Privacy Policy

This Privacy Policy describes how Hireaan ("we," "us," or "our") collects, uses, and shares information when you use our hiring platform. Please read this policy carefully to understand our practices regarding your personal data.

Who this policy is for

This policy is written for three audiences. Where treatment differs, we say so:

• Customers — recruiters, hiring managers, and team owners who sign up for a Hireaan workspace. For customer account data, Hireaan is the data controller.
• Candidates — job applicants whose information is uploaded to or generated within a customer's Hireaan workspace. For candidate data, the customer is the data controller and Hireaan is the data processor acting on the customer's documented instructions. Candidates exercising rights against a Hireaan customer should use the public request flow at https://{your-employer}.hireaan.hoogli.dev.br/privacy/request (see Section 9).
• Visitors — anyone browsing hireaan.hoogli.dev.br without an account. Hireaan is the controller for the limited data we collect from you (cookies, contact-form submissions).

Where this policy refers to "your data," it means the data we hold about you in whichever role you interact with us. If you are a candidate and want a copy of your data, or want it deleted, the route is the public request flow on your employer's tenant subdomain — not this page.

1. Information We Collect

Personal Information

• Account Information: Name, email address, password, company details, job title
• Profile Information: Employment history, educational background, skills, profile picture
• Candidate Data: Information you collect from job applicants through our platform
• Payment Information: Billing information and transaction records. Card details go straight to Mercado Pago; we keep only the card brand and last digits
• Business Information: Company size, industry, business address, tax identification numbers
• Communication Data: Email correspondence, support tickets, chat messages, feedback submissions
• Integration Data: Information shared through third-party integrations you enable

Usage Data

• Service Usage: How you interact with our platform, features used, time spent
• Device Information: IP address, browser type, operating system, device identifiers
• Log Data: Access times, pages viewed, features used, crashes, system activity
• Performance Data: Response times, error rates, system uptime metrics
• Aggregated Statistics: Anonymized data about hiring processes, conversion rates, hiring funnels
• Feature Adoption: Which features are used most frequently by your team

Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies to collect information about your interactions with our platform and to enhance your user experience.

2. How We Use Your Information and Lawful Basis

Under the EU and UK General Data Protection Regulation (GDPR) and Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), every processing activity must rely on a lawful basis (GDPR Article 6; LGPD Articles 7 and 11). The list below sets out, for each purpose, what we do, what data we use, and the lawful basis we rely on. The GDPR bases cited have direct LGPD equivalents: performance of a contract (Art. 7, V), legitimate interests (Art. 7, IX), legal obligation (Art. 7, II), and consent (Art. 7, I). For automated candidate scoring specifically, see Section 11 (Automated Decision-Making).

• Provide and operate the Hireaan service — Account creation, workspace access, candidate pipeline management, interview scheduling, offer letters. Lawful basis: performance of a contract (Art. 6(1)(b)) for customers; legitimate interests (Art. 6(1)(f)) of the customer for candidate data processing on their behalf.
• Process payments and manage subscriptions — Billing, charge history, plan changes via Mercado Pago. Lawful basis: performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) for tax / accounting record-keeping.
• Send service and transactional communications — Verification emails, password resets, candidate application notifications, system alerts. Lawful basis: performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) in keeping users informed of activity on their account.
• Send WhatsApp messages on behalf of customers — Application updates and other recruitment messages sent from the customer's own WhatsApp Business number, only to candidates who authorized them. Lawful basis: consent of the candidate (GDPR Art. 6(1)(a); LGPD Art. 7, I), collected by the customer through Hireaan (see Section 5).
• Send marketing communications — Product updates, newsletters, occasional offers (customers only; never to candidates). Lawful basis: consent (Art. 6(1)(a)) where required, or legitimate interests(Art. 6(1)(f)) under the soft-opt-in for existing customers. You can unsubscribe at any time via the link in any marketing email.
• Improve the platform and analyse usage — Product analytics, feature adoption metrics, bug diagnostics. Lawful basis: legitimate interests (Art. 6(1)(f)) in operating and improving a recruitment platform; consent (Art. 6(1)(a)) for non-essential cookies on the public career-page surfaces (see Cookies and Tracking Technologies in Section 1).
• Detect, prevent, and respond to fraud and abuse — Account abuse, brute-force attempts, spam detection, suspicious activity in candidate flows. Lawful basis: legitimate interests (Art. 6(1)(f)) in keeping the service safe and reliable.
• Comply with legal obligations — Responding to law-enforcement requests, tax record retention, enforcing terms of service. Lawful basis: legal obligation (Art. 6(1)(c)).
• Generate AI candidate summaries, ranking, and assessment scoring — See Section 11. Lawful basis: legitimate interests (Art. 6(1)(f)) of the customer in efficient candidate evaluation, with safeguards described in Section 11.

