Privacy Policy

1. Information We Collect

We collect the following types of information to provide our services:

• Account Information: Name, email address, university name, and graduation date.
• Resume Data: Resume content you upload for AI analysis. This data is encrypted at rest and in transit.
• Visa & Immigration Data (Sensitive): OPT/CPT dates, visa type, and immigration or citizenship status you choose to provide for deadline tracking. This is sensitive personal information under California (CCPA/CPRA), Virginia, Colorado, Connecticut, and most other US state privacy laws: we collect it only with your explicit consent, use it only to power the visa-tracking features you request, and never for any secondary purpose. See Section 1a.
• Usage Data: Pages visited, features used, and interaction patterns to improve our service.
• Payment Data: Processed securely via Stripe. We never store your full credit card number.
• Authentication & Sign-in Activity: For each successful or failed sign-in we record the IP address, user-agent, sign-in method (Google, GitHub, password), and timestamp. This is used solely for security review (showing you recent activity in Settings, alerting on unfamiliar sign-ins, and powering rate-limit / lockout protection).
• Email Activity: We log when transactional email is dispatched (verification, password reset, sign-in alerts) along with the recipient and delivery state, so you can see exactly which messages we sent you.

1a. Sensitive Personal Information & Consent

Our core purpose involves immigration and citizenship status, which is treated as sensitive personal information under the CCPA/CPRA and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Texas, and other states. We apply extra safeguards:

• We request your explicit, affirmative consent before storing any visa or immigration information, through a separate opt-in at the point of collection, and we keep a record of when you gave it and which version of this policy you saw.
• We use this data solely to provide the deadline-tracking and alerting features you request. We do not use it to infer other characteristics, we do not use it for advertising, and we do not sell or share it.
• You may withdraw consent at any time from Settings, under Visa & Immigration Data. Withdrawing deletes your visa status and any immigration dates you gave us, and switches off the features that rely on them: deadline reminders, the visa roadmap, the H-1B tracker, and sponsorship-aware job ranking. Your account and everything else in it (applications, resumes, saved jobs) are unaffected, and you can add your status back whenever you want.
• Withdrawing does not affect processing that already took place. We retain the record of when you gave consent and which version of this policy you saw, together with the date you withdrew, as proof that we handled your data lawfully. That record contains no visa or immigration details.
• You can also change or clear your visa status and dates directly in your Job Search Profile, without withdrawing consent, if you want to keep the deadline features but correct what they run on.
• Under California law you may limit the use of your sensitive personal information. Because we already restrict use strictly to the service you requested, no further processing occurs; you may still request deletion at any time.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To provide, maintain, and improve the HiringFleet platform.
• To generate AI-powered resume analysis and employer sponsor recommendations.
• To send critical visa deadline alerts and proactive CPT/OPT notifications.
• To process payments and manage your subscription.
• To analyze platform usage through anonymized, aggregated data.

3. Data We Never Sell or Share

We believe your data belongs to you. We maintain strict rules regarding data sharing:

• We never sell your personal data to third-party recruiters, advertisers, or data brokers.
• We never use your resume data to train public AI models.
• We never share your visa status with employers, universities, or government agencies.

4. Data Security

We implement industry-standard security protocols to protect your information, including:

• Encryption of data at rest.
• Encryption of data in transit (HTTPS/TLS).
• Role-based access controls and audit logging.
• Ongoing security monitoring and review of our systems.

If a security incident affects your personal information, we will notify you and the relevant regulators as required by applicable law, without undue delay.

4a. Data Retention

• Account data is kept while your account is active.
• Sign-in logs and email logs are kept for the most recent 180 days for security review and customer support, then purged automatically.
• Verification tokens expire within 1-24 hours and are deleted immediately on use.
• Visa and immigration data is kept while your account is active and you have not withdrawn consent. Withdrawing deletes it immediately, with no recovery window. What survives is the consent record itself (the dates you gave and withdrew consent, and the policy version you saw), which we keep for as long as your account exists as evidence that we processed your data lawfully. It holds no visa or immigration details of its own.
• When you delete your account from Settings, all rows tied to your user (profile, OAuth links, sessions, sign-in logs, email logs, 2FA secrets, recovery codes) are scheduled for permanent removal. To protect you from accidental or malicious deletion, there is a 14-day recovery window: we email you a restore link, and signing back in cancels the deletion. After 14 days everything is permanently removed by an automated purge. We may keep de-identified aggregate metrics (e.g. total signups by month) but those cannot be linked back to you.

4b. Job Listings and Data Sources

Job listings on HiringFleet come from legal, sanctioned sources: employers who post directly to us, employer applicant-tracking systems (such as Greenhouse, Lever, Ashby, and Workday), licensed job aggregators (such as Adzuna), open job APIs (such as Remotive, RemoteOK, and Arbeitnow), and public government data (USAJOBS and U.S. Department of Labor disclosures). For listings sourced from aggregators we show a short preview and link back to the original posting, where you apply directly with the employer.

