1. Who we are

HireOS is operated by Aravind Innovative Ltd ("we", "us", "our"). We are the data controller for information collected through hireos.co.uk and hireos.ai.

Contact: privacy@hireos.co.uk

2. What data we collect

Account data

• Name, email address, password (encrypted)
• Country / preferred job market
• Account creation date and login history

CV and career data

• Your uploaded CV (PDF or DOCX) — stored securely in Supabase
• Work history, skills, education, certifications you provide
• Target roles, salary expectations, location preferences
• STAR+R answers you create during coaching sessions

Usage data

• Jobs you searched for and viewed
• Applications you created and submitted
• Interview coaching session history
• Feature usage (job scanner, CV tailoring, Nova workspace)

Technical data

• IP address, browser type, device type
• Pages visited and time spent on site
• Error logs for debugging

Payment data

Card payments are processed by Stripe. HireOS never stores full card numbers. We receive only a payment confirmation token and last 4 digits.

3. How we use your data

To provide the service

• Tailoring your CV to specific job descriptions using AI
• Generating personalised cover letters and interview answers
• Searching job portals on your behalf across 7 markets
• Running STAR+R coaching sessions specific to your experience
• Powering Nova's real-time on-job support across 8 domains

AI processing

Your CV and job details are sent to Anthropic's Claude API to generate tailored content. Anthropic processes this data under their own data processing agreement. We use API settings that disable training on your data. Your CV content is never used to train AI models.

To improve HireOS

• Analysing which features are used most to prioritise development
• Monitoring API performance and error rates
• Aggregated, anonymised usage statistics (no personal data)

To communicate with you

• Transactional emails: account confirmation, password reset, receipts
• Product updates (you can unsubscribe at any time)
• University or institution partnership communications

4. Legal basis (GDPR)

We process your data under these legal bases:

• Contract performance — to provide the service you signed up for
• Legitimate interests — to improve the product and prevent fraud
• Consent — for marketing emails (you can withdraw at any time)
• Legal obligation — when required by law (e.g. financial records)

5. Who we share data with

We never sell your data to employers, recruiters, data brokers or advertisers.

We share data only with these trusted third-party processors:

• Anthropic — AI processing of CV and job content (USA, SCCs in place)
• Supabase — secure database storage (EU region)
• Clerk — authentication and user account management (USA, SCCs in place)
• Stripe — payment processing (USA/EU, PCI-DSS compliant)
• Vercel — application hosting (USA/EU, SCCs in place)
• Resend — transactional email delivery

All processors are bound by data processing agreements. International transfers to the USA are covered by Standard Contractual Clauses (SCCs).

6. Data retention

• Active accounts: data retained for the lifetime of your account
• Deleted accounts: all personal data deleted within 30 days
• CV files: deleted immediately when you remove them or close your account
• Payment records: retained for 7 years (UK tax law requirement)
• API logs: anonymised after 90 days, deleted after 12 months

7. Your rights (GDPR / UK GDPR)

You have the right to:

• Access — request a copy of all data we hold about you
• Rectification — correct inaccurate data
• Erasure — delete your account and all associated data
• Portability — receive your data in a machine-readable format
• Restriction — limit how we process your data
• Object — opt out of processing based on legitimate interests
• Withdraw consent — for marketing emails at any time

To exercise any right, email privacy@hireos.co.uk. We will respond within 30 days.

You can also complain to the ICO (Information Commissioner's Office) at ico.org.uk if you believe we have mishandled your data.

8. Cookies

We use minimal cookies:

• Essential cookies — login session, security token (required, cannot be disabled)
• Analytics cookies — anonymised usage data via privacy-first analytics (you can opt out)

We do not use advertising cookies, third-party tracking pixels, or sell cookie data.

9. Security

• All data encrypted in transit (TLS 1.3) and at rest (AES-256)
• CV files stored in isolated, access-controlled Supabase storage
• Passwords hashed with bcrypt — we cannot see your password
• API keys stored as environment variables — never in source code
• Regular security reviews and dependency updates

10. Children's data

HireOS is not intended for users under 16 years old. We do not knowingly collect data from children. If you believe a child has created an account, contact us at privacy@hireos.co.uk and we will delete it immediately.

11. Changes to this policy

We may update this policy when we add new features or when law requires it. We will notify active users by email for material changes. The current version is always at hireos.co.uk/privacy.