Privacy Policy

01Who We Are and the Two Roles We Play

Novexhire, Inc. is a Delaware corporation headquartered at 1100 Congress Ave, Suite 1400, Austin, TX 78701, United States, with additional offices in Chicago, Bogota, Madrid, and Manila. We operate the Novexhire talent acquisition platform and a recruitment agency practice. This policy covers both.

Our obligations depend on which role we are in for a given set of data. When we decide why and how data is processed, we are a controller. When an employer decides those things and we act on its instructions, we are a processor and the employer is the controller. Most candidate data flows through the platform under the second arrangement, governed by the Data Processing Addendum we sign with each customer.

• We act as a controller for: recruiter and customer user accounts, billing records, our own marketing and event lists, security and audit logs, and website visitors.
• We act as a processor for: candidate profiles, applications, resumes, interview recordings and transcripts, screening conversations, call audio, and agent-generated scores submitted or generated inside a customer's workspace.
• We act as a controller for candidate data collected through our own agency practice, where Novexhire recruiters place candidates directly with client employers.

02Data We Collect from Recruiters and Customer Users

When an organization subscribes to Novexhire, we collect the information needed to create and support the workspace. Individual recruiters, hiring managers, and administrators using that workspace are the people this section is about.

We collect this data directly from the user, from the customer's administrator, or from the identity provider the customer connects, such as Okta or a Workday-linked directory. We do not buy recruiter contact lists from data brokers.

• Identity and account data: name, work email address, job title, team, workspace role and permissions, profile photo if uploaded.
• Authentication data: password hashes, single sign-on identifiers, multi-factor enrollment, session tokens, and login history including IP address and device type.
• Usage data: features opened, searches run, agents launched, jobs created, records viewed, and timestamps. We use this for billing accuracy, capacity planning, and abuse detection.
• Support and communications data: tickets, chat transcripts with our support team, feedback submitted in product, and call notes.
• Billing data: company legal name, billing contact, purchase orders, tax identifiers, and payment status. Card and bank details are handled by our payment processor and never stored on our systems.
• Integration data: metadata exchanged with connected systems such as Greenhouse, Lever, SAP SuccessFactors, BambooHR, Slack, Microsoft Teams, or Zapier, limited to the scopes the customer authorizes.

03Data We Collect from Candidates

Candidate data reaches us in four ways: a candidate applies or replies directly, a customer imports records from its applicant tracking system, our Beacon Sourcing agent finds a professional profile on a public job board or public web page, or a Novexhire recruiter adds a candidate to an agency search.

We collect what is needed to evaluate a person for a specific role. We do not ask candidates for government identification numbers, financial account details, health information, or immigration documents through the platform. Customers are contractually prohibited from uploading those categories into standard workspace fields.

Where a customer collects voluntary equal employment opportunity data to meet EEOC reporting duties, that data is stored in a separate encrypted store, is excluded from every scoring model, and is never shown to an interviewer or surfaced in TalentGraph search results.

• Application and profile data: name, contact details, location, work authorization status as a yes or no answer, resume or CV, work history, education, skills, certifications, portfolio links, and salary expectations.
• Sourced professional data: publicly available profile information gathered by Beacon Sourcing from job boards and open web pages, including current employer, title, tenure, and public skill listings, together with the source URL and collection date.
• Screening conversation data: messages exchanged with Signal Screening over WhatsApp or SMS, including the answers to pre-qualification questions, delivery receipts, and opt-out requests.
• Voice data: audio of inbound and outbound calls handled by Voice Outreach, the machine transcript, call duration, and disposition. Recording is announced at the start of every call and can be declined without losing consideration for the role.
• Interview data: video and audio from Nova Recruiter structured interviews, the transcript, timestamps of each answer, and the structured scores generated against the job description criteria.
• Derived data: skill tags, seniority estimates, role-fit scores, and rediscovery matches produced by TalentGraph. Derived data is labeled as machine-generated wherever it appears.

