Privacy Policy

Where a feature means we decide purposes ourselves (for example securing the platform, preventing fraud, or improving the Services with de-identified data), we act as controller for that processing and say so below.

Contact: accounts@gethivemind.ai. Data Protection Officer: James Hitch.

What we hold depends on who you are and which features an Employer uses.

Identity and contact. Name, email, phone, postal address, employer, job title, LinkedIn URL, profile photo, communication preferences.

Application and professional. CV or resume, work history, education, qualifications, skills, languages, portfolio and work samples, references, salary expectations, availability, location and relocation preferences, work-authorization status, answers to application questions, cover letters.

Screening, assessment, and interview. Answers to screening questions, coding exercises, case studies, and structured assessments; personality and cognitive assessment results where an Employer enables them; recruiter and interviewer notes; scorecards; plagiarism and anti-cheating signals where enabled.

Audio, video, and communications. Recordings and transcripts of AI phone screens, video answers, and interviews where enabled; meeting metadata; email, SMS, chat, and support messages; calendar and scheduling data; conversations with the candidate assistant.

AI-generated and inferred. Parsed fields from a CV, match indicators against a role, criterion-level scores, rankings and shortlist position, summaries, skill and experience inferences, confidence and anomaly flags, and the human review, override, and appeal record attached to each. An inference is not a verified fact.

Account, commercial, and signature. Login and authentication records, roles and permissions, subscription and invoice records, limited payment data from our payment processor (we do not store full card numbers), offer documents, and e-signature audit trails.

Technical and usage. IP address and approximate location, browser and device, cookie and similar identifiers, pages and features used, clicks and session events, audit logs, API and integration activity, crash and performance data.

Integration data. Whatever an Employer or user authorizes an integration to share: calendar, email, video-meeting, HRIS, job-board, assessment, or signature data.

Sensitive data. We do not ask for it as a matter of course. It may arise when a candidate volunteers it, when an Employer lawfully runs equal-opportunity monitoring, when an accommodation request involves health or disability information, or when strictly necessary to test for bias. We never use it for advertising and never use it as a selection criterion.

Biometric data. Ordinary audio and video are not biometric identifiers. Hivemind does not derive voiceprints, face-geometry templates, or emotion inferences from any recording, and no AI feature analyzes tone of voice or facial expression. Session recordings of assessment pages capture on-screen activity, not your camera. If a feature ever did, we would give the specific notice and obtain the specific consent the law requires before enabling it.

• You, when you fill in a form, apply, upload a CV, record an answer, message us, or use the product.
• An Employer that enters, imports, or forwards your data, or connects an integration.
• Public professional sources, including LinkedIn public profiles, company websites, and job boards, when an Employer uses the sourcing feature or when we prospect (section 5).
• Data providers: People Data Labs, which supplies the professional profiles in our contact database (section 5A), and Apollo.io and People Data Labs for enrichment and for our own prospecting (section 5).
• Referrals and references you or an Employer name.
• Integrations you or an Employer authorize.
• Automatically, from your device and your use of the Services.
• Generated, by our AI features from the data above.

When we obtain personal data about a person in the EU, EEA, or UK from somewhere other than that person, we give them the information in this Policy within one month, at first contact, or before we disclose it to anyone else, whichever comes first, unless the law excuses it.

We do not rely on this Policy as consent to an automated employment decision. Section 6 explains how AI is used and what you can do about it.

Hivemind sells to employers and recruiting firms. To do that we hold and use business contact data about people who work at organizations we think may want the Services. This section is about that data and it applies whether or not you ever visited our website.

What we collect. Name, job title, employer, business email and phone, LinkedIn profile URL and public profile content, company size, industry, technology in use, and location.

Where it comes from. LinkedIn and Sales Navigator public profile data, data providers (Apollo.io, People Data Labs), your company's website, and what you tell us.

What we do with it. We email and call you about the Services, we connect on LinkedIn, and we track whether you open or click a message and which page of our site a link took you to. Links in our emails are personalized so we know who clicked. We record sales calls that connect and we tell you at the start of the call; you can ask us not to and we will stop the recording. Call recordings and transcripts are used to train our sales team and to check our targeting; they are not used to make any decision about you.