3. Third-Party Services We Use

We use various third-party services to support our platform:

• Authentication: Google Auth for user login
• Communications: Gmail for sending email messages; Meta's WhatsApp Business Platform for WhatsApp messages, when a customer connects its WhatsApp number
• Scheduling: Google Calendar for interview scheduling, Google Meet for virtual interviews
• Analytics: PostHog to track usage data and improve our services
• Customer Support: Third-party customer service tools to assist with support requests
• Payment Processing: Mercado Pago for secure payment processing
• Marketing: Affiliate marketing software, email marketing platforms

These third-party services may collect information sent by your browser as part of their operations. Their use of your information is governed by their respective privacy policies.

For the complete, up-to-date list of sub-processors — including the entity, processing location, and international transfer mechanism for each — see our Sub-Processors page.

4. Google API Data Usage and Privacy

What Google Data We Access

Hireaan integrates with Google services to streamline recruitment workflows:

How We Use Google Data

• Email Sending: When you send a message to a candidate through Hireaan, we use gmail.send to deliver it from your Gmail account
• Calendar Scheduling: When you schedule an interview, we create a calendar event in your Google Calendar with interview details and Google Meet links
• Forms Import: When you import candidates from Google Forms, we read your form structure to enable field mapping, then read form responses to create candidate profiles in Hireaan. File attachments (such as resumes) are downloaded and stored securely in your Hireaan account.
• Account Management: We use your email and profile to manage your Hireaan account and provide personalized features

Data Storage and Security

• Email content: We store the text of emails you compose through Hireaan until you manually delete them
• Calendar data: We store interview event details until you manually delete them
• Google Forms data: Imported candidate data from Google Forms responses is stored as candidate profiles in your Hireaan account. File attachments are downloaded once and stored securely; we do not maintain ongoing access to your Google Forms responses after import.
• Security measures: All Google OAuth tokens are encrypted at rest and in transit using industry-standard encryption (AES-256)
• Access controls: Only authorized system components can access Google API credentials

Data Sharing

• We do NOT sell, rent, or share your Google data with third parties
• We do NOT use your Google data for advertising or marketing purposes
• Your Google data is used exclusively within Hireaan for the recruitment features you've authorized

Your Rights and Controls

You can:

• Revoke access: Disconnect Google integration at any time through Settings → Integrations in your Hireaan account
• View connected permissions: Check your Google Account permissions at myaccount.google.com/permissions
• Request data deletion: Contact lgpd@hireaan.com.br to request deletion of your Google-related data
• Export your data: Available through your account settings

Google API Services User Data Policy Compliance

Hireaan's use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements.

Data Retention

• Email content: Retained until manually deleted by the organization owner
• Calendar events: Retained until manually deleted by the organization owner
• Google Forms imported data: Candidate profiles created from Google Forms imports are retained until manually deleted by the organization owner. We do not store raw Google Forms responses; only the mapped candidate data is retained.
• OAuth tokens: Retained while your integration is active, deleted immediately upon disconnection

Updates to Google Data Handling

We will notify users of any material changes to our Google data handling practices via email and in-app notifications at least 30 days before changes take effect.

