working with on the platform, it reaches only the services that run it: a hosting and database provider, an email provider that delivers notifications and sign-in links, object storage that holds CV files, and the model provider named above. Each of them processes it on our instructions and for nothing else. Product analytics (PostHog) records how the portal is used — pages opened, clicks and sessions, with typed text and on-screen content masked — so we can see where it works and where it does not.

Between a partner and the team, the split is structural rather than a matter of care: a candidate’s contact details and surname are held apart from the CV a partner reads, so a partner sees a professional history and not a person to approach directly.

How long we keep it

While the account is active, and while the work it belongs to is current. Closing an account disables the sign-in rather than erasing the rows behind it: a colleague leaving must not rewrite the record of what they did, so their name stays on the changes they made. For deletion of anything specific, or of everything, write to support@hirex-ai.com and we will do it.

Google user data

This section is about data obtained through Google APIs specifically, and applies only if you connect a Google account.

What we obtain. Your Google account’s email address and sign-in identifier (openid, email); the intervals your calendar reports as busy (calendar.freebusy); and the ability to create and manage events on calendars you own (calendar.events.owned).

How we use it. The email address labels the connection, so you can see which account is connected and disconnect the right one. The free/busy intervals are drawn as shading under the interview times on offer, so you are not asked to take an hour you are already committed for. The write permission is used once per booking, to put that interview in your own calendar. Nothing is used for any other purpose, and we ask nothing beyond these: the free/busy scope cannot return an event, so titles, descriptions, attendees, locations and contents are not merely unread, they are unavailable to us.

What we do not do with it. Google user data is not sold, rented or licensed. It is not used for advertising or any form of profiling. It is not used to train, retrain or improve any artificial-intelligence or machine-learning model, ours or anyone else’s — no data obtained from Google APIs is sent to the model provider named above, or to any other one. It is not transferred to any third party for that party’s own purposes.

Who we share it with. Nobody, other than the infrastructure that runs HireX: our hosting and database provider, which stores the connection record on our behalf and under our instructions. No other broker, partner, or member of the HireX team sees your busy intervals as calendar data — they see only the interview times you have accepted, which you chose. We disclose Google user data outside that where the law requires it of us, and not otherwise.

How we protect it. The refresh and access tokens that let us ask Google these questions are encrypted at rest with AES-256-GCM under a key held outside the database, so a copy of the database is not a set of live keys to anyone’s calendar. All traffic to Google and to this application runs over TLS. Free/busy intervals are never written to our database: they are fetched when you open a calendar screen, held in memory for at most a few minutes, and dropped. Access to the connection records is limited to the application itself.

How long we keep it, and how to end it. Disconnecting in HireX erases the stored tokens immediately and all access stops with them; the interview entries already written to your calendar are yours and stay where they are, for you to delete. You can also revoke the grant at Google directly, at your Google account permissions. To have the connection record itself deleted, write to support@hirex-ai.com.

HireX’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Changes

When this page changes, the date at the top changes with it. Anything that would widen what we collect or what we do with it will be said here before it happens.