Legal basis. In the United States and in jurisdictions that permit business-to-business marketing to a named work address, our legitimate interest in promoting the Services to the people who buy them, balanced by the limits below. In jurisdictions that require consent for email or telephone marketing to an individual, we do not contact you until you consent.

Your controls. Every email has an unsubscribe link. Every call can end with "please do not call again". Either stops contact through the tool you used, and we record the request so no other outreach tool contacts you. You can also email accounts@gethivemind.ai to object, to ask what we hold, or to have it deleted.

Retention. We keep prospect data for 24 months from the last interaction, then delete it, except the minimum needed to keep a suppression entry working.

Website visitors. If you visit our pricing or product pages while we can identify you (because you clicked a personalized link or are logged in), we may note that and follow up.

Customers can search a database of professional profiles to find candidates. This section is about that database. It applies to you if your profile is in it, whether or not you have heard of Hivemind.

What we hold. The profile record our data provider supplies: name, job titles, current and past employers, education, skills, location, and work and personal contact details where the provider holds them.

Where it comes from. We license it from People Data Labs, which compiles it from public and licensed sources. It is the only source of the database.

What we do with it. When a customer searches, we show matching profiles. When the sourcing feature delivers a profile to a customer, for a fee or for credits, we give that customer the contact details and keep a copy of the record in our database, linked to each customer whose search returned it. Search results are cached for 30 days per customer. The customer that receives your profile is a separate controller of its copy and is responsible for its own notice to you. It may use the profile to contact you about roles, and may not use the profile data as delivered to score, screen, or assess you. Anything you later give that customer directly, such as a reply or an application, is handled under its recruiting process.

Our role. We are the controller of the database. Profiles of people in the EU, EEA, and UK are excluded from sourcing until we confirm in writing to customers that they are available.

Your choices. You can ask what we hold about you, correct it, or have your profile removed from the database, through section 13. A later customer search can add your profile again from People Data Labs, so we also tell you how to ask People Data Labs, and any customer that already revealed your profile, to delete it.

California. Giving a customer a profile for a fee or credits is a sale of personal information, and we sell data about people we have no direct relationship with. Section 16 explains your opt-out.

What the AI features do. Depending on what an Employer enables, they extract structured data from CVs and applications, compare evidence against the criteria the Employer defined, produce criterion-level scores and an overall ranking, transcribe and summarize phone screens and interviews, evaluate structured assessments, and suggest next steps. They use professional experience, skills, qualifications, application answers, assessment performance, and job-related interview content. They are prohibited from using protected characteristics or proxies for them, and we test them for accuracy and adverse impact before release and annually.

When a decision can be automatic. A score or ranking is information for a person at the Employer, who remains responsible for the decision. An Employer can, however, set up a workflow that moves an application forward or declines it automatically based on a score, an assessment result, or an answer you gave. Our Terms allow that only where the law of your location permits it, only after the Employer has told you, and only with a person available to review the result if you ask.

What it means for you. A score can affect whether the Employer reviews your application early, invites you to interview, or does not progress you. Because of that you can, at any point:

• ask whether AI was used at a step and what categories of information it considered;
• ask for a human to review the result;
• correct inaccurate data and add context;
• contest the result;
• request a reasonable accommodation or an alternative process, including one that does not use AI.

Email accounts@gethivemind.ai (the Candidate Privacy Notice gives the same address), and we will forward your request to the Employer within 5 business days and help it respond.

Where the law goes further. Where GDPR Article 22 applies to a decision based solely on automated processing with legal or similarly significant effect, such a decision is made only where the law authorizes it and with the right to human intervention, to express your view, and to contest. In the UK, Articles 22A to 22D of the UK GDPR (in force 5 February 2026) permit such a decision on non-special-category data only with those same safeguards, and we provide them. Where the EU AI Act classifies a feature as high-risk, we perform the provider obligations that apply to us and the Employer performs the deployer obligations, including telling you a high-risk system is in use. Where a US state or city requires notice, a bias audit, or an appeal route (New York City, Colorado, Illinois, California), the Employer gives the notice, and we supply the audit data and forward your requests to it.