5. WhatsApp Business Platform (Meta)

Customers can connect their own WhatsApp Business number to Hireaan through Meta's WhatsApp Business Platform (Cloud API). Hireaan acts as a technology provider: it sends messages and manages message templates on the customer's behalf. The customer stays the owner of its WhatsApp account, and Meta bills the customer directly for messages.

What data we receive from Meta

• About the customer's WhatsApp account: the access token Meta issues when the customer connects, the WhatsApp Business Account ID, the phone number ID, the display name and phone number, the quality rating, the daily messaging limit, and the review status of each message template.
• About candidates: the delivery status of each message (sent, delivered, read, or failed), the WhatsApp ID Meta returns for the candidate's phone number, and messages candidates send to the customer's number.

How we use it

• To send the messages the customer's recruiters or automations choose to send, and to show their delivery status in the workspace.
• To show candidates' replies to the customer's recruiters.
• To keep the connection working: subscribe to the account's events, show quality and limit warnings, and submit templates for review.

We do not sell WhatsApp data, share it with anyone other than the customer and Meta, use it for advertising, or use it to train AI models. Data a customer receives from Meta is visible only inside that customer's workspace.

Candidate authorization

A customer can send WhatsApp messages only to candidates who authorized them. Authorization is given per organization, by ticking a box on the application form (never pre-ticked) or by confirming through a link sent by email. We record when and how it was given and the exact text the candidate agreed to. A candidate can withdraw it at any time by asking the employer, and the recruiter revokes it in the candidate's profile; after that, Hireaan blocks every WhatsApp message to that candidate.

Storage, security, and retention

• Access token: encrypted at rest, and deleted as soon as the customer disconnects the number in Organization → Integrations. Disconnecting also stops the account's events from reaching Hireaan.
• Messages, statuses, and authorizations: kept with the candidate record and deleted with it, following the retention windows in Section 8.
• WhatsApp ID: deleted when the candidate's phone number changes.

To delete WhatsApp data, see How to delete your data in Section 9.

6. Information Sharing and Disclosure

We may share your information in the following circumstances:

• With Your Consent: When you authorize us to share your information
• Service Providers: With third-party vendors who provide services on our behalf
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• Legal Requirements: When required by law, legal process, or government request
• Protection of Rights: To protect our rights, privacy, property, or safety, and that of our users

We do not sell your personal information to third parties.

7. Data Security

We implement appropriate technical and organizational measures to protect your information. However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security of your data.

8. Data Retention

We retain personal data only as long as necessary for the purposes set out in this policy, after which we either delete it or anonymise it. The default windows are:

• Rejected candidate records: 730 days (24 months) by default, after which the candidate is automatically purged. Customers can override this from Organization → Data retention in the app, with a minimum of 30 days and a maximum of 3,650 days.
• Inactive candidate records (applied but never reached an outcome): 1,095 days (36 months) by default, configurable per workspace.
• Soft-deleted candidates and applications: 30-day grace period before hard-deletion. During grace, a recruiter may restore the record.
• Soft-deleted workspaces: 30-day grace period before the entire team and its data are hard-deleted.
• Audit and activity logs: 6 months in primary storage; archived to encrypted cold storage for an additional 18 months; hard-deleted at 24 months.
• Subject-access-request verification tokens: 72 hours from issuance. Download links for completed exports: rotated single-use token with a 5-minute presigned URL on each click.
• Billing and tax records: 7 years, as required by applicable tax law.
• Account data after closure: deleted or anonymised within 30 days, except where retention is required for legal, tax, or fraud-prevention purposes.

Customers can configure per-workspace retention windows for rejected and inactive candidate records at Organization → Data retention inside the app. Setting a shorter window does not reduce statutory retention obligations (e.g. billing records).

