Version: Draft v0.3 (US, NY entity) · Last updated: 2026-06-12 · Status: DRAFT — pending counsel review
This Policy explains how AID Hires LLC ("AiD Hires", "we") handles the personal information of Candidates and Interviewers who use the AiD Hires platform. It is written for the United States and is designed to meet the California Consumer Privacy Act, as amended by the CPRA (CCPA/CPRA), which we apply as our nationwide baseline. California residents have specific rights described in Section 8.
Note on scope. California's employment/applicant data is fully in scope of the CCPA. Other US states (e.g. Colorado, Connecticut, Texas, Virginia) have their own privacy laws — most currently exempt job-applicant data, but we apply consumer-style rights as a baseline. [Counsel: confirm per-state applicant-data scope for the states the owner confirmed = US nationwide, all states.]
Under the CCPA, we collect the following categories of personal information about Candidates (the specific data elements map to the AID-66 data map):
| CCPA category | Specific elements we collect | Source |
|---|---|---|
| Identifiers | Name, email, phone, account ID, LinkedIn URL, IP address | You; your device |
| Customer/commercial-style records | Resume file + parsed resume data (summary, skills, experience, education, certifications, free-form parsed content) | You (upload); resume parsing |
| Professional/employment information | Position, level, career history from your resume/answers | You |
| Education information | Education history from your resume | You |
| Protected-classification information (only if you include it) | Resumes occasionally contain date of birth, photo, or other details that reveal protected characteristics — we ask you not to include sensitive details you don't want processed | You |
| Audio/electronic information | Spoken-answer audio sent for transcription (transient — see "Voice"); the resulting text transcript | You (recording) |
| Inferences & assessment outputs | AI scores (0–100), AI rationale (strengths/weaknesses), the raw AI response, and an AI-vs-human indicator with its reason | Generated by the Service |
| Behavioral / integrity signals | Response-integrity signals: time-to-first-keystroke, paste-detection, character counts, tab/focus changes | Generated during your assessment |
| Internet/network activity | Last login time, IP address, browser/user-agent | Your device |
Sensitive personal information (CPRA). We do not seek to collect "sensitive personal information," but resumes you upload may contain it. We do not use or disclose sensitive personal information for purposes beyond providing the Service, which under the CPRA does not trigger the right to limit its use.
To operate your account; let you apply to jobs and complete assessments; run AI-assisted scoring and transcription; detect response-integrity anomalies and possible impersonation; present results to the relevant Employer for their hiring decision; communicate with you; secure the Service; and meet legal obligations.
We do not "sell" your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months. We disclose personal information to service providers / sub-processors (Section 5) and to the Employer you applied to, only to provide the Service.
We use automated tools to evaluate assessments: AI scores your answers, transcribes spoken answers, and produces integrity and AI-vs-human signals.
We disclose personal information to the following service providers, each under a contract limiting their use to providing services to us [DPA execution to be confirmed per AID-67]:
| Service provider | What it receives | Purpose |
|---|---|---|
| OpenAI | Your answer text and spoken-answer audio (for transcription), plus question context | AI scoring and speech-to-text transcription |
| Resend | Your name and email and notification content | Sending transactional emails |
| Stripe | (Employer billing data; Candidate data is not intended to be sent to Stripe) | Payment processing for Employers |
| DigitalOcean | Data at rest and in transit (US-region hosting) | Hosting the application and database |
[OPENAI TERMS — to be confirmed per AID-67 that Candidate content sent to OpenAI's API is excluded from model training and retained only for the limited period required.] We also disclose your application and results to the Employer you applied to, who decides on your application.
AiD Hires hosts data in the United States. Some service providers may process limited data outside the US; where they do, they are bound by contract to protect it. [Counsel/AID-67: confirm DigitalOcean US data region and any OpenAI processing locations.]
We keep each category only as long as needed for the purposes above and to meet legal obligations, then erase or de-identify it. Our US retention windows (per AID-66 v0.2 US) are:
| Data class | Retention |
|---|---|
| Rejected/closed-candidate profile + resume + parsed data | 1 year after the final hiring decision, then erase/de-identify |
| AI assessment + decision record (answers, score, rationale) for rejected candidates | 1 year after the decision, then de-identify (retain only aggregate/anonymized metrics for bias-audit records) |
| Integrity / behavioral surveillance signals (keystroke/paste) | 90 days after the decision |
AI-vs-human (is_human) inferences | 90 days after the decision |
| Login IP / user-agent telemetry | 90 days |
| Talent-pool ("keep me for future roles") | Only with your opt-in consent, time-boxed to 2 years, renewable |
| Application logs containing transcription previews | 30 days |
Hired-candidate data transitions to the Employer's employee/HR retention. The 1-year baseline aligns with EEOC / Title VII record-retention (29 C.F.R. § 1602) and the ADEA record-keeping rules; some roles/states or an open charge of discrimination can require longer retention, in which case we retain the relevant records until the matter is resolved.
Subject to applicable law, California residents may request to: know/access the categories and specific pieces of personal information we collected and the purposes; delete their personal information; correct inaccurate personal information; and opt out of sale/sharing (we do not sell or share, so there is nothing to opt out of). We do not discriminate against you for exercising these rights. We do not "sell" data and do not use sensitive personal information beyond providing the Service, so the "limit the use of my sensitive personal information" right does not apply. You may use an authorized agent. We will verify your request and respond within the statutory timeframe (generally 45 days, extendable). [Note: the deletion/export tooling that fulfils these requests is being built per AID-66; until then requests are handled manually.] To make a request: privacy@aidhires.com.
We use cookies strictly necessary to operate the Service, and other cookies where applicable. See our Cookie Policy. We do not use cookies to sell or share your information for cross-context behavioral advertising.
We apply reasonable technical and organizational measures to protect your information. No system is perfectly secure; please use a strong, unique password.
We may update this Policy; we will update the version and date and, for material changes, notify you. For any privacy question or to exercise your rights: privacy@aidhires.com · AID Hires LLC (New York) · [postal address — owner to supply].