Model training. We do not use identifiable candidate or customer data to train any model that serves other customers unless the customer has opted in by signed agreement. The AI features run on models from OpenAI, with zero data retention, and from Google (Gemini) on its paid tier, under which Google does not use the data to improve its products. AI phone screens run on Vapi, which keeps call recordings and transcripts under its own terms; those terms permit Vapi to use them to improve its models, and we have no zero-retention arrangement with Vapi. Where an Employer connects its own OpenAI account, that Employer's grading runs on its own account instead.

Where an Employer enables it, a phone screen may be run by an AI agent. The call starts only when the Start button on your phone interview page is pressed, and it goes to the number shown there, which you can change. The agent's standard greeting says it is an AI; an Employer can edit the greeting, and our Terms require it to keep that statement. Phone screens, live AI interviews, and video answers are recorded and transcribed. The Employer is responsible for telling you before recording starts and for offering another way to complete the step where the law requires one. When you take an assessment, your on-screen activity on the assessment page is recorded so the Employer can review how it was completed. SMS about your application is sent to the number you gave. Reply STOP to stop messages from that number: our SMS provider blocks further messages from it on US and Canadian numbers, and the Employer honors other opt-outs. Message and data rates from your carrier may apply.

We use cookies, local storage, pixels, and SDKs for four purposes: strictly necessary operation and security; remembering your preferences; measuring how the Services are used; and advertising measurement and targeting, which you can refuse or opt out of (section 9). Non-essential technologies are not set until you consent where the law requires consent, and we honor the Global Privacy Control signal as an opt-out where it applies. You can change your choices at any time through Your privacy choices in the site footer.

Our current cookie table, generated from a scan of the live site, is linked from Your privacy choices in the site footer.

• The Employer and the people it authorizes (recruiters, hiring managers, interviewers): everything about your application, including recordings and AI outputs.
• Subprocessors that host, store, transcribe, transmit, analyze, or support the Services, bound by contract to use the data only for that. The current list, with each provider's role, location, and AI-training setting, is at hivemind.hr/legal/subprocessors, and customers can subscribe to change notices.
• Integrations an Employer or you activate, which then act under their own terms.
• Our advisers, auditors, and insurers, under confidentiality.
• A buyer or successor in a financing, merger, or sale, with notice before your data becomes subject to a different policy.
• Authorities and courts where the law requires, and anyone where needed to protect rights, safety, or the Services.
• Anyone you direct us to.

Sale and sharing. We do not sell or share candidate data that an Employer gives us. We do two things that the California Consumer Privacy Act and some other state laws treat as selling or sharing: we give customers profiles from our contact database for a fee or credits (section 5A), and our website uses advertising pixels from Meta, LinkedIn, and Reddit, which send page visits, and for Reddit sign-up, lead, and booking events, with cookie and device identifiers so we can measure and target our advertising. You can opt out of both through Your privacy choices in the site footer, and we treat a Global Privacy Control signal as that opt-out. In the EU, EEA, and UK the pixel loads only with your consent.

We process data in the United States (Amazon Web Services, us-west-2, Oregon), and we cannot currently keep it in the EU. Subprocessors may process it in other countries listed in the subprocessor list, including the European Union (Crisp, in the Netherlands and Germany) and France (Unipile). Where personal data from the EU, EEA, UK, or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and supplementary measures. You can ask accounts@gethivemind.ai for a copy of the relevant safeguard.

We host data on Amazon Web Services in the United States and encrypt it in transit and at rest through AWS storage encryption; integration credentials are additionally encrypted by our application. Customer accounts use role-based permissions and sign in with a password or Google sign-in; we do not yet offer multi-factor authentication or single sign-on. We monitor the application through New Relic and Datadog, and our logs can contain candidate data such as call transcripts. Our database can be restored to any point in the last seven days; uploaded files are not separately backed up. In November 2025 we completed a Google Cloud Application Security Assessment (CASA) Tier 2, performed by TAC Security, which included a penetration test. We hold no SOC 2 or ISO 27001 certification; our alignment with the GDPR and the CCPA, and our readiness work toward ISO 42001, describe our program and are not certifications. No system is perfectly secure. If we confirm an incident affecting your personal data we will notify you and the relevant authorities as the law requires.

