The short version
1. Who we are
This Privacy Policy describes how HyreTech Pte. Ltd., operating as HyreTech (“we”, “us”), handles personal data through our platform at hyretech.ai. We are a Singapore-registered company at 77 High Street, #10-12B, High Street Plaza, Singapore 179433. You can use HyreTech as your applicant tracking system, or keep your existing stack and import candidates for AI evaluation.
Our primary privacy regime is Singapore’s Personal Data Protection Act (PDPA). We also honour EU/UK GDPR rights and US state-law rights (including CCPA/CPRA and NY SHIELD) for people in those jurisdictions, to the extent they apply.
When our clients (“Clients”) use HyreTech to manage hiring, they are the data controller for candidate data and we act as the data processor, processing candidate data solely on the client’s documented instructions (except for the résumé screener and role-recommendation emails, described below). For data we collect directly — such as account information and website analytics — we are the data controller.
Contact: privacy@hyretech.ai
2. Talent pool submissions on HyreTech pages
When a candidate submits their information directly through a HyreTech-hosted talent-pool page (for example, hyretech.ai/companies/<client>/join), HyreTech acts as a joint controller with the named client for that submission. This differs from our role on a client’s own integrated site, where the client remains the sole controller and we act only as their processor.
What we collect on these pages. Contact details (name, email, phone), location, links (LinkedIn, portfolio, GitHub, etc.), an uploaded CV, and a record of the consent version, IP address, and user agent at the time of submission.
Recipients. The named client whose page the candidate submitted through. If that client is a recruitment agency, the agency may forward the submission to its own end clients — the candidate is told this on the submission page before they submit. We do not share talent-pool submissions across unrelated clients.
Purpose. AI-assisted matching of the candidate against the named client’s current and future open roles, both as a passive talent pool and as an applicant pipeline when matching roles open.
Legal basis. The candidate’s consent, captured at submission time and stamped with a consentVersion identifier so we can later demonstrate which version of this disclosure was shown. Candidates may withdraw consent at any time.
Retention. We keep a submission until the candidate or the client asks us to delete it, and we delete it within 30 days of a verified request. Submissions are not yet deleted automatically after a fixed period.
Your rights as a talent-pool candidate. Access, correction, withdrawal of consent, and deletion. Email privacy@hyretech.ai and identify which client’s page you submitted through. Because we share controllership for these submissions, we act on these requests directly rather than forwarding to the client.
3. Free résumé screener
Our free résumé screener at hyretech.ai/tools/resume-screener scores one CV against a job description, without an account. The CV is usually about someone other than the person uploading it. HyreTech Pte. Ltd. is the data controller for screenings.
What we collect. The uploaded CV (a PDF), the job description pasted with it, and the uploader’s IP address, which is stored with the screening.
Purpose. To score the CV against the job description and show the result to the uploader, and to limit screenings to three per IP address per 24 hours. We send no email about a screening. The result shows scores and reasoning, not the name or contact details in the CV, but the reasoning can mention experience described in it.
Recipients. The CV text is parsed and scored by our AI sub-processors, OpenRouter and Google Vertex AI, listed under “Who we share data with”. Screening traces in Langfuse are redacted and do not contain the résumé text.
Legal basis. The uploader’s request to run the screening, and their confirmation that they have permission from the person on the CV. For the IP address, our legitimate interest in preventing abuse.
Retention. The result is available for 24 hours after the screening. After that, a clean-up that runs every hour deletes the file (all stored versions of it), the data extracted from it, and the screening record, including the IP address. Our storage provider keeps deleted files recoverable for up to 7 days.
Your rights. To exercise your rights over a screening, email privacy@hyretech.ai. This includes the person named on a CV that someone else uploaded. We act on these requests ourselves rather than forwarding them to a client.
4. Emails we send
We send the next two kinds of email on our own behalf, as data controller, not on a client’s instructions.
Role recommendations to candidates. If you are a candidate in HyreTech and have email notifications on, we may email you, at most once every 7 days, with up to five roles that are open, publicly listed on HyreTech by the company you most recently applied to through HyreTech, and a match for your profile. People a company imports from its own applicant tracking system are not emailed about that company’s roles. Roles from a company that has marked you as do-not-hire are never included.
These emails are sent through our email provider, Mailjet, which receives your name and email address, the roles, and for each role a short excerpt (up to 120 characters) quoted from your own CV explaining the match. Our legal basis is our legitimate interest in telling candidates about relevant roles. Every email has an unsubscribe link, and unsubscribing stops role recommendations from every company.
Onboarding emails to workspace members. After a new workspace is created, we send its members a short series of emails, on days 1, 3 and 7, to help them get started. Our legal basis is our legitimate interest in helping new users get started. Every email has an unsubscribe link.
We also send the two emails below to candidates on behalf of the hiring company, as data processor, on the company’s instructions.
