Privacy policy

Scope and privacy roles

This draft covers HireHint websites, account registration, recruiting, candidate collaboration, employee operations, people workflows, reporting, and permission-scoped intelligence. It does not replace a customer organization’s candidate, employee, or workforce privacy notice.

For this draft, “HireHint” means hirehint LLC, a Virginia limited liability company. The final approved notice must distinguish the situations in which HireHint determines why information is used from the situations in which HireHint handles information only for a customer organization.

Sources of information

• Information a person supplies directly through an account, form, support request, application, employee profile, workflow, upload, or communication.
• Information a customer organization, authorized teammate, recruiter, manager, employee, candidate, or administrator adds under its own authority.
• Information created when people use HireHint, such as authentication events, page and feature activity, permission changes, audit history, error context, and device or browser details.
• Information received from a third-party service only when a customer or user chooses and authorizes that connection.
• Public or customer-approved information used to create a controlled recruiting or employee record, subject to applicable notice and lawful-use requirements.

Account, organization, and contact information

• Name, work email address, organization, job title, telephone number, profile details, and account preferences.
• Authentication method, email-verification state, session state, recovery events, memberships, assigned roles, organizational scopes, and account status.
• Workspace configuration, plan or trial state, feature access, billing-administration details, and authorized support contacts.
• Support correspondence, feedback, issue descriptions, and the minimum diagnostic context needed to investigate a request.

Recruiting and candidate information

• Job interests, application answers, resumes, work history, education, skills, qualifications, portfolio or profile links, and candidate-provided files.
• Application source, job and talent-pool relationships, pipeline stage, screening results, evaluations, scorecards, interview notes, and hiring-team feedback.
• Candidate communications, scheduling context, referrals, sourcing activity, consent or notice records, and permitted offer or compensation information.
• Workflow history, decisions, archive state, access history, and audit evidence created by authorized users.

A customer must provide the notices and obtain any permissions required for the recruiting information it collects or imports. HireHint does not turn sample or teaching content into a real candidate record.

Employee and workforce information

• Employee identity, work contact information, employment details, department, entity, location, site, manager, and reporting-line relationships.
• Profile fields, onboarding state, documents, files, tasks, acknowledgements, calendar information, attendance, leave, time records, and approval activity where the customer enables those features.
• Goals, performance, survey, development, and employee-reporting information where supported and lawfully configured.
• Draft, active, inactive, suspended, or removed status and the audit history needed to apply access and retention rules safely.

Customers should avoid entering highly sensitive information unless the relevant feature, permission model, notice, and legal basis have been reviewed for that use.

Technical, usage, and security information

• Internet Protocol address, browser and device characteristics, approximate locale, timestamps, requested routes, referring page, and product interaction events.
• Sign-in, verification, session, authorization, rate-limit, validation, security, and fraud-prevention signals.
• Error reports, performance measurements, request identifiers, deployment or application version, and bounded diagnostic logs.
• Audit and operational records that connect an authorized actor, organization, record, action, and outcome.

Why information is used

• Create and administer accounts, workspaces, roles, scopes, jobs, candidate workflows, employee workflows, and configured product modules.
• Authenticate people, enforce tenant and record boundaries, prevent unauthorized access, and apply permission changes.
• Deliver requested features, preserve workflow state, reconcile changes, and present loading, success, error, and recovery outcomes.
• Provide support, investigate incidents, prevent abuse, maintain audit evidence, and protect the service and its users.
• Operate, measure, debug, and improve product reliability with appropriately scoped and minimized evidence.
• Meet contractual, accounting, regulatory, legal, and dispute-handling obligations after the applicable terms are approved.

Lawful bases and customer instructions

Where applicable law requires a lawful basis, the final notice should identify the basis that applies to each HireHint-controlled purpose. Depending on the relationship, those bases may include performing a contract, taking requested pre-contract steps, complying with law, protecting legitimate operational and security interests, or consent where required.

When HireHint handles customer-controlled candidate or employee records, the customer’s documented instructions and agreement define the permitted processing. HireHint should not use those records for an unrelated purpose merely because the data is technically available.

The final lawful-basis, employment-data, and sensitive-data disclosures require qualified legal review for every jurisdiction in which the service will be offered.

AI-assisted features

HireHint may use permission-scoped context to summarize available records, identify missing evidence, help draft material, or suggest a next step. Output can be incomplete or incorrect and must be reviewed by an authorized person before a consequential hiring or employment action.

AI assistance should receive only the information needed for the requested task, preserve the surrounding organization and permission boundaries, and disclose when required evidence or provider capability is unavailable. A person remains responsible for the final decision and for complying with applicable employment and automated-decision requirements.

Service providers and disclosures

HireHint may engage providers for infrastructure, data storage, authentication, communications, monitoring, analytics, customer support, payments, and other functions required to operate an approved service. A provider should receive only the data needed for its configured function and be subject to appropriate contractual and security controls.

