法律
隐私政策
This policy explains how Yasha Limited (registration no. HE 419811), Office 908H, 9th floor, Nicolaou Pentadromos Center, Limassol 3312, Cyprus (“HireCue”, “we”, “us”) — the data controller for the HireCue application, the account portal at account.hirecue.ai, and the website hirecue.ai (the “Service”) — collects, uses, and protects personal data.
The short version. HireCue is local-first: your interview transcripts, AI answers, and knowledge-base documents are stored on your device, not on our servers. Audio is processed in real time to produce transcription and suggestions, then discarded — we don't keep it and we don't use it to train AI models. On our side we keep only what's needed to run your account: identity, subscription, and usage counters. Optional Google Analytics through Google Tag Manager, Meta Pixel, Yandex Metrika, and, when enabled, self-hosted OpenReplay session replay load on the marketing website only after you explicitly choose “Allow analytics” in “Privacy choices.” You can withdraw that common choice at any time.
1. 我们收集的数据
账户数据
当您创建账户时，我们收集您的电子邮件地址、姓名（如提供）和身份验证数据。身份验证由我们的自建身份服务 (auth.hirecue.ai) 处理；您的密码仅作为加盐哈希值存储。
账单数据
付款由第三方支付处理商处理。我们接收您的订阅状态、套餐、卡片的最后四位数字及品牌和账单国家；我们不会接收或存储您的完整卡号。支付处理商根据其隐私政策作为独立控制者处理您的付款数据以防止欺诈，并作为我们的处理商处理付款。
使用和权利数据
为了强制执行计划限制和提高可靠性，我们记录计量事件：按模式统计的答案计数、会话时间戳和持续时间、应用程序版本和操作系统。这些计数器不包括您访谈内容。
音频、转录和文档 — 已处理，未存储
当您使用实时转录或回答功能时，麦克风和系统音频会实时传输给语音转文字服务商，生成的文本则通过我们的网关发送给 AI 模型服务商以生成建议。此处理是临时的：我们不会在服务器上存储您的音频、转录或 AI 回答。转录、回答和知识库文档存储在您的设备上，您可随时删除。为创建和搜索知识库索引，相关文档片段和搜索查询会通过我们的网关发送给嵌入服务商。按我们配置的零保留设置，网关和服务商均不保留这些内容；返回的数字向量存储在您的设备上。我们不会使用您的内容训练 AI 模型，也不允许服务商这样做。
支持沟通
如果您给我们发送电子邮件，我们会保留相应的对话记录，只要需要帮助您并保留请求记录。
网站
The hirecue.ai marketing website offers Google Analytics 4 through Google Tag Manager, Meta Pixel, Yandex Metrika, and, when enabled, self-hosted OpenReplay under one common “Allow analytics” choice. None of these optional browser analytics tools loads before that choice, and Global Privacy Control or Do Not Track keeps them off. Google, Meta, and Yandex may process the sanitized page address and referrer, browser/device information, IP address, and measurement identifiers or cookies for page measurement, campaign attribution, and configured conversion goals. Yandex Webvisor, clickmap, and automatic link tracking are disabled. OpenReplay runs on our infrastructure in Germany and records marketing-page content, clicks, navigation, and technical behavior. Inputs and payment interfaces are obscured; sensitive form and payment data, QR codes, deep links, tokens, network bodies, and authentication/cookie headers are hidden or excluded; and legal, account, authentication, and hosted payment pages are outside its scope. Page URLs are stripped of query strings and fragments, and external referrers are reduced to their origin before transmission. You can refuse or withdraw all optional analytics through “Privacy choices”; withdrawal reloads the page to unload vendor code. Our operational target is to delete replay sessions within 30 days. The website also stores language, attribution, and privacy choices in browser storage. Our hosting and content-delivery provider processes IP addresses and request logs to serve and secure the site. The account portal uses strictly necessary cookies/storage for sign-in sessions.
2. 我们如何使用数据
- 提供服务：身份验证、实时转录和 AI 答案、计划强制执行、自动更新（合同履行）。
- 处理付款和防止欺诈（合同履行；合法利益；法律义务）。
- 响应支持请求（合同履行；合法利益）。
- To secure and improve the Service using aggregate, non-content usage data and, only with your common analytics choice, optional website analytics and enabled session replay (legitimate interests for essential security; consent for optional browser analytics).
- 发送服务消息，如收据、续订和安全通知（合同履行；法律义务）。我们不发送营销电子邮件，除非您明确同意。
3. 我们与谁分享数据
We share personal data only with the processors and service providers needed to run the Service. After your common analytics choice, website measurement data may be sent to Google, Meta, and Yandex through the tools described above; OpenReplay remains self-hosted by us and starts only when separately enabled in our build. Other providers act under contracts that require them to protect data and use it only to provide the relevant service.
We do not sell personal data. After your common analytics choice, we use Meta Pixel for measurement and attribution as described above, but we do not provide interview content or account data to advertisers. We may disclose data if required by law, or in connection with a merger or acquisition (in which case this policy continues to apply to data collected before the change).
4. 国际转移
我们的服务器托管在European Union。我们的某些提供商在United States和其他国家处理数据。当数据国际转移时，我们依赖适当的保护措施，例如EU Standard Contractual Clauses，以及在适用情况下的EU–US Data Privacy Framework。
5. 保留
- "账户和使用数据：" 在您的账户存在期间保留。当您删除账户时，我们在 30 天内删除或匿名化数据，除非法律要求更长时间的保留。
- "账单记录：" 根据税务和会计法保留。
- "音频和内容：" 不由我们存储 — 见第 1 部分。
- "支持电子邮件：" 在请求得到解决后最多保留 24 个月。
6. 安全
所有传输流量都是加密的（TLS）。服务器数据受访问控制和最小权限原则保护；密码已哈希处理；付款数据由PCI-DSS 1级支付处理商处理。没有任何系统是完全安全的——如果违规事件影响您的数据，我们将按照法律要求通知您和主管部门。
7. 您的权利
根据您所在的位置（包括在 GDPR 和类似法律下），您有权访问、纠正、导出、限制、反对处理和删除您的个人数据，以及在处理基于同意的情况下撤销同意。您可以通过从您的账户电子邮件地址发送电子邮件至 support@hirecue.ai 来行使这些权利；账户删除也可以从账户门户请求，30 天内完成。您还有权向您当地的数据保护当局提出投诉。
8. 儿童
该服务不针对 16 岁以下的儿童，我们不故意收集他们的数据。如果您认为一个儿童已经向我们提供个人数据，请与我们联系，我们将删除它。
9. 对本政策的更改
随着服务的发展，我们可能会更新本政策。对于重大更改，我们将在其生效前通知您（例如通过电子邮件或在应用程序中）。当前版本始终在此页面上提供，其生效日期在上方。
10. 联系方式
Privacy questions and requests: support@hirecue.ai
Yasha Limited (HE 419811), Office 908H, 9th floor, Nicolaou Pentadromos Center, Limassol 3312, Cyprus