Privacy Policy

Last updated: April 2026

HireHex ("we", "our", or "us") is committed to protecting your personal information. This Privacy Policy explains what data we collect, how we use it, and your rights in relation to it. By using HireHex, you agree to the practices described here.

1. Information We Collect

Account Information

When you register, we collect your full name, email address, password (stored securely as a hash), phone number (optional), country, and your account role (Job Seeker or Recruiter). If you sign in with Google, we receive your name, email address, and Google account ID from Google's OAuth service.

Application Data

When you apply for a job, we collect the information you provide: cover letter, resume/CV (PDF or Word document), phone number, LinkedIn profile URL, and portfolio or personal website URL. All fields except the job itself are optional.

CV Generator Data

When you use the AI CV & Cover Letter Generator, you may submit CV text or upload a file. This content is transmitted to a third-party AI provider for processing and is not stored by us beyond the duration of your session request. We do record usage counts per account to enforce the feature's usage limit.

Job Alert Preferences

If you create job alerts, we store your chosen keywords, job categories, and other filter criteria to send you matching job notification emails. You can view, edit, or delete your alerts at any time from your dashboard.

Mobile App & API Tokens

When you log in via the HireHex mobile application, we issue a secure API token that is stored on your device. We log the creation time of tokens but do not log individual API requests beyond standard server-level access logs. You can revoke your mobile session from your account settings at any time.

Usage Data

We collect standard server log data including your IP address, browser type, pages visited, and timestamps. We use this to maintain platform security, diagnose issues, and understand how the platform is used.

We use essential session cookies to keep you logged in and remember your preferences (such as language and dark/light mode). We do not use advertising or tracking cookies. The mobile application uses secure on-device token storage instead of cookies.

2. How We Use Your Information

To create and manage your account.
To process and display your job applications to the relevant recruiter.
To allow you to save jobs and track your application history.
To send you job alert emails when new listings match your saved criteria.
To process your CV content through our AI provider and return an improved document to you.
To send you important account notifications (e.g. password reset emails, email verification codes).
To authenticate your mobile app sessions via API tokens.
To enforce our Terms of Service and prevent misuse.
To improve the platform based on usage patterns.

3. How We Share Your Information

With Recruiters

When you apply for a job, the information in your application (name, email, cover letter, resume, phone, LinkedIn, and portfolio) is shared with the recruiter or employer responsible for that listing, including any authorised team members on their company account. By submitting an application, you consent to this.

With AI Service Providers

When you use the CV Generator, your CV content is transmitted to a third-party AI language model provider. This provider processes the content solely to generate an improved version and returns the result. We use providers whose data processing agreements prohibit them from using your content to train their models. We encourage you to review the relevant AI provider's privacy policy for further detail.

With Service Providers

We may share data with trusted third-party services that help us operate the platform, such as hosting providers and email delivery services. These providers are contractually bound to keep your data secure and may not use it for their own purposes.

Google OAuth

If you choose to sign in with Google, your authentication is handled by Google. We receive only your name, email, and Google account ID. We do not receive your Google password. Google's use of your data is governed by Google's Privacy Policy.

Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests from public authorities.

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

4. Data Retention

We retain your account data for as long as your account is active. If you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal or compliance purposes.

Application data (cover letters, resumes) is retained for up to 12 months after the job listing closes, to allow recruiters to complete their hiring process. After that period, it is deleted.

CV Generator inputs are not stored beyond the processing request. Usage counts are retained for as long as your account is active.

Job alert preferences are deleted when you delete the alert or close your account. API tokens are invalidated upon logout or account deletion.

5. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you.
Correction: Request that we correct inaccurate or incomplete data.
Deletion: Request that we delete your personal data ("right to be forgotten").
Portability: Request a machine-readable copy of your data.
Objection: Object to certain uses of your data.

To exercise any of these rights, please contact us.

6. Security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse. Passwords are stored using industry-standard hashing (bcrypt). Uploaded files are stored in a private, access-controlled storage environment. Mobile API tokens are transmitted over HTTPS and stored securely on-device.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

7. Children's Privacy

HireHex is not intended for use by anyone under the age of 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If we make significant changes, we will notify you by email or via a notice on the platform. Your continued use of HireHex after any changes constitutes acceptance of the updated policy.

Questions about your data?

If you have any questions or concerns about this Privacy Policy or how we handle your data, please get in touch.