9. Your Rights and How to Exercise Them

If you are in the EEA, the UK, Switzerland, California, or another jurisdiction with comparable privacy law, you have the following rights regarding personal data we hold about you:

• Right of access (Art. 15) — Confirmation of whether we process your data, and a copy of it.
• Right to rectification (Art. 16) — Correction of inaccurate or incomplete data.
• Right to erasure / right to be forgotten (Art. 17) — Deletion of your data, subject to lawful exceptions.
• Right to restrict processing (Art. 18) — Request that we limit how we process your data.
• Right to data portability (Art. 20) — Receive your data in a structured, machine-readable format (we provide a ZIP bundle with a JSON manifest).
• Right to object (Art. 21) — Object to processing based on legitimate interests, including profiling.
• Right not to be subject to automated decision-making (Art. 22) — See Section 11 for how this applies to AI candidate ranking.
• Right to withdraw consent (Art. 7(3)) — Where processing is based on consent, withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint (Art. 77) — File a complaint with your local supervisory authority. For EU residents, find your authority at edpb.europa.eu/about-edpb/about-edpb/members.

If you are in Brazil, the LGPD (Article 18) gives you the right to confirm whether we process your data; access it; correct incomplete, inaccurate, or outdated data; have unnecessary or excessive data anonymised, blocked, or deleted; port it to another provider; have data processed on the basis of consent deleted; know with whom we share it; be told what happens if you refuse consent; and withdraw consent at any time. You can also ask for a review of decisions made solely by automated processing (Article 20). You can file a complaint with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.

How to exercise these rights

The route depends on your relationship with Hireaan:

• If you are a candidate who applied for a role through a Hireaan customer's career page, the customer (your prospective employer) is the data controller. Use their public request flow at https://{your-employer}.hireaan.hoogli.dev.br/privacy/request — you'll be asked for your email, you'll get a verification link, and once verified you can download your data or request deletion. We respond within 15 days.
• If you are a customer (recruiter or team owner), you can manage retention, anonymise candidates, or delete candidate records directly from inside your workspace. For requests about your own customer-account data, email lgpd@hireaan.com.br.
• If you are a visitor, email lgpd@hireaan.com.br with your request.

How to delete your data

This includes data we receive from Meta through the WhatsApp Business Platform. Deletion is permanent once any grace period below ends.

• Candidates: use the request flow on your employer's career page, https://{your-employer}.hireaan.hoogli.dev.br/privacy/request, and choose deletion. Your applications, messages (WhatsApp included), WhatsApp authorization, and files are deleted from that employer's workspace. To only stop WhatsApp messages, ask the employer to revoke your authorization.
• Customers: to delete WhatsApp account data, disconnect the number in Organization → Integrations; the access token is deleted immediately. To delete candidate records, delete or anonymise them in the workspace (30-day grace period, see Section 8). To delete your whole workspace and account, email us; everything is deleted within 30 days, except billing records we must keep by law.
• Anyone, including if you cannot use the options above: email lgpd@hireaan.com.br with the subject line "Data deletion" and the email address or phone number your data is linked to. We confirm the deletion within 15 days, or tell you why part of the data must be kept (for example, a legal retention duty).

We may need to verify your identity before fulfilling a request. Where we cannot identify you in our records (for example, because you applied to a customer's career page that has since been deleted) we will tell you so without disclosing whether your data is held by any other tenant.

10. Sub-Processors and Data Processing Addendum

We engage trusted third-party service providers (sub-processors) to help us deliver the Hireaan platform — for example, Cloudflare R2 for file storage, OpenAI for AI summaries and assessment scoring, Mercado Pago for billing, Meta for WhatsApp messages. The full up-to-date list, including the entity, processing location, and international transfer mechanism for each, lives at hireaan.hoogli.dev.br/sub-processors. That list is incorporated by reference into this policy and into our Data Processing Addendum (DPA).

Customers requiring an executed DPA for EU candidate data processing can review and accept our DPA at hireaan.hoogli.dev.br/dpa or in-app under Organization → Settings. Acceptance is recorded with timestamp, acceptor identity, and DPA version.

