Terms of Service

You accept these Terms by signing an Order Form that refers to them, or by creating an account or continuing to use the Services after we have given you notice of them in a way you could not reasonably miss. Merely visiting the public website does not create a contract beyond Part A and Part D.

If you accept for an organization, you confirm that you are authorized to bind it. If you are not, or you do not agree, do not create the account and do not use the Services.

We keep every signed Order Form.

"Services" means hivemind.hr and its subdomains, Hivemind-hosted careers pages and candidate portals, the Hivemind web application, APIs, integrations, AI features, and any implementation, training, or support services we provide, together with their documentation.

"Content" means the text, graphics, designs, software, and other material that we make available through the Services, excluding Customer Data and Candidate Data.

"Customer" means an organization that holds a Hivemind account under Part B, and "Authorized User" means a person the Customer allows to use that account.

"Candidate" means a person who applies for a role, completes a screen or assessment, uses a candidate portal, or whose profile a Customer imports, sources, or evaluates through the Services.

"Customer Data" means data submitted to, generated in, or collected through a Customer's account, including Candidate Data. "Candidate Data" means personal data about a Candidate, including applications, CVs, profiles, recordings, transcripts, assessment answers, scores, notes, inferences, and hiring status. Customer Data and Candidate Data exclude the Delivered Fields of a Sourced Record (B9).

"Output" means anything the Services produce from Customer Data: a score, ranking, summary, transcript, recommendation, report, or generated message.

"AI Feature" means any part of the Services that uses machine learning or generative models to parse, classify, score, rank, transcribe, summarize, recommend, converse, or generate.

"Applicable Law" means every law that applies to a party's performance, including data protection, employment and anti-discrimination, consumer, communications and recording, artificial intelligence, accessibility, export control, sanctions, and anti-bribery laws.

You must be at least 18 to open an account or use the website. A Candidate may use a candidate experience from age 16 where the Customer running the process has confirmed that this is lawful for the role and location; see Part C. We do not knowingly collect personal data from anyone under 13 and we delete it if we learn we have.

We grant you a limited, revocable, non-exclusive license to view the public website and to use the Content for the purpose it is provided for. You may not copy, republish, scrape, frame, or build a competing product from the Content, except for fair use and as Applicable Law allows. Hivemind and its licensors own the Services and the Content, including the trade marks "Hivemind" and "Hivemind.HR". Nothing transfers ownership to you.

Schedule 1 applies to everyone. Authorized APIs, integrations, and AI agents used as documented are permitted; prohibitions on automated access do not apply to them.

If you send us an idea or suggestion about the Services, you allow us to use it without restriction or payment. This does not give us any right to your Customer Data, Candidate Data, or confidential information, and we will not name you without permission.

The Services link to and connect with services we do not run (calendars, email, video meetings, job boards, HR systems). Their terms and privacy notices govern them. We do not endorse them and we are not responsible for them, except where they are our subprocessors under the DPA.

If you believe material on the Services infringes your copyright, email accounts@gethivemind.ai with the work, the location, your contact details, a statement of good-faith belief, a statement under penalty of perjury that you are authorized, and your signature. Our designated agent's name and address are available on request. We remove or disable infringing material and may terminate repeat infringers.

We aim to meet WCAG 2.2 AA across the candidate-facing parts of the Services. If you need an accommodation to use them, contact accounts@gethivemind.ai or the Customer running the process; see Part C.

Free and Self-serve plans are subject to these Terms and the DPA. An Enterprise plan is subject to its Customer Agreement, and to these Terms only where that agreement is silent. An Order Form can add to or override an identified section of these Terms; nothing else can. Purchase orders and vendor-portal terms have no effect.

You are responsible for your Authorized Users, their permissions, and everything done through your account, except what results from our breach. Keep credentials confidential, use multi-factor authentication where we offer it, and tell us at accounts@gethivemind.ai without delay if you suspect compromise. We may reset credentials or revoke tokens to protect the Services.

For the term of your plan we grant you a limited, non-exclusive, non-transferable right for your Authorized Users to use the Services for your own recruiting and workforce purposes, and for the purposes of your clients if you are a staffing or recruitment agency acting for them. You may use our APIs and integrations within the documented rate limits. You may not resell the Services or run them as a bureau for third parties unless an Order Form allows it.