04How Our AI Agents Process Interview, Screening, and Voice Data

Our five agents (Nova Recruiter, Signal Screening, Voice Outreach, TalentGraph, and Beacon Sourcing) run a defined pipeline. Audio and video are transcribed, the transcript is compared against criteria the customer derived from the job description, and the agent returns a structured score per criterion with the supporting quote from the transcript. The raw media, the transcript, and the score stay linked so a human can always check the evidence behind a number.

Novexhire does not train foundation models on customer or candidate data. Model providers we use are engaged under zero-retention terms, meaning prompts and outputs are not stored by the provider or used for provider model training. We improve our own scoring rubrics using aggregated, de-identified statistics only, and a customer may opt out of that in writing.

Agent output is a recommendation, never a decision. The platform is configured so that no candidate can be rejected, advanced, or ranked out of a process by an agent acting alone. A named human user must confirm each stage change. We publish annual bias audit results for the Nova Recruiter and Signal Screening scoring models in line with NYC Local Law 144, maintain technical documentation and human oversight records aligned to the EU AI Act obligations for high risk employment systems, and give customers the audit summary they need for their own notices.

• Recording notice is delivered before any interview or call begins, in the candidate's selected language where available.
• Scores are expressed as a rubric result with cited evidence, not as a single opaque number.
• Facial expression analysis, emotion inference, voice pitch scoring, and personality inference are not performed by any Novexhire agent, and customers cannot enable them.
• Customers may disable video capture entirely and run Nova Recruiter as an audio-only or text-only interview.

05Lawful Bases for Processing

Where the GDPR, UK GDPR, or a similar law applies, we and our customers rely on the bases below. When we act as a processor, the customer selects the basis and is responsible for the notice given to candidates; we support that notice with the technical detail in this policy.

Where we rely on legitimate interests, we complete and retain a balancing assessment. Candidates and recruiters may request a summary of the relevant assessment at privacy@novexhire.com.

• Performance of a contract: providing the platform to a customer, administering a recruiter's account, and progressing a candidate through a hiring process the candidate has entered.
• Legitimate interests: outbound sourcing of professional contact data for roles that match a person's stated public experience, service security and fraud prevention, product analytics, and defense of legal claims.
• Consent: recording of interviews and calls where local law requires it, marketing emails, non-essential cookies, and retention of a candidate profile in TalentGraph beyond the applied-for role.
• Legal obligation: retaining recruitment records for anti-discrimination reporting, publishing bias audit results where required, tax and accounting records, and responding to lawful requests.
• Substantial public interest or employment law obligations under Article 9(2)(b) GDPR: processing voluntary diversity data where a customer is required to report it, always in a segregated store.

06How We Use Personal Data

We use the data described above to run the service and nothing further. Concretely, that means matching candidates to open roles, conducting and scoring interviews and screenings, keeping the customer's records in sync with its applicant tracking system, billing correctly, keeping accounts secure, and answering support requests.

We use aggregated statistics, such as median time to first interview across all workspaces, for benchmarking and product research. These statistics cannot be traced back to an individual candidate, recruiter, or customer, and we do not publish per-customer figures without written permission.

• We do not sell personal data, and we do not share it for cross-context behavioral advertising as those terms are defined by the CCPA.
• We do not use candidate data collected for one customer to serve another customer, unless the candidate has separately joined the Novexhire agency talent network and consented to that.
• We do not use interview recordings for marketing, demos, or sales material.

07Sharing and Subprocessors

We share personal data with the customer whose hiring process the candidate has entered, with our subprocessors, and with professional advisers or authorities where the law requires it. Every subprocessor is bound by a written agreement with confidentiality, security, and international transfer terms at least as protective as our own commitments.

The current subprocessor list, including each entity's role, processing location, and transfer mechanism, is published at novexhire.com/subprocessors. Customers subscribed to that page receive at least 30 days notice before we add or replace a subprocessor and may object in writing during that window.

If Novexhire is involved in a merger, acquisition, or sale of assets, personal data may transfer to the acquiring entity. We will give notice on this page and by email to workspace administrators before any such transfer takes effect, and the data stays subject to this policy until it is replaced by a policy that is no less protective.

• Cloud infrastructure and storage providers operating in the United States and the European Union.
• Speech-to-text and large language model providers, engaged under zero-retention terms.
• Messaging and telephony carriers used to deliver WhatsApp, SMS, and voice traffic.
• Payment processing, tax calculation, and accounting providers.
• Customer support ticketing, product analytics, and error monitoring providers.
• Background verification vendors, only where a customer instructs us to initiate a check and the candidate has consented.

08Candidate Rights and Human Review of Automated Decisions

Candidates have rights over their data regardless of where they live. Depending on the applicable law, those rights include access, correction, deletion, restriction of processing, objection to processing based on legitimate interests, portability, and the right to withdraw consent at any time without penalty. Residents of California, Colorado, Connecticut, Texas, Virginia, and other states with comparable laws have equivalent rights, including the right to appeal a refused request.

Anyone assessed with the help of a Novexhire agent may request human review. Write to privacy@novexhire.com with the role and the approximate date. We will identify the workspace, tell you which employer controls the record, and pass the request to that employer's designated contact within five business days. A qualified reviewer at the employer, or a Novexhire recruiter for agency placements, will re-examine the transcript and the evidence behind each score, and you will receive a plain-language explanation of the criteria used.

We answer requests within 30 days, extendable by a further 60 days for complex cases with notice to you. CCPA requests are answered within 45 days. We verify identity before acting, using the email address on the application or a comparable check, and we never charge for a first request. Requests are free unless they are manifestly unfounded or repetitive.

• Request a copy of your data, including your interview transcript and your scores with their criteria.
• Ask for correction of anything inaccurate in your profile, including data collected by Beacon Sourcing from a public source.
• Ask for deletion of your profile from TalentGraph, which removes you from future rediscovery matches.
• Opt out of Signal Screening messages by replying STOP, and out of Voice Outreach calls by telling the agent or by writing to us.
• Lodge a complaint with your local supervisory authority. EU candidates may also contact the Spanish Agencia Espanola de Proteccion de Datos, where our EU representative is based.

09How Long We Keep Data

Retention is set per workspace by the customer within the limits below. Where the customer sets a shorter period, the shorter period wins. Where a legal hold or an open discrimination claim applies, we retain the affected records until the matter closes.

When a retention period ends, records are deleted from production systems within 30 days and purged from encrypted backups within a further 90 days. Deletion is logged and the log is available to the customer.

• Interview video and audio: 12 months from the interview, configurable between 30 days and 24 months.
• Interview transcripts and structured scores: 24 months, configurable between 6 and 36 months.
• Voice Outreach call audio: 90 days. Call transcripts and dispositions: 12 months.
• Signal Screening message threads: 18 months from the last message.
• Candidate profiles in TalentGraph: 24 months from the last candidate activity, after which we ask the candidate to confirm continued storage. No reply means deletion.
• Sourced professional data that never turns into an application: 6 months.
• Recruiter account records: for the subscription term plus 90 days.
• Billing and tax records: 7 years, as required by US federal and state law.
• Security and audit logs: 12 months. Bias audit records: as long as the applicable law requires, currently 3 years under NYC Local Law 144.

10International Transfers and Security

Novexhire operates from the United States with staff in Colombia, Spain, and the Philippines. Data may therefore be accessed from outside the country where it was collected. For transfers of personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, incorporated into our Data Processing Addendum, together with the UK International Data Transfer Addendum where relevant. We complete a transfer impact assessment for each destination and publish a summary on request.

Customers on our EU data residency option have their candidate records, transcripts, and media stored and processed in the European Union, with support access from outside the EU limited to named personnel under documented controls. Customers in the United States are hosted in US regions by default.

We maintain a SOC 2 Type II attestation covering security, availability, and confidentiality, and an ISO 27001 certified information security management system. Data is encrypted in transit with TLS 1.3 and at rest with AES-256. Access to production follows least privilege, requires multi-factor authentication and SSO, and is logged. We run independent penetration tests annually and operate a coordinated disclosure program. Report a vulnerability or a suspected incident to security@novexhire.com.

11Children, Changes, and How to Reach Us

The Novexhire platform is built for professional recruitment and is not directed to children. We do not knowingly collect data from anyone under 16, and customers must not upload records of applicants under 16. