Privacy Policy

1. Introduction

HiringTree (“we”, “us”, “Platform”) is committed to protecting the personal data of all Users — Candidates, Agencies, and Companies. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights.

We process personal data in accordance with applicable data protection laws, including Nepal’s Individual Privacy Act, 2075 (2018) for candidates onboarded in Nepal, the General Data Protection Regulation (GDPR) where applicable, and the privacy laws of the other jurisdictions in which we and our Users operate.

2. Data Controller

HiringTree is the data controller for the personal data collected through the Platform. For questions or requests, contact contact@hiringtree.net.

3. Data We Collect

3.1 Information you provide

3.1.1 A note on source attribution

When a Candidate registers through a campaign link, a printed QR code, a referral code or a training institute’s link, we record which source it was. This stays attached to the Candidate’s record so that the employer, recruitment partner or institute that introduced them can see the outcome of doing so, and so that we can tell which sourcing channels actually work.

Attribution is recorded on first registration and is not changed afterwards. It identifies the source, not the Candidate’s behaviour across other websites: we do not track Candidates across the wider internet, and we do not sell or share this data with advertising networks.

3.2 Information collected automatically

• Device and browser information — IP address, browser type, operating system, device model, screen size.
• Usage data — pages visited, features used, timestamps, referring URLs.
• Cookies and similar technologies — see our Cookie Policy for details.

3.3 Information generated by the Platform

• AI match scores — numerical scores indicating fit between candidate profiles and job posts, together with the reasons recorded for each component of the score.
• Product events — a record that a step happened, such as a registration, an application, a screening completion or a stage change, used to measure how the hiring funnel performs.
• Pipeline history — the stages an application has passed through and when, retained so that funnel measurements stay accurate even after an application is rejected or withdrawn.
• Job review decisions — the approval, rejection or flag recorded by our team against a job post, and the reason given.
• Transcriptions and translations — text generated from voice recordings using AI services.

4. How We Use Your Data

5. AI Processing

We may use trusted AI and cloud providers, including Google Cloud, OpenAI, Anthropic, Firebase, and cloud infrastructure providers, to process voice recordings, translations and matching. The specific providers used may change as the platform evolves. These services help us:

• Transcribe candidate voice recordings into text profiles.
• Translate candidate voice answers into English so a profile can be read by an employer who does not share the candidate’s language.
• Generate match scores between candidate profiles and job requirements.

AI outputs are used as decision-support tools. No automated decision that produces legal or similarly significant effects is made without human review. Candidates may request a human review of any AI-generated output that affects them by contacting contact@hiringtree.net.

6. Data Sharing

We share personal data only in the following circumstances:

We do not sell personal data. We do not share data with third-party advertisers.

6.1 A note on WhatsApp verification codes

Where we verify a phone number, the one-time code is delivered over the WhatsApp Business Platform, which means your number and that code pass through Meta Platforms in order to reach you. Meta’s own handling of that message is governed by its privacy policy.

These messages are transactional only. We do not send marketing over WhatsApp, we do not use your number to build advertising audiences, and we do not pass your number to Meta or anyone else for advertising purposes. If you would rather not receive a code this way, contact contact@hiringtree.net and a member of our team will arrange another way to confirm your account.

7. International Data Transfers

Your data may be transferred to and processed in countries other than your country of residence, including to servers operated by trusted cloud and AI providers. Where data is transferred outside your jurisdiction, we rely on appropriate safeguards such as Standard Contractual Clauses or the data processor’s certifications and compliance programmes.

8. Data Retention

• Active accounts — data is retained for as long as your account is active.
• Deleted accounts — personal data is deleted within 30 days of account closure, except where retention is required by law or for legitimate dispute resolution.
• Voice recordings — retained for the duration of the candidate’s account. Deleted within 30 days of account deletion.
• Messages — retained for 12 months after the last activity on the conversation thread, then automatically deleted.
• Verification documents — retained for 24 months after an agency or company account is closed, for audit and compliance purposes.
• Anonymised analytics — may be retained indefinitely in aggregated, non-identifiable form.

9. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your personal data (“right to be forgotten”).
• Restriction — request that we limit processing of your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact contact@hiringtree.net. We will respond within 30 days.

Candidates do not have to write to us for the most common ones. Signed in, a Candidate can edit their profile, change whether they are looking for work, withdraw an application, see who has been granted access to their contact details, profile or documents and revoke it, delete a voice recording, deactivate their account, or request its deletion — all from their own settings. Withdrawing a consent stops the processing it covered and takes the Candidate out of every search and candidate list immediately. Deleting a voice introduction removes the audio and its transcript at once.

Erasure has its own page. Our Data Deletion Instructions explain how to request deletion — including how to do so if you cannot sign in or never held a login — what takes effect immediately, and which records are retained and why.

10. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption of data in transit (TLS) and at rest.
• Access controls limiting who can view personal data to authorised personnel only.
• Regular security reviews and monitoring.
• Secure authentication via Google Sign-In and hashed password storage.

No system is perfectly secure. If we become aware of a data breach that is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority as required by applicable law.

11. Children

The Platform is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors. If we learn that we have collected data from a person under 18, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notice at least 14 days before they take effect. The “last updated” date at the top of this page indicates the most recent revision.

13. Contact

For privacy inquiries, data requests, or complaints:

• Privacy and data requests: contact@hiringtree.net
• General support: contact@hiringtree.net

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.