Fees are as shown in-product or in the Order Form, in USD unless stated otherwise, and exclude taxes. You are responsible for sales, use, VAT, GST, and similar taxes; we are responsible for taxes on our income. If you must withhold tax, you will increase the payment so that we receive what we would have received without the withholding, and supply the receipts within 30 days.

Invoices are due within 30 days. Self-serve fees are charged to your payment method at the start of each period. Dispute an invoice in good faith within 30 days with the amount and reason; we will not suspend for a disputed amount while we work it out. Undisputed amounts overdue by more than 15 days may accrue interest at the lower of 1.5% a month and the legal maximum. We may suspend the account only where an undisputed amount is more than 60 days overdue and we have given at least 15 days' written warning.

Usage above your plan limits is charged at the overage rates shown in-product or in the Order Form, or we may ask you to upgrade after reasonable notice.

Monthly Self-serve plans run month to month and can be canceled in-product at any time, effective at the end of the current month. Annual Self-serve plans run for the stated term and renew for a further year unless either party gives notice of non-renewal at least 15 days before the renewal date. A renewal price rises by no more than the lower of 7% and the 12-month change in the US Consumer Price Index for All Urban Consumers, and we give notice of any increase at least 45 days before the renewal. We will email the account owner between 30 and 40 days before each renewal with the renewal date, the price, and how to cancel. Enterprise plans renew as their Customer Agreement states. Cancellation is available in-product for every plan bought online, without needing to call or write to us. Fees for a committed term are not refundable except as these Terms provide.

A trial or pilot runs on the terms shown at enrollment or in the Order Form, including its length, usage limits, what happens at the end, and what data we delete if you do not convert.

We do not guarantee any hire, candidate quality, a particular hiring outcome, a reduction in bias, or your compliance with any law. No website statement creates a guarantee or a refund right beyond what these Terms or a signed Customer Agreement state.

Where an Order Form or SOW includes implementation, migration, configuration, assessment building, training, or integration work, we will perform it with reasonable skill and care and with suitably qualified people. You will provide, when asked, the access, data, credentials, decisions, and people the work needs. Delay on your side moves the dates and may add cost through written change control. The SOW states milestones, acceptance criteria, and remedies. Marketing statements about implementation speed are not acceptance criteria unless the SOW adopts them.

You will:

• use the Services only for lawful recruiting, selection, and workforce purposes;
• have a lawful basis for, and give the notices required for, all Customer Data you process, including Candidate Data you import, source, enrich, or receive from third parties;
• configure job criteria, scoring rubrics, and assessments that are job-related and non-discriminatory, and not use protected characteristics, zip codes, or other proxies for them;
• keep a human decision maker responsible for every hiring decision and follow Schedule 2;
• obtain every consent needed for recording, transcription, AI phone screens, SMS, and integrations, and honor opt-outs;
• use Sourced Records only as B9 allows, give the notices the law of each person's location requires, and honor objections;
• provide reasonable accommodations and an alternative process to Candidates who need one;
• keep the employment records your jurisdictions require;
• answer Candidates and regulators about decisions you made;
• follow the documentation and Schedule 1.

You remain the employer, employment agency, or recruiter. Providing software does not make us your employment agency, your co-employer, or your legal adviser.

As between us, you own Customer Data. You grant us the right to host, process, transmit, and display it only as needed to provide, secure, and support the Services, to comply with law, and as you otherwise instruct through the product. Personal data is governed by Applicable Law and the DPA rather than by ownership.

The DPA applies to every account, including Free accounts, from the moment the account is created. It sets out our processor obligations, our subprocessors, transfer mechanisms, security measures, breach notification, audit rights, and deletion. Where these Terms and the DPA conflict about personal data, the DPA wins.

We do not sell Customer Data or Candidate Data and we do not use either for advertising.

Sourced Records. Profiles the sourcing feature delivers to you ("Sourced Records") come from a contact database we license from a third-party data provider, of which we are the controller. A Sourced Record is not Customer Data: for it each of us is an independent controller, and you are responsible for your lawful basis, notices, and responses to the people concerned. You may use a Sourced Record for your own recruiting, including placement with your own clients if you are a staffing business, for as long as your plan lasts and we hold the underlying data under our supplier license. You will not resell, distribute, or publish Sourced Records, use them to build or enrich a competing database, use the data fields as delivered by the sourcing feature (the "Delivered Fields") as an input to any scoring, ranking, screening, assessment, or automated decision about the person, or use them for background checks, any purpose covered by the Fair Credit Reporting Act, or training generative AI. Profiles of people in the EU, EEA, and UK are excluded from sourcing until we confirm in writing that they are available. Anything a Candidate gives you directly, including a reply and an application, is Customer Data.