We commit to providing at least 30 days' advance notice of any new sub-processor that will process customer personal data, giving customers time to object on reasonable grounds. To subscribe to change notifications, email lgpd@hireaan.com.br with the subject line "Subscribe to sub-processor changes."

11. Automated Decision-Making and AI Processing

Hireaan uses AI to help recruiters review candidates faster. Specifically, we use OpenAI models to:

• Generate a short summary and verdict ("Strong Yes / Yes / Maybe / No") on each candidate's profile
• Rank candidates within a job posting based on the job description and resume content
• Score open-ended assessment answers and produce a recommended overall score
• Transcribe candidate video responses (Whisper)
• Parse uploaded resumes into structured fields (skills, work experience, education)

These outputs are recommendations to the recruiter. They do not by themselves produce a hiring decision, an offer, or a rejection. A human recruiter reviews and decides every stage move, every offer, and every rejection. Under Article 22 of the GDPR, this means our AI processing is decision-support, not solely-automated decision-making, because a human is meaningfully involved in every consequential outcome.

Safeguards. AI-generated summaries are clearly labelled in the recruiter UI. The recruiter sees the underlying resume, application answers, and assessment responses alongside the AI verdict. Recruiters can regenerate or ignore an AI summary at any time. AI is never used to auto-reject candidates without a recruiter-configured automation rule (which the recruiter sets up explicitly).

Candidate rights. If you are a candidate and you do not want AI processing applied to your application — for example, because you'd prefer your application be reviewed without an AI summary or rank — you can request this via the public request flow at your prospective employer's tenant subdomain (see Section 9). We are working to ship a self-service AI opt-out toggle on the candidate-facing privacy request form; until then, customer-side recruiters can honour this objection manually on a per-candidate basis.

12. International Data Transfers

Hireaan is operated by HIREAAN PLATAFORM LTDA. Several of our sub-processors are based in the United States or operate global infrastructure, so personal data may be processed outside your country. When personal data of EEA, UK, Swiss, or Brazilian data subjects is transferred outside those regions, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs). The European Commission's Standard Contractual Clauses, Module 2 (controller-to-processor), as published in Commission Implementing Decision (EU) 2021/914.
• EU-US Data Privacy Framework. Where a sub-processor is self-certified under the DPF (Cloudflare, OpenAI, Stripe, Zoom, Google, Meta — see the sub-processor list for current status), transfers to that sub-processor additionally rely on that adequacy mechanism.
• UK International Data Transfer Addendum. For transfers from the UK, we incorporate the UK IDTA to the SCCs.
• Brazil (LGPD Article 33). For transfers of personal data from Brazil, we rely on the mechanisms of Article 33 of the LGPD, including standard contractual clauses under the ANPD's International Data Transfer Regulation (Resolution CD/ANPD No. 19/2024), and, where applicable, the data subject's specific consent.

For UK and Swiss transfers, equivalent safeguards apply via the UK IDTA and the Swiss Federal Act on Data Protection (FADP) respectively.

13. Children's Privacy

Our services are not directed to individuals under 16. We do not knowingly collect personal information from children. If we learn that we have collected personal information from a child, we will take steps to delete that information.

14. Changes to This Privacy Policy

We may update this Privacy Policy periodically. The updated version will be effective as of the date stated at the top of this policy. We will notify customers of any material changes by email and via in-app notification at least 30 days before the change takes effect.

15. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Company: HIREAAN PLATAFORM LTDA
Address: SRTVS Quadra 701, Conjunto E, Ed. Asa Sul, Brasília – DF, 70340-902, Brasil
Email: lgpd@hireaan.com.br
Data protection inquiries: lgpd@hireaan.com.br (subject line: "Data protection")
Data Protection Officer (Encarregado, LGPD Art. 41): Eduardo Lustosa de Souza, lgpd@hireaan.com.br
Website: hireaan.hoogli.dev.br/contato

By using Hireaan, you acknowledge that you have read and understood this Privacy Policy.