We keep data longer when a legal hold, regulatory inquiry, or claim requires it. When retention ends we delete or de-identify.

Depending on where you live and your relationship with us you may have the right to know what we hold and get a copy; correct it; delete it; restrict or object to processing, including direct marketing; take it with you in a portable format; withdraw consent; opt out of sale, sharing, targeted advertising, or profiling for significant decisions; limit use of sensitive data; obtain information about, and human review of, an automated decision; appeal a refusal; be treated no differently for exercising a right; and complain to a supervisory authority.

How to exercise them. Email accounts@gethivemind.ai from the address we hold for you, or tell us how to verify you. Say which role or Employer the request concerns. We respond within one month in the EU and UK and within 45 days in the US, extendable where the law allows, and we tell you if we need longer. Where the Employer is the controller we forward the request within 5 business days and help it answer. An authorized agent may act for you with proof of authority. If we refuse, we explain why and how to appeal at accounts@gethivemind.ai, and we answer an appeal within 45 days. Deletion is carried out by hand: when you ask, we delete what an ordinary deletion in the product leaves behind, including files and the copies our subprocessors hold where they offer deletion.

Regulators. EU and EEA: the authority where you live or work, listed at edpb.europa.eu. UK: the Information Commissioner's Office, ico.org.uk. Switzerland: the FDPIC. Elsewhere, your national or state privacy regulator.

The controller is identified in section 1 or in the Employer's notice. Purposes and legal bases are in section 4 and 5, sources in section 3, recipients in section 9, transfers in section 10, retention in section 12, rights in section 13, and automated decision-making in section 6. Where we rely on legitimate interests we have carried out and documented a balancing test and you can ask for a summary. Where an Employer is the controller, its own notice governs the purposes and bases of the recruitment process itself.

This section applies where the California Consumer Privacy Act applies to Hivemind as a business.

Categories collected in the preceding 12 months, with sources in section 3 and purposes in section 4: identifiers; customer records; protected classifications where lawfully provided; commercial information; internet and network activity; approximate geolocation; audio and visual information; professional and employment information; education information; inferences; sensitive personal information (account credentials, and any health or protected-class data a candidate volunteers). Each category may be disclosed for a business purpose to the recipients in section 9.

Sale and sharing. In the preceding 12 months we sold identifiers and professional and employment information from our contact database to customers who receive profiles through the sourcing feature (section 5A), and shared identifiers and internet activity with Meta, LinkedIn, and Reddit for cross-context behavioral advertising (section 9). We do not sell or share candidate data an Employer gives us, and we do not knowingly sell or share the personal information of anyone under 16. Opt out through Your privacy choices in the site footer; we honor the Global Privacy Control signal. We use sensitive personal information only for the purposes the CCPA regulations permit without a right to limit.

Your California rights: know, access, correct, delete, opt out of sale or sharing, limit sensitive use, non-discrimination, and, for automated decision-making technology used for a significant decision, pre-use notice, access to information about the decision, and an opt-out or appeal as the regulations provide. Exercise them through section 13. We keep a record of requests for 24 months.

Notice at collection. We show a short notice at each point we collect personal data (forms, signup, application, phone screen, assessment). This Policy supplements those notices.

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, New Jersey, Iowa, Nebraska, New Hampshire, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and other states with comprehensive privacy laws have rights of access, correction, deletion, portability, opt-out of targeted advertising, sale, and profiling for significant decisions, and appeal, which vary by state. Exercise them through section 13.

Customer accounts and the public website are for people aged 18 and over. A candidate may use a candidate experience from age 16 only where the Employer has confirmed it is lawful for the role, and we block younger signups by date of birth where an Employer enables early-careers hiring. We do not knowingly collect personal data from anyone under 13; if you think we have, email accounts@gethivemind.ai and we will delete it.

We may update this Policy. We post the new version, and for a material change we give notice by email or in-product before it takes effect. Prior versions stay available from a link on this page.

Candidates are shown a short notice at each collection point that names the Employer, states the purposes, explains AI use, and gives the rights route. It is reproduced at hivemind.hr/legal/candidate-privacy and supplements this Policy.