AI Features support decisions; they do not make them, unless you configure a workflow that does. Outputs can be incomplete, inaccurate, or biased, and you will have Outputs reviewed by trained personnel with authority to accept, modify, or disregard them before relying on them for any decision that materially affects a Candidate. Schedule 2 sets out what each party does about validation, human oversight, notices, audits, logs, and accommodations. If you configure a workflow that rejects, advances, or otherwise decides about a person on an Output with no person reviewing the case, you do so as the decision maker and only on the conditions in Schedule 2 section 2.2.

We will not use identifiable Customer Data or Candidate Data to train any model that serves other customers, and we do not license Candidate recordings for training by anyone, unless you opt in through a separate signed agreement that states the data, the purpose, and the lawful basis. Retrieval, configuration, and evaluation of your own workflows are not model training. Vapi, the subprocessor that runs AI phone screens, keeps call recordings and transcripts under its own terms, which permit it to use them to improve its models, and we have no zero-retention arrangement with Vapi; the DPA Annex 3 states the position for each model provider. We may use de-identified and aggregated usage data to run, secure, and improve the Services, and we will not try to re-identify it.

Do not record, transcribe, or analyze a call, interview, or meeting through the Services unless every participant has been told and every consent the law of their location requires has been obtained. The Services do not play a recording notice or collect recording consent; you give the notice and obtain the consent.

Email, SMS, telephone, and AI-voice features may only be used with the consent, sender identification, opt-out, suppression, and quiet-hours practice the law requires, and you supply what the Services do not. An AI phone screen call is placed when the Start button on the Candidate's phone interview page is pressed, to the number shown there, or from the recruiter test-call tool; the Services keep no record of consent to it, so you obtain that consent. The test-call tool may be used only to call your own number or a person who has agreed to receive an AI call, and never a number obtained from sourcing or enrichment. The preset AI phone screen greetings say the agent is an AI; if you edit a greeting you keep that statement in its first sentence and never configure an agent to claim to be a human. Send SMS to Candidates only between 08:00 and 20:00 at the recipient's local time: campaign send windows use one time zone per campaign, and pipeline SMS and reminders send when the Candidate reaches the step, so configure them accordingly. Our SMS provider's standard handling blocks further messages from a US or Canadian number after a STOP reply; the Services do not record opt-outs, so you honor every STOP, unsubscribe, or other reasonable revocation within 10 business days and, from 31 January 2027, across all messaging to that person. Never re-add a suppressed contact.

E-signature features let you collect an electronic signature and keep an audit trail. You decide whether a document may be signed electronically in the relevant jurisdiction and you keep the records the law requires.

We assign to you, on creation, all right, title, and interest in the job descriptions, rubrics, assessment questions, workflows, benchmark reports, and other content we create specifically for you under an Order Form or Customer Agreement ("Customer Deliverables"). You own your Customer Data and your Outputs. We own the Services, the platform, the models, our generic templates, question banks, workflow patterns, item banks, scoring methods, and improvements to them, whoever prompted the improvement, but no improvement includes a Customer Deliverable or Customer Data. We grant you a perpetual, irrevocable, royalty-free, worldwide, non-exclusive license to any of our templates or items embedded in a Customer Deliverable, to the extent needed to use it. Outputs do not transfer any right in our models or the Services, and third-party material inside an Output stays subject to that third party's rights.

Each party will protect the other's confidential information with at least reasonable care, use it only to perform or benefit from these Terms, and share it only with people who need it and are bound to keep it confidential. Customer Data and your hiring metrics are your confidential information. Our pricing, security details, roadmap, and non-public product information are ours. The duty does not cover information that is public without breach, already known, independently developed, or lawfully received from someone else. Disclosure required by law is allowed with advance notice where permitted. The duty lasts five years after the end of your plan, and for trade secrets as long as they stay secret. Personal data stays protected as long as it is held.

We keep the technical and organizational measures in Schedule 3 and the DPA. We tell you without undue delay after becoming aware of a personal data breach affecting your Customer Data, within the period in the DPA. You are responsible for your devices, users, permissions, exported data, and third-party systems. We will describe any audit or certification we hold only within its actual scope and period.