• Customer-authorized users receive information according to their active membership, role, scope, job assignment, reporting line, and record permissions.
• A connected provider receives information only after the required customer configuration and authorization.
• Professional advisers, auditors, insurers, or authorities may receive limited information when lawfully required to protect rights, investigate harm, or meet an obligation.
• A successor may receive relevant information in a properly reviewed corporate transaction, subject to appropriate notice and safeguards.

A reviewed subprocessor list, provider locations, processing purposes, and change-notice process must be published before external production use.

Third-party integrations and links

Customers may choose to connect job boards, identity providers, calendars, communications tools, assessment services, file services, or other third parties. Those services have their own privacy practices. HireHint distinguishes an integration displayed in a catalog from one that is configured, authorized, ready, active, failed, or disconnected.

Selecting an integration or following a third-party link may direct information outside HireHint. Customers should review the provider, requested permissions, destination, and retention behavior before enabling it.

Sale, sharing, and targeted advertising

No HireHint product behavior established in this review authorizes the sale of customer-controlled candidate or employee records. A production privacy notice must separately confirm the actual website analytics, advertising, and marketing stack and must provide any opt-out mechanisms required by applicable state law.

HireHint must not describe information as sold, not sold, shared, or not shared for statutory purposes until qualified review has mapped the live data flows to the definitions used by each applicable law.

Retention, deletion, and account closure

Customer-controlled records should be retained according to customer settings, documented instructions, contractual requirements, and applicable law. Retention may differ for active workspace data, archived records, backups, audit evidence, security logs, billing records, and legal holds.

Deletion from an active workspace may not immediately remove a record from bounded backups, immutable audit evidence, or records that must be retained by law. The final customer agreement and retention schedule must state the available export, closure, deletion, and recovery periods.

Candidates and employees should direct record-specific requests to the organization that collected their information. HireHint Support can route requests concerning HireHint-controlled account, support, security, or website data.

Storage locations and international transfers

The production architecture, hosting regions, support locations, subprocessors, and cross-border access paths determine where information is stored and processed. Those facts must be verified against the live service before an external notice names a region or transfer mechanism.

Where a transfer safeguard is required, HireHint and the customer should use the appropriate approved contractual or legal mechanism and make any required supplementary assessment available through the applicable agreement.

This draft does not claim a production hosting region, adequacy decision, transfer certification, or approved transfer mechanism.

Security and incident handling

HireHint uses layered identity, session, authorization, tenant-isolation, validation, audit, and recovery controls. Protected routes and requests are expected to re-evaluate the active identity and scope before returning or changing sensitive records.

No online service can promise absolute security. Customers should limit access to the people and records required for each workflow, remove access promptly, secure exported information and endpoints, and report a suspected incident through HireHint Support.

Privacy rights and requests

Depending on location and context, a person may have rights to request access, correction, deletion, restriction, portability, or an objection to certain processing, and may have a right to appeal a denied request. Some rights are subject to exemptions or verification requirements.

• Identify whether the request concerns a customer-controlled candidate or employee record, or information controlled directly by HireHint.
• Verify identity, authority, and the workspace or relationship involved without collecting unnecessary additional information.
• Route customer-controlled requests to the relevant organization and assist that organization as required by the applicable agreement.
• Record the request, decision, response, applicable exemption, and appeal path where required.

Jurisdiction-specific notices, authorized-agent rules, appeal steps, response periods, and non-discrimination statements require legal approval before publication.

Cookies and browser storage

HireHint uses browser storage and similar technologies where needed for authentication, security, navigation, preferences, and core product operation. Optional analytics, personalization, or marketing technologies must not be described as active unless their live configuration, purpose, duration, provider, and consent behavior have been verified and disclosed.

A separate cookie notice should identify each non-essential category and provide a working choice mechanism before those technologies are enabled where consent is required.

Children and sensitive use

HireHint is intended for authorized business users and for recruiting or employee interactions managed by customer organizations. It is not designed as a general service for children. A customer must not use HireHint to collect information from a child unless that use is lawful, necessary, appropriately noticed, and supported by the product and agreement.

Customers are responsible for determining whether a field, file, assessment, communication, or workflow contains sensitive or regulated information and for applying stricter access, notice, retention, and decision controls when required.

Changes, complaints, and accessible formats

Material updates should show a new effective date and be communicated through an appropriate product, account, or direct notice. Archived versions should be retained once a reviewed policy becomes externally effective.

A person may contact HireHint Support to request an accessible format, raise a privacy concern, or ask how to reach the appropriate privacy owner. The final notice must also identify any regulator or supervisory-authority complaint route required by applicable law.

Contact and company information

hirehint LLC is a Virginia limited liability company formed on October 18, 2024. Its principal office is 705 S College Ave # 1007, Bluefield, VA 24605-1640, USA.

Use HireHint Support for privacy questions or requests so the message can be routed to the appropriate owner. Do not include passwords, authentication codes, or unrelated sensitive records in an initial request.

A dedicated approved privacy email, controller or representative details, and any jurisdiction-specific service address remain subject to legal and operational approval.