4b-i. HiringFill Browser Extension

HiringFill, our optional browser extension, fills job application forms for you from your HiringFleet Job Search Profile. It works only when you choose to apply and only on supported application sites (such as Greenhouse, Lever, Workday, Ashby, and iCIMS).

• What it reads: when you start an application, the extension requests your profile data from your signed-in HiringFleet account, over an encrypted connection, using a short-lived access token. It does not read your account without your action.
• What it fills: your name, contact details, address, links, education, work history, skills, and your work-authorization and salary answers, into the application form in your own browser.
• Voluntary EEO / demographic answers: if you have provided them, the extension can fill voluntary Equal Employment Opportunity questions (such as gender, race or ethnicity, veteran and disability status, and, where you chose to provide it, sexual orientation) that some applications ask. These sensitive answers are used solely to complete those voluntary questions on your behalf and are never sold or used for advertising. You control them in your profile and can leave them blank.
• Where your data goes: the extension moves your data from your HiringFleet account into the application form you are completing. To help map fields on complex forms it may send form-structure and profile fields to our own processing service under the same protections described below; it does not sell your data or send it to advertisers.
• Account required: the extension requires a HiringFleet account to function and only accesses the data of the account you are signed in to.

4c. AI Processing of Your Data

Some features (resume analysis, job matching, and outreach drafting) are powered by AI. To deliver them, relevant content you submit may be sent to trusted third-party AI providers that run the underlying models on our behalf. When we do this:

• We send only the data needed to perform the feature you requested.
• We do not send your immigration or citizenship status to any AI provider unless strictly necessary for a feature you have explicitly requested (for example, visa-aware job matching), and never to train their models. Encrypted profile fields (demographics, address, phone) are excluded from AI prompts by design.
• We use these providers under business/enterprise terms and do not permit your content to be used to train their general-purpose foundation models.
• AI output is informational only and is not legal, immigration, or career advice. See our AI Disclaimer for details and limitations.

5. Cookies

We use essential cookies to maintain your session securely. We also use analytics cookies (only with your explicit consent) to understand platform usage. You can manage your preferences at any time via your browser settings. For a full breakdown of the categories we use and how to control them, see our Cookie Policy.

6. Your Rights

Depending on your location (GDPR, CCPA), you hold the following rights over your data:

• Access: Request a copy of all personal data we hold about you.
• Deletion: Request permanent deletion of your account and all associated data.
• Portability: Export your data in a standardized, machine-readable format.
• Opt-out: Opt out of marketing communications instantly at any time.
• Withdrawal of consent: Where we rely on your consent, withdraw it at any time, as easily as you gave it. For visa and immigration data this is a single control in Settings; see Section 1a for exactly what it deletes.

You can exercise these rights yourself from Settings: Download my data for a JSON export, Withdraw consent under Visa & Immigration Data to delete your immigration details, or Delete account to permanently remove everything tied to your user. For anything that needs human help, email support@hiringfleet.com.

6b. Legal Basis for Processing (EEA/UK Users)

Where the GDPR or UK GDPR applies, we rely on: your explicit consent for immigration/citizenship data and for analytics; the performance of a contract to provide your account and subscription; and our legitimate interests in securing the platform (for example, sign-in logging and fraud prevention). You may withdraw consent at any time without affecting prior lawful processing.

7. Google User Data & Gmail Access

If you connect your Google account to send outreach emails, HiringFleet requests only the gmail.send scope. This lets us send emails on your behalf when you click Send. It does not allow us to read, browse, modify, or delete any of your existing emails.

• We only access Google data to provide the outreach-email feature you explicitly use.
• We never sell or transfer your Google data, and never use it for advertising.
• We do not use your Google data to train generalized or foundation AI models.
• Your Google OAuth tokens are encrypted at rest. You can disconnect Google at any time from Settings, which revokes our access.
• Outreach emails you send include a small open-tracking image and a one-click unsubscribe link, so you can see engagement and recipients can opt out. Anyone who unsubscribes is recorded as opted-out and is never emailed through HiringFleet again.

HiringFleet's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

8. International Data Transfers

HiringFleet is operated from the United States, and the infrastructure and service providers we use to run the platform (such as our hosting, database, payment, and email providers) are primarily located in the United States. If you access the Service from outside the U.S., your information will be transferred to, stored, and processed in the U.S. and other countries where we or our providers operate. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.

9. Children's Privacy

HiringFleet is intended only for users who are at least 18 years old, and we do not knowingly collect personal information from anyone under 18. In no case do we knowingly collect personal information from children under 13 (as defined by the U.S. Children's Online Privacy Protection Act, COPPA) or, for users in the EEA/UK, under 16. If you believe a child has provided us with personal data, contact us at support@hiringfleet.com and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will revise the “Updated” date at the top of this page and, for material changes, provide a more prominent notice (such as an email or in-app notice). Your continued use of the Service after an update means you accept the revised policy.

11. Contact Us

For privacy-related questions, data access requests, or security concerns, our dedicated Privacy Team is here to help. You can contact us via email at support@hiringfleet.com.

HiringFleet Inc.
Privacy & Security Team