HirePitch policy
Privacy
External counsel review of these terms is a launch gate that is not yet complete. The commitments below describe how the product actually behaves today; wording may tighten after review, and no candidate fee or stored value may ever be introduced.
HirePitch stores the least it can to run a marketplace, and it never stores a CV.
CVs never reach our servers
CV parsing runs entirely in a Web Worker in your browser. The file and the extracted text stay on your device; buffers and object URLs are cleared when parsing finishes or is cancelled. Only the structured fields you review and approve are uploaded. There is no raw-CV column, bucket, or backup anywhere in the system.
What we store and why
- Account and session — to sign you in by single-use email link.
- Seeker profile — the structured fields you reviewed, used to apply.
- Applications — your answers and a profile snapshot, shared with that employer only.
- Employer content — company and job text, with encrypted original input kept as moderation evidence.
- Payments — placement purchases, provider transactions, refunds and disputes. Employers pay; candidates never do.
- Security and tool telemetry — request metadata and agent tool calls without user-authored text.
Retention
| Category | Kept for | Why |
|---|---|---|
| Unsubmitted drafts | 30 days of inactivity | Data minimisation |
| Application content | 24 months after the job closes, unless a legal hold applies | Contract and dispute handling |
| Raw moderation evidence (encrypted) | 12 months after the final decision | Trust and safety, legal defence |
| Tool-call metadata | 90 days | Abuse investigation |
| Security and audit events | 12 months, except payment-related records | Security monitoring |
| Payment, refund, dispute and tax records | 7 years or the longer legally required period | Statutory accounting duty |
| Expired magic links and organization invitations | Purged within 30 days | Credential hygiene |
| Talent search documents | No retention after the profile becomes ineligible | Consent and data minimisation |
| Unavailable talent shortlist references | 30 days after the profile becomes unavailable | Recruiter workflow continuity and data minimisation |
| Talent outreach invitations | 24 months after the terminal transition or related job closure | Contract, consent, abuse, and dispute evidence |
| Encrypted talent moderation evidence | 12 months after the final decision | Trust and safety, legal defence |
| GDPR export archives | Deleted within 7 days | Data minimisation |
Your rights
Export and deletion are self-service from your data. Export archives use short-lived links and are deleted within seven days. Deletion removes your profile and saved data, anonymizes application content where no overriding obligation applies, revokes sessions, and pseudonymizes payment and audit references we must keep by law.
Processors
- Turso — database
- Fly.io — application hosting
- Cloudflare — DNS, TLS, CDN and object storage
- Amazon SES — sign-in and transactional email
- Dodo Payments — merchant of record for employer payments
- Sentry and Grafana Cloud — errors and operational telemetry