Legal

Privacy Policy

Effective date: July 16, 2026

This policy explains how Yasha Limited (registration no. HE 419811), Office 908H, 9th floor, Nicolaou Pentadromos Center, Limassol 3312, Cyprus (“HireCue”, “we”, “us”) — the data controller for the HireCue application, the account portal at account.hirecue.ai, and the website hirecue.ai (the “Service”) — collects, uses, and protects personal data.

1. Data we collect

Account data

When you create an account we collect your email address, name (if provided), and authentication data. Authentication is handled by our self-hosted identity service (auth.hirecue.ai); your password is stored only as a salted hash.

Billing data

Payments are processed by a third-party payment processor. We receive your subscription status, plan, the last four digits and brand of your card, and billing country; we never receive or store your full card number. The payment processor handles your payment data under its own privacy policy as an independent controller for fraud prevention and as our processor for payments.

Usage and entitlement data

To enforce plan limits and improve reliability we record metering events: counts of answers by mode, session timestamps and durations, app version, and operating system. These counters do not include the content of your interviews.

Audio, transcripts, and documents — processed, not stored

When you use live transcription or answer features, audio from your microphone and system audio is streamed in real time to our speech-to-text provider, and the resulting text is sent through our gateway to AI model providers to generate suggestions. This processing is transient: we do not store your audio, transcripts, or AI answers on our servers. Transcripts, answers, and any documents you add to your knowledge base are stored locally on your device, where you can delete them at any time. To create and search the knowledge-base index, relevant document chunks and search queries are sent through our gateway to our embedding provider. Under our configured zero-retention setting, neither our gateway nor the provider retains that content; the returned numerical vectors are stored locally on your device. We do not use your content to train AI models, and we do not permit our providers to use it for training as part of providing our Service.

Support communications

If you email us, we keep the correspondence for as long as needed to help you and to keep records of the request.

Website

The hirecue.ai marketing website offers Google Analytics 4 through Google Tag Manager, Meta Pixel, Yandex Metrika, and, when enabled, self-hosted OpenReplay under one common “Allow analytics” choice. None of these optional browser analytics tools loads before that choice, and Global Privacy Control or Do Not Track keeps them off. Google, Meta, and Yandex may process the sanitized page address and referrer, browser/device information, IP address, and measurement identifiers or cookies for page measurement, campaign attribution, and configured conversion goals. Yandex Webvisor, clickmap, and automatic link tracking are disabled. OpenReplay runs on our infrastructure in Germany and records marketing-page content, clicks, navigation, and technical behavior. Inputs and payment interfaces are obscured; sensitive form and payment data, QR codes, deep links, tokens, network bodies, and authentication/cookie headers are hidden or excluded; and legal, account, authentication, and hosted payment pages are outside its scope. Page URLs are stripped of query strings and fragments, and external referrers are reduced to their origin before transmission. You can refuse or withdraw all optional analytics through “Privacy choices”; withdrawal reloads the page to unload vendor code. Our operational target is to delete replay sessions within 30 days. The website also stores language, attribution, and privacy choices in browser storage. Our hosting and content-delivery provider processes IP addresses and request logs to serve and secure the site. The account portal uses strictly necessary cookies/storage for sign-in sessions.

2. How we use data

• To provide the Service: authentication, real-time transcription and AI answers, plan enforcement, automatic updates (performance of contract).
• To process payments and prevent fraud (performance of contract; legitimate interests; legal obligations).
• To respond to support requests (performance of contract; legitimate interests).
• To secure and improve the Service using aggregate, non-content usage data and, only with your common analytics choice, optional website analytics and enabled session replay (legitimate interests for essential security; consent for optional browser analytics).
• To send service messages such as receipts, renewal and security notices (performance of contract; legal obligations). We do not send marketing email without your consent.

3. Who we share data with

We share personal data only with the processors and service providers needed to run the Service. After your common analytics choice, website measurement data may be sent to Google, Meta, and Yandex through the tools described above; OpenReplay remains self-hosted by us and starts only when separately enabled in our build. Other providers act under contracts that require them to protect data and use it only to provide the relevant service.

We do not sell personal data. After your common analytics choice, we use Meta Pixel for measurement and attribution as described above, but we do not provide interview content or account data to advertisers. We may disclose data if required by law, or in connection with a merger or acquisition (in which case this policy continues to apply to data collected before the change).

4. International transfers

Our servers are hosted in the European Union. Some of our providers process data in the United States and other countries. Where data is transferred internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

5. Retention

• Account and usage data: kept while your account exists. When you delete your account, we delete or anonymize it within 30 days, except where law requires longer retention.
• Billing records: kept as required by tax and accounting law.
• Audio and content: not stored by us — see Section 1.
• Support emails: kept up to 24 months after the request is resolved.

6. Security

All traffic is encrypted in transit (TLS). Server data is protected with access controls and the principle of least privilege; passwords are hashed; payment data is handled by a PCI-DSS Level 1 payment processor. No system is perfectly secure — if a breach affects your data, we will notify you and the competent authorities as required by law.

7. Your rights

Depending on where you live (including under the GDPR and similar laws), you have the right to access, correct, export, restrict, object to the processing of, and delete your personal data, and to withdraw consent where processing is based on consent. You can exercise these rights by emailing support@hirecue.ai from your account email; account deletion can also be requested from the account portal and is completed within 30 days. You also have the right to lodge a complaint with your local data-protection authority.

8. Children

The Service is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

9. Changes to this policy

We may update this policy as the Service evolves. For material changes we will notify you (for example by email or in the application) before they take effect. The current version is always available at this page, with its effective date above.

10. Contact

Privacy questions and requests: support@hirecue.ai
Yasha Limited (HE 419811), Office 908H, 9th floor, Nicolaou Pentadromos Center, Limassol 3312, Cyprus