Privacy Policy

This Policy applies to the AuraHire web application, marketing pages, supporting APIs, transactional emails, and any related services we operate (collectively, the “Platform”). It is incorporated into our Terms of Service and applies to candidates, recruiters, company administrators, and platform administrators.

Personal data

Information that identifies, or could reasonably be linked to, a natural person, such as name, email, phone, location, or resume content.

Processing

Any operation performed on personal data, including collection, storage, use, transmission, redaction, scoring, anonymization, and deletion.

Controller / processor

AuraHire is the controller of candidate-account data. For application data inside a hiring company, AuraHire acts as a processor on behalf of that company.

• Operating the Platform, authenticating users, presenting your dashboard, delivering applications to recruiters, and routing notifications.
• Computing match scores, extracting structured evidence, redacting personal identifiers, and producing explainable scores against role criteria.
• Mitigating bias, checking job descriptions for biased language and exposing aggregate fairness metrics to platform admins.
• Securing the Platform, detecting abuse, throttling unusual traffic, and investigating incidents.
• Communicating, sending transactional emails (verification, status updates, interview invitations) and responding to support requests.
• Maintaining audit trails, recording consequential actions for transparency, dispute resolution, and regulatory compliance.
• Improving the product, analyzing aggregate, de-identified usage patterns. We do not train AI models on your personal data without an explicit, opt-in basis.

Before any resume content is sent to an AI scoring or parsing model, it passes through an automated PII redaction step. The redaction targets categories of data that should not influence a score.

• Names and contact details, first/last name, email, phone, postal address, social-network handles.
• Demographic-correlated identifiers, date of birth, photographs, gender pronouns, marital status, nationality.
• Locations beyond the granularity needed for a role match, full street addresses are reduced to city / region.
• Other identifiers a recruiter does not need to score against role criteria, passport numbers, government IDs, references' personal details.

• Authentication cookies, set by our identity provider so you stay signed in. These are strictly necessary.
• Session cookies, used to keep your in-product state (filters, drawer open/closed) consistent during a visit.
• Security cookies, used for CSRF protection and to detect anomalous activity.

We do not deploy advertising cookies, cross-site trackers, or third-party analytics that profile users for marketing. If we ever introduce optional analytics, we will obtain your consent first where required by law.

• Transport security, all traffic is served over HTTPS with modern TLS configurations.
• Authentication, JWT-based session tokens validated on every request, with role-based access control on protected endpoints.
• Database, Postgres with row-level security policies that scope every read/write to the rows the user is allowed to see.
• Backend isolation, AI keys and database credentials live only on the backend. The frontend never sees them.
• Auditability, consequential mutations write to an immutable audit log.
• Operational hygiene, least-privilege access for engineers, encrypted backups, and incident-response runbooks.

• Cloud hosting, for compute and storage of application infrastructure.
• Managed Postgres, for relational data, with row-level security and encryption at rest.
• Authentication, for sign-in, JWT issuance, and password recovery.
• AI inference, for resume parsing, match scoring, and bias detection. Used in inference mode only; data is not used for training.
• Transactional email, for verification emails, status updates, and interview notifications.
• Error monitoring, for application-error reporting; configured to scrub personal data from payloads.

An up-to-date list of named sub-processors is available on request. We give reasonable advance notice before adding a new sub-processor that materially expands the categories of personal data processed.

AuraHire and its sub-processors may process personal data in countries other than the one in which it was collected. Where required, we use standard contractual clauses or other lawful transfer mechanisms to protect personal data in transit and at rest. The protections in this Policy follow your data wherever it is processed.

AuraHire is not directed to children under 16, or under the age of digital consent in your jurisdiction (whichever is higher). We do not knowingly collect personal data from children below that threshold. If we learn we have collected such data, we will delete it promptly. Contact us using the address below if you believe a child has supplied data through the Platform.

We may update this Policy from time to time. When we do, we will update the “Last updated” date at the top of this page and, for material changes, provide reasonable advance notice, typically by email or an in-product banner. Continued use of the Platform after the effective date of an update constitutes acceptance of the revised Policy. Prior versions are available on request.

Reach out using the contact card below for any privacy question, request to exercise your rights, or report of a suspected privacy issue. Where required, we will verify your identity before disclosing personal data, to protect you from impersonation.