Privacy Policy

This policy explains how TargetHire HR ("TargetHire HR", "we", "us") collects, uses, stores, and deletes personal data when you and your organisation use our interview screening platform. It applies to data belonging to account holders (employers using the platform) and to candidates whose interviews are recorded and analysed through it.

If you do not agree with this policy, please do not use the service. If you have questions or wish to exercise any of the rights described below, contact us at tradewellharry@gmail.com.

1. Who is responsible for your data

For account data (employer organisation details, user logins, billing information), TargetHire HR acts as the data controller. For candidate interview data uploaded by an employer using the platform, the employer organisation is the data controller and TargetHire HR acts as a data processor, processing that data only on the organisation's instructions and for the purposes set out in this policy and our terms of service.

If you are a candidate and have questions about an interview recorded about you, you should in the first instance contact the organisation that conducted the interview, as they control how and why your data was collected. We will also respond to direct candidate requests as described in Section 7.

2. What data we collect

Account and user data

• Name and email address of the people who sign up and use the platform.
• Organisation details (company name, plan, billing reference).
• Authentication data, such as hashed passwords (handled by our authentication provider, Supabase, and never stored by us in plain text).
• Usage data such as login times, interviews uploaded, and actions taken within the platform.

Candidate interview data

• Audio recordings of screening interviews, uploaded or recorded by your organisation.
• Transcripts generated from those recordings.
• The candidate's name, as entered by your organisation.
• AI-generated reports derived from the transcript, including summaries, scores, strengths, concerns, cultural fit notes, and hiring recommendations.
• Records of which users within your organisation uploaded or were given access to a given interview.

We do not knowingly collect any special category data (such as health information, religious beliefs, or political opinions) about candidates, and organisations using the platform must not deliberately record or submit such information. If special category data is incidentally captured within an interview recording (for example, a candidate voluntarily disclosing a health condition), it is processed under the same security and retention controls described in this policy, and the organisation that recorded the interview remains responsible for ensuring it had a lawful basis to capture and retain it.

3. Why we process this data and our legal basis

• To provide the service -- transcribing audio, generating reports, storing and displaying interview records, and enabling your team to review and compare candidates. Legal basis: performance of our contract with your organisation (Article 6(1)(b) UK GDPR), and, in respect of candidate data, processing on the organisation's behalf as set out in our processor terms.
• To operate user accounts and billing -- authenticating users, managing subscriptions, and processing payments. Legal basis: performance of a contract and our legitimate interest in running a functioning, billable service (Article 6(1)(f)).
• To maintain security and prevent misuse -- monitoring for unauthorised access, abuse, or technical faults. Legal basis: legitimate interests in keeping the platform secure (Article 6(1)(f)).
• To comply with legal obligations -- such as responding to lawful requests from regulators or retaining billing records as required by tax law. Legal basis: compliance with a legal obligation (Article 6(1)(c)).

Organisations using TargetHire HR to record candidate interviews are responsible for establishing their own lawful basis for processing candidate data -- typically their legitimate interest in fair recruitment, provided the candidate has been clearly informed and, where required, has given their consent to being recorded. Our terms of service require organisations to obtain that consent before recording any interview.

4. How long we keep data

Candidate interview data -- audio, transcripts, candidate names, and generated reports -- is retained for 90 days from the date of upload by default. After this period it is automatically and permanently deleted from our systems, including backups within a reasonable operational timeframe. Organisations on certain plans may extend this retention period; where they do, the extended period will apply instead.

Account data (organisation and user records) is retained for as long as the organisation maintains an active subscription, plus a limited period afterwards to handle billing queries, unless deletion is requested sooner in accordance with Section 7. Billing records that we are legally required to keep (for example, for tax purposes) are retained for the period required by law, which in the UK is generally six years.

5. Who we share data with

We do not sell personal data, and we share it only with the following categories of recipient, each of which is bound by appropriate data processing terms:

• OpenAI -- audio recordings are sent to OpenAI's Whisper model for transcription, and the resulting transcript text is sent to OpenAI's GPT-4o model to generate the structured candidate report. This is a core, unavoidable part of how the service works: without sending this data to OpenAI for processing, no transcript or report can be produced. OpenAI processes this data as our sub-processor, under its own data processing terms, and does not use data submitted via the API to train its models.
• Supabase -- our database, file storage, and authentication provider, which hosts account data, candidate records, and audio files on our behalf, under a data processing agreement.
• Payment processors (Stripe) -- to process subscription payments. We do not store full card details ourselves.
• Other users within your organisation -- interview records are visible only to the user who uploaded them and to colleagues they specifically share the record with, or to organisation administrators, as configured within the platform.

We will also disclose data where we are required to by law, for example in response to a valid court order or regulatory request.

6. Where data is stored and international transfers

Our infrastructure providers may process and store data outside the UK and European Economic Area, including in the United States. Where this happens, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, to ensure data receives an equivalent level of protection.

7. Your rights

Subject to applicable law, you have the right to:

• Access -- request a copy of the personal data we hold about you.
• Rectification -- ask us to correct inaccurate or incomplete data.
• Erasure ("right to be forgotten") -- ask us to delete your personal data. For candidate interview data, we will action erasure requests directly, or pass them to the relevant organisation where we act only as a processor and the organisation is best placed to assess the request.
• Restriction -- ask us to limit how we use your data in certain circumstances.
• Portability -- request your data in a structured, commonly used, machine-readable format, where technically feasible.
• Objection -- object to processing carried out on the basis of legitimate interests.

To exercise any of these rights, email tradewellharry@gmail.com with enough detail for us to identify the relevant data (for example, the organisation name and candidate name, or your account email address). We will respond within one month, as required by UK GDPR. We may need to verify your identity before acting on a request.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

8. How we keep data secure

Personal data, including audio recordings and transcripts, is encrypted in transit (using TLS) and at rest. Access to candidate data within the platform is restricted by organisation and by user permissions, enforced at the database level, so that users can only see interviews they uploaded or were given access to. Administrative access to underlying infrastructure is limited to those who need it to operate the service.

9. Automated processing

The candidate reports generated by TargetHire HR are produced by AI models (OpenAI Whisper for transcription and GPT-4o for analysis) and constitute a form of automated decision-support. These reports are intended to assist human reviewers, not to replace them -- hiring decisions are made by people within your organisation, not by the platform. If you are a candidate and believe a decision about you was based solely on automated processing without meaningful human review, you have the right to request human intervention, and should raise this with the organisation that interviewed you, or with us using the contact details above.

10. Changes to this policy

We may update this policy from time to time, for example to reflect changes in the law or in how the service works. Where changes are material, we will take reasonable steps to notify account holders. The date at the top of this page shows when it was last updated.

11. Contact

For any question about this policy or about how your data is handled, contact us at tradewellharry@gmail.com.