Privacy Policy

2.Our role: controller and processor

Our responsibilities differ depending on whose data is involved, and this distinction matters for how you exercise your rights.

• We act as a controller for data about our website visitors, prospective customers, demo requesters, and the individual users who administer a customer account. We decide why and how that data is processed.
• We act as a processor for candidate and applicant data that a customer uploads to or generates within HireAivv. The employer or recruitment agency using HireAivv is the controller: they decide which roles to hire for, which candidates to assess, and how long to keep the records.

3.Personal data we collect

We do not ask for special category data. Résumés occasionally contain information a candidate volunteered — health, religion, trade-union membership, or similar. We do not use such information for scoring or ranking, and customers should not upload it deliberately or use it in hiring decisions.

4.How we use personal data, and our legal bases

We do not sell personal data, and we do not share it with third parties for their own advertising or marketing purposes.

5.Automated processing and AI decision-making

HireAivv uses large language models and statistical matching to parse résumés, extract skills, score candidate-to-role fit, rank shortlists, generate interview questions, and summarise screening conversations. Because this directly affects people's employment prospects, we want to be explicit about how it works.

• Scores are decision support, not decisions. HireAivv surfaces rankings and recommendations. Our customers are contractually required to keep a human reviewer responsible for every rejection, advancement, and hiring decision.
• Models are not trained on customer data. We do not use candidate data, résumés, assessment output, or interview transcripts to train or fine-tune our own models, and our AI sub-processors are engaged under terms that prohibit them from training their models on data we submit.
• Inputs are limited to job-relevant signals. Matching operates on skills, experience, qualifications, and role requirements. Protected characteristics are not used as scoring inputs.
• Output can be wrong. Language models can misread a document or infer something inaccurate. Candidates may ask the employer to review any assessment, and employers can override any score in the platform.
• Logging and traceability. Assessment output is retained with the associated role and timestamp so a customer can reconstruct how a shortlist was produced.

6.Voice screening, recordings, and transcripts

Where a customer enables AI voice screening or meeting intelligence, calls and interviews may be recorded and transcribed to produce summaries, evaluations, and structured notes.

• Notice and consent are obtained before recording begins, in the manner required by the applicable jurisdiction. Several jurisdictions require the consent of every participant.
• Participants may decline to be recorded. Our customers are responsible for offering an equivalent, non-recorded path where a candidate objects.
• Recordings and transcripts are stored as customer data and are subject to the customer's retention configuration.
• We do not use voice data for biometric identification, voiceprinting, or emotion inference.

7.Sharing and sub-processors

We share personal data with the service providers below, each engaged under a written contract that restricts them to processing data on our instructions and requires appropriate security measures.

We also disclose personal data where required by law or valid legal process; to protect the rights, safety, and property of TechAIVV, our customers, or the public; and to a successor entity in connection with a merger, acquisition, or sale of assets, subject to this policy continuing to apply.

8.International data transfers

We operate globally, and the sub-processors above may process data outside your country of residence, including in the United States, the European Union, and India. Where we transfer personal data out of the EEA, the UK, or another jurisdiction with transfer restrictions, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism, together with supplementary technical measures such as encryption in transit and at rest.

Customers with data residency requirements should contact us before onboarding so we can confirm what we can support. TODO: state the supported residency regions once infrastructure is confirmed.

9.Data retention

We keep personal data only as long as needed for the purpose it was collected, or as required by law.

10.Security

We apply technical and organisational measures appropriate to the sensitivity of recruitment data, including:

• Encryption of data in transit (TLS) and at rest.
• Role-based access control, with tenant isolation so one customer cannot access another customer's data.
• Scoped, expiring authentication tokens and hashed credential storage.
• Least-privilege internal access, granted on a need-to-know basis and reviewed periodically.
• Audit logging of access to candidate records and administrative actions.
• Secure development practices, dependency monitoring, and environment separation.
• Encrypted, access-controlled backups.

No system is perfectly secure. If we become aware of a personal data breach affecting your data, we will notify affected customers without undue delay and, where we are the controller, notify supervisory authorities and individuals as required by law.

11.Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you and receive a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data, subject to legal retention obligations.
• Restrict or object to processing, including objecting to processing based on legitimate interests and to direct marketing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent at any time, without affecting processing already carried out.
• Not be subject to a decision based solely on automated processing with legal or similarly significant effects.
• Nominate another person to exercise your rights in the event of death or incapacity (India's DPDP Act).
• Complain to your supervisory authority or, in India, the Data Protection Board.

To exercise a right, email privacy@hireaivv.ai. We respond within 30 days, and will tell you if we need longer. We may ask for information to verify your identity. Exercising your rights is free, and we will not treat you differently for doing so.

12.Cookies and similar technologies

Our application uses strictly necessary cookies and local storage to keep you signed in, maintain session state, and protect against cross-site request forgery. These cannot be switched off without breaking the service.

Where we use analytics or performance cookies on our marketing site, we request consent in regions that require it, and you can change your choice at any time. Most browsers also let you block or delete cookies directly. TODO: confirm which analytics tooling is deployed and add a cookie table if consent-gated cookies are introduced.

13.Children

HireAivv is a business tool intended for adults in professional hiring contexts. We do not knowingly collect personal data from children. Where a customer's hiring programme involves candidates under the age of majority in their jurisdiction, that customer is responsible for obtaining any consent required by law. If you believe a child's data has been provided to us, contact privacy@hireaivv.ai and we will delete it.

14.Changes to this policy

We may update this policy to reflect changes in our services, technology, or legal obligations. We will update the effective date at the top of this page, and for material changes we will notify account administrators by email or in-product notice before the change takes effect. This version is effective 20 July 2026.

15.Contact us

TechAIVV Technologies — privacy@hireaivv.ai

TODO: insert registered company name, full registered address, company registration number, and the name and contact details of the Data Protection Officer or privacy contact. If TechAIVV offers services in the EEA or UK without an establishment there, an Article 27 representative must also be named here.