Application confirmation. When you apply to a role through HyreTech we email you a confirmation on behalf of the hiring company.
Rejection notice. If the hiring team decides not to proceed and chooses to notify you, we email that notice on their behalf. It never contains internal notes and is never sent automatically by AI.
5. What we collect
We process personal data provided by clients and candidates through the platform — such as contact details, professional background, qualifications, and application data — as well as account and billing information from clients. We also automatically collect device information, usage analytics, and cookies.
6. How we use it
We process personal data to operate the platform, run AI-powered resume parsing and candidate matching, manage accounts and billing, communicate with you, improve our services, comply with legal obligations, and maintain security.
Each AI operation on the platform consumes one AI credit. Credit usage is logged against client accounts, not individual candidates.
7. Legal basis
Depending on your jurisdiction, we process data based on consent, contractual necessity, legitimate interest, or legal obligation — in accordance with applicable data protection laws.
8. AI and automated decisions
HyreTech uses AI for resume parsing, candidate matching, skill assessment, and screening. These are decision-support tools — human recruiters retain final hiring authority. No candidate is automatically rejected or accepted by AI. The AI can label a candidate, for example with a “reject” recommendation, but a label never changes a candidate’s status; a person on the client’s team does.
You may have the right to request human review of AI-driven decisions, receive an explanation of how AI processing works, and contest automated outcomes. Contact your prospective employer or email us at privacy@hyretech.ai.
9. Who we share data with
We share data with clients and their authorised team members, cloud infrastructure providers, payment processors, analytics providers, and legal authorities when required by law. In the event of a merger or acquisition, data may transfer to the successor entity.
We do not sell personal data. We do not use candidate data for advertising.
Where each one processes data is listed under International transfers. Business clients can request a Data Processing Agreement from privacy@hyretech.ai. We update this list when we add a sub-processor that handles candidate data.
10. Google API Services
HyreTech’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We only use data obtained through Google APIs for the purposes described in this Privacy Policy and do not use it for serving advertisements or transfer it to third parties for unrelated purposes.
11. International transfers
We are based in Singapore and our production infrastructure runs in the asia-southeast1 (Singapore) region, and Google Vertex AI creates embeddings there too. Some vendors process data elsewhere: AI inference through OpenRouter, whose upstream model provider’s region is not fixed; LLM traces in Langfuse (EU, Ireland); product analytics and support chat in PostHog (EU); and error tracking (Sentry), payments (Stripe) and team notifications (Slack) in the United States. For transfers out of Singapore we rely on the receiving organisation being bound to PDPA-comparable protection; for EU/UK transfers, on Standard Contractual Clauses or an adequacy decision. Contact privacy@hyretech.ai for details.
12. Retention
We keep candidate data for as long as the client keeps it in HyreTech, and delete it within 30 days of a verified request from the client, or from the candidate where we act on our own behalf. Candidate data is not yet deleted automatically after a fixed period. A workspace user’s personal data is purged after they delete their account, as described below. We keep billing records for as long as tax and accounting law requires, and server logs for 90 days.
Deletion requests are actioned within 30 days. Deleting your account takes effect immediately — subsequent authenticated requests fail — and queues an irreversible purge of personal data that runs after a 30-day grace window. The grace period is deliberate: an account deleted in error can be recovered by emailing privacy@hyretech.ai before the purge runs, while erasure still completes inside the 30-day SLA.
13. Your rights
Depending on where you are, you may have the right to access, correct, delete, or port your data, restrict or object to processing, withdraw consent, and lodge a complaint with a supervisory authority.
Candidates: Direct your request to the employer who manages your data through HyreTech. We process candidate data on behalf of our clients and cannot independently fulfil requests without the client’s instruction. If you contact us at privacy@hyretech.ai, we’ll forward it to the relevant client. For the résumé screener and role-recommendation emails, contact us directly — we act on those requests ourselves.
Clients and users: Contact us directly at privacy@hyretech.ai.
We respond within 30 days, and within any shorter period applicable law requires.
14. Cookies
We use cookies essential for platform functionality (authentication, security) and analytics cookies to understand how the platform is used. Non-essential cookies require your consent where applicable — if you are in the EEA, the UK or Switzerland we ask before analytics cookies are set. You can change your choice here at any time, or manage cookies through your browser settings.
Analytics cookies follow the default for your region.
If you arrive through a referral link, we store the referral code in a functional cookie for 30 days so the referral is still credited if you browse the site before signing up. It holds only the code — no name, email, or other identifying information about you or the person who referred you.
15. Security
We protect data with encryption in transit and at rest, role-based access controls, audit logging, and an incident response process. In the event of a data breach, we notify the relevant authorities and affected individuals as required by law.
16. Changes
We may update this policy. Material changes will be communicated on our website and, where appropriate, by email.
17. Contact
HyreTech Pte. Ltd.
77 High Street, #10-12B, High Street Plaza, Singapore 179433
hyretech.ai