When you connect a third-party service you authorize us to exchange Customer Data with it as your configuration directs. The third party's terms apply to it. We are not responsible for third-party outages or API changes outside our control, and we will give notice where we can when an integration will stop working. Subprocessors we choose are our responsibility under the DPA.

Each party warrants that it can enter these Terms. We warrant that during a paid term the Services will perform materially as documented, professional services will be performed with reasonable skill and care, each assessment we build is built to your written specification and comes with the technical documentation a validation study needs, we will not knowingly introduce malicious code, and we will keep the Schedule 3 measures. If we breach this warranty, we will fix or re-perform; if we cannot within a reasonable time, you may terminate the affected plan and receive a pro-rata refund of prepaid fees for the unused period. That is your exclusive remedy for breach of warranty.

Except as stated in these Terms, the Services, AI Features, and Outputs are provided as available, and we disclaim implied warranties of merchantability, fitness for a particular purpose, title, and non-infringement to the extent the law allows. We do not warrant uninterrupted or error-free operation, that Outputs are accurate or free of bias, that any assessment is valid or job-related for any particular role, that any Candidate will be hired, or that using the Services makes you compliant with any law. Nothing excludes a warranty or right that cannot be excluded.

By us. We will defend you against a third-party claim that the Services as provided by us infringe a patent, copyright, or trade mark, and pay resulting damages and settlements we approve. We are not liable for claims arising from Customer Data, your modifications, combinations we did not supply, use against the documentation, or AI-generated Output, including assessment content, messages, and summaries, that you chose to use, publish, or send. If a claim is likely, we may fix, replace, or, as a last resort, terminate the affected Service with a pro-rata refund.

By you. The Services are a set of tools that you configure and operate for your own hiring. You alone decide how you use them, which Candidates you assess, contact, interview, select, and hire, and whether that use complies with the employment, anti-discrimination, automated-decision, privacy, consumer-reporting, and telemarketing laws that apply to you in each place you hire. You will defend us against any third-party claim, and any regulatory proceeding, arising from your use of the Services, including your Customer Data, your employment decisions, the criteria and assessments you specified or configured (psychometric instruments included), a notice, consent, validation, or audit you failed to give, obtain, or perform, your use of Sourced Records, and use of the Services in breach of these Terms, and pay resulting damages, penalties, costs, and settlements you approve. The only exception is a duty that Applicable Law places on us directly as a developer of the Services and does not allow to be shifted.

The indemnified party must notify promptly, cooperate, and let the indemnifying party control the defense, and no settlement may impose obligations on the indemnified party without its consent. Nothing in this section allocates a duty that Applicable Law imposes on a party directly.

Neither party is liable for indirect, consequential, special, or punitive loss, or for lost profits, revenue, or goodwill, even if foreseeable.

To the fullest extent Applicable Law permits, our only liabilities to you under or in connection with these Terms, however arising, are the refunds, service credits, re-performance, term extension, and other remedies these Terms and the DPA expressly provide and our indemnity in B18, and we have no other liability to you. If and to the extent Applicable Law does not permit that exclusion, our total liability is capped at the fees you paid in the 12 months before the event giving rise to the claim. Your total liability under these Terms, other than your payment obligations and your indemnity in B18, which are uncapped, is capped at the same amount. Our indemnity in B18 is not subject to the cap. These caps survive independently of any remedy in these Terms and do not apply to either party's fraud or willful misconduct or to liability that cannot be limited by law.

We may suspend affected access where reasonably necessary to address a security threat, unlawful use, a material breach of Schedule 1, a legal requirement, or fees overdue as B4 allows. We will give notice where practicable, limit the suspension to what is needed, and restore access when the cause is resolved.

Either party may terminate a plan if the other materially breaches these Terms and does not cure within 30 days of written notice, or immediately if the other commits a breach that cannot be cured or, to the extent Applicable Law permits, becomes insolvent. You may stop using a Free plan at any time. Termination does not cancel fees already due for Services delivered. If you terminate for our uncured breach, we refund within 30 days the prepaid fees other than purchased credits, pro rata for the unused remainder of the current term, plus the price paid for purchased credits not yet consumed; if we terminate for your breach, we do not accelerate fees for the unperformed remainder. Sections that by nature survive (confidentiality, IP, fees, indemnities, liability limits, data obligations, disputes) survive.

During your plan you can export the records, reports, and configurations that the product's export features provide, and on request we produce a full export of Customer Data and any Customer Deliverables, as CSV and files, within 30 days. For 30 days after termination we keep that export available, unless we terminated for unlawful use or the law forbids it. After that we delete or de-identify Customer Data under section 9 of the DPA, except what we must keep by law.

We will not use your name, your logo, or the existence of your account in marketing, a case study, a testimonial, or a customer listing without your prior written consent, which you may give or withhold in your absolute discretion and withdraw for future use on written notice. Nothing in these Terms requires you or your people to write or publish any review, rating, or statement about Hivemind, and no benefit under these Terms depends on one.

Each party will comply with applicable sanctions, export-control, and anti-bribery laws. Each party represents that neither it nor, to its knowledge, any of its owners, directors, or officers is a sanctioned person or located in an embargoed territory, and that it has not made or offered any improper payment in connection with these Terms. You will not give access to the Services from an embargoed country or to a sanctioned person.

The employer, agency, or recruiter running the process (the "Employer") decides what roles to fill, what criteria to use, and who is hired. Hivemind provides the software the Employer uses. For most of your data the Employer is the controller and we are its processor; the Candidate Privacy Notice explains this and tells you who to contact for what.

If you create a portal account you must give accurate information and keep your login confidential. You confirm that what you submit (CV, answers, recordings, work samples) is your own work, is truthful, and does not infringe anyone else's rights. You keep the rights in your own material. You allow the Employer and us to use it for the recruitment process and as the Candidate Privacy Notice describes, and for nothing else.

The Employer may use AI Features to parse your application, transcribe and summarize a screen or interview, score an assessment, or rank applications. You will be told before a step uses AI, and a person at the Employer remains responsible for any decision about you. You can ask for a human review of an automated result, provide more context, correct inaccurate data, or ask for a reasonable accommodation or an alternative process. The Candidate Privacy Notice gives the address. We will not treat you worse for asking.

Phone screens, live AI interviews, video answers, and interviews may be recorded and transcribed, and your on-screen activity during an assessment may be recorded. An AI phone screen call starts only when the Start button on your phone interview page is pressed. The Employer is responsible for telling you before recording starts and, where the law requires, for offering an alternative. If you give a mobile number you may receive SMS about your application; reply STOP to end them.

Hivemind never charges a Candidate. Nothing in the Services guarantees you an interview, an offer, or employment.

If an Employer found your profile through a public source or through Hivemind's contact database and contacted you through Hivemind, you can object at any time using the link in the message or the address in the Candidate Privacy Notice, and we will suppress further contact through the Services. If your profile is in our contact database you can also ask us to remove it and keep it out (Privacy Policy section 5A).

We may change these Terms for legal, security, or product reasons. For a change that reduces your rights or adds obligations, we will give Customers at least 30 days' notice by email and in-product, and the change will not apply during a committed term you have already paid for unless the law requires it or you accept it. Other changes take effect when posted. Prior versions stay available from a link on this page.

Legal notices to us go to accounts@gethivemind.ai with a copy by post to RocketDevs, LLC, 8 The Green, Suite R, Dover, DE 19901, United States. Notices to you go to the account owner's email or the address in the Order Form. A notice is effective when delivered.

These Terms, and any dispute arising out of or relating to them or their formation, including non-contractual disputes, are governed by the laws of the State of Delaware without regard to its conflict-of-laws rules. The United Nations Convention on Contracts for the International Sale of Goods and the Uniform Computer Information Transactions Act do not apply. Before starting proceedings a party gives the other written notice of the dispute; within 10 business days each names an executive with authority to settle it, they confer within 15 business days of the notice, and either party may start proceedings if the dispute is not resolved within 30 calendar days of the notice. No waiting period applies to urgent injunctive or interim relief, to collecting fees that are due and not disputed in good faith, or to a step needed to preserve a claim against a limitation period. Each party submits to the exclusive jurisdiction of the Superior Court of the State of Delaware sitting in New Castle County, with designation to its Complex Commercial Litigation Division where its rules permit, and, where that court lacks subject-matter jurisdiction, the United States District Court for the District of Delaware, and otherwise any Delaware state court of competent jurisdiction. Nothing in this section prevents a Candidate or other individual from exercising a right under the law of their own country, complaining to a regulator, or bringing a claim where consumer law gives them that right.

Neither party may assign these Terms without the other's consent, except to an affiliate or a successor in a merger, reorganisation, or sale of substantially all relevant assets that assumes them in writing. Each party will tell the other of any assignment.

Neither party is liable for delay or failure caused by events beyond its reasonable control, other than payment obligations and failures that reasonable continuity planning would have prevented.

The parties are independent contractors. If a provision is unenforceable it is first narrowed to give the maximum permissible effect to its intent and otherwise severed, and the rest stands. Failure to enforce is not waiver. These Terms, the DPA, and any Order Form are the whole agreement and replace prior proposals, except for fraud. Where you have signed a Hivemind Customer Agreement it prevails over these Terms, and no click-through acceptance of these Terms amends it. Electronic signatures and acceptance records are valid. There are no third-party beneficiaries. Neither party is the drafter for the purpose of interpreting ambiguity, and headings are for convenience.

We keep an inventory of AI Features, provided to the Customer on request, that states, for each one: whether it parses, transcribes, summarizes, scores, ranks, recommends, or converses; the categories of input it uses; what it outputs; and whether it is intended for decision support only. We record the provider and model family each feature uses. The Services do not record the model version, the prompt, or the provider used for an individual Output. Features that score or rank Candidates are recruitment and selection systems under Annex III of the EU AI Act and, because they profile natural persons, are high-risk without exception; we treat them as such everywhere, not only in the EU.

No AI Feature makes a decision about a Candidate unless the Customer configures it to. A score or ranking is an input to a person's judgment. The Services let a Customer build workflows that route Candidates automatically on a score, an assessment result, or an application answer, including a path that rejects or advances a Candidate without a person reviewing the individual case. If the Customer configures such a path, the Customer as the decision maker:

1. uses it only where the law of the Candidate's location permits a decision based solely on automated processing, and never on special-category data in the UK or the EU;
2. has completed the validation in 2.4 and given the notices in 2.5 before the path goes live;
3. keeps the human-review route in 2.6 available to every Candidate the path affects, and honors a request by having a person review the case; and
4. never uses a beta or preview feature on that path.

Neither party will use, and the Customer will not configure, race, color, religion, sex, sexual orientation, gender identity, national origin, age, disability, genetic information, pregnancy, union membership, or any other protected characteristic, nor obvious proxies such as name, photograph, accent, address, school, or graduation year, as a scoring or knockout criterion. We covenant that the AI Features do not perform emotion recognition, sentiment inference, voice-based personality inference, biometric extraction, or inference of protected characteristics, and do not make final hiring decisions except on a path the Customer configures under 2.2. Scoring what a Candidate said is not emotion recognition; scoring how they said it is, and is not offered.

We test each scoring and ranking feature for accuracy and for adverse impact across the groups the law names before release and at least annually, using representative data, and we keep the results. Where the Customer commissions an independent bias audit, we supply the audit data the Services hold and the Customer's historical data the auditor needs. We may also commission a vendor-level audit of the scoring features and, if we do, make the summary available to the Customer. The Customer is responsible for confirming that its own criteria, rubrics, and assessments are job-related for each role and for testing outcomes on its own applicant population where the law requires it. We provide, on request and at no charge, the technical information a Customer needs for a data protection impact assessment, an algorithmic impact assessment, a risk assessment, or an independent bias audit, including selection-rate and scoring-rate exports by group.

The Customer decides which Candidate notices its jurisdictions require and gives them, using the notice content we supply. We supply the content a Candidate notice needs: the qualifications and characteristics each feature assesses, the data categories and sources, and the retention statement. In particular:

• New York City: where a feature is an automated employment decision tool used for a role in the city, the Customer commissions the annual independent bias audit for its own use, publishes the summary, and gives Candidates the notice at least ten business days, as that law counts them, before use. We supply the audit data under 2.4.
• Colorado (the Colorado Artificial Intelligence Act, SB 24-205 as amended by SB 26-189, decisions from 1 January 2027): we act as developer and supply the intended-use, known harmful or inappropriate use, limitation, training-data-category, and human-oversight documentation a deployer needs, give notice of material updates, and keep that documentation for three years; the Customer as deployer gives the pre-use notice, the adverse-decision disclosure within the statutory period, and the correction and human-review route.
• Connecticut (Public Act 26-15, effective 1 October 2026, covered-deployment duties from 1 October 2027): the Customer gives the pre-decision written notice, which must name the tool by its trade name ("Hivemind") and the data categories used; we supply that wording.
• Illinois: the Customer gives the notice the Human Rights Act requires, never uses zip code as a proxy, and for AI-analyzed video interviews obtains written consent, limits sharing to evaluators, and honors deletion within 30 days of a request, which we perform on the Customer's written instruction under section 9 of the DPA.
• California: the Civil Rights Council regulations bind us as the Customer's agent as well as the Customer. Automated-decision-system input and output must be kept for four years. The Services keep Outputs until the Customer deletes them and delete none on a schedule, but a retaken assessment replaces the earlier grade and a manual review replaces the result, so the Customer keeps its own copies under 2.7. Personality or cognitive assessments are configured so they do not elicit disability or medical information. Where the CCPA automated decision-making rules apply, the Customer gives the pre-use notice and honors the opt-out and access rights; we supply the information a CCPA risk assessment needs and, from 1 January 2027, the automated decision-making technology information.
• New York State, Texas, and other states: the Customer determines applicability and gives any required notice; we do not develop or deploy any feature with the intent to discriminate.
• EU, EEA, and UK: from 2 December 2027 (Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744) the Customer as deployer uses the system according to our instructions, assigns competent human oversight, ensures input data is relevant and representative, keeps the logs we generate for at least six months, informs workers' representatives and affected workers before use, and informs each Candidate that they are subject to the system. We perform the provider duties: risk management, data governance and bias examination, technical documentation, automatic logging, instructions for use, accuracy and robustness testing, quality management, conformity assessment and CE marking, registration in the EU database, an EU authorized representative, and post-market monitoring and serious-incident reporting. Already in force and observed everywhere: no emotion inference (Article 5(1)(f), since 2 February 2025) and disclosure that a Candidate is interacting with AI (Article 50, since 2 August 2026). In the UK, Articles 22A to 22D of the UK GDPR (inserted by the Data (Use and Access) Act 2025, in force 5 February 2026) permit significant automated decisions on non-special-category data only with the safeguards of information, representations, human intervention, and contest, which the human-review route in 2.6 provides.

The Customer will maintain a route by which a Candidate can request human review of an automated result, correct data, add context, contest a result, and request a reasonable accommodation or an alternative process. A Candidate can send such a request to accounts@gethivemind.ai, and we forward it to the Customer within 5 business days. The Customer answers within the period its law requires and in any event within 30 days.

The Services store each Output with the Candidate record until the Customer deletes it. They do not store the model version, the prompt, or a history of human review: a manual review replaces the result, a score edit is marked as edited without the previous value or the user, a retaken assessment replaces the earlier grade, and the branch that rejected a Candidate is recorded only where the Customer has configured a webhook. The Customer keeps, outside the Services, the records Applicable Law requires of it, for the longer of the legal period and its own retention for similar decisions.

No identifiable Customer Data or Candidate Data trains a model of ours that serves other customers, and we license no recording for training, unless the Customer opts in under B10. The DPA Annex 3 states each model provider's training and retention position, including Vapi's.

Either party that becomes aware of a systematic error, drift, or disparate outcome in an AI Feature tells the other within five business days. We may disable a configuration that creates a material risk of unlawful discrimination, with notice.

We maintain an AI risk-management program informed by the NIST AI Risk Management Framework and describe it to the Customer on request.

Business Hours are 09:00 to 18:00 Central European Time (Central European Summer Time while in effect) on a Business Day. Business Days are Monday to Friday, excluding the holidays the United States federal government observes under 5 U.S.C. 6103.

We target 99.5% monthly availability of the web application and APIs, measured in minutes and rounded to two decimal places, excluding maintenance announced at least 48 hours ahead and limited to eight hours a month outside Business Hours, and events beyond our reasonable control. We report each month's availability within 10 Business Days after the month ends. Below target you may claim, within 30 days after that report, a credit of the following share of one twelfth of the annual fees:

Credits are your exclusive remedy for availability shortfalls, except that three consecutive months below target entitle you to terminate the affected plan with a pro-rata refund.

We announce material feature changes in the release notes and, for changes that remove functionality you have purchased, give 60 days' notice or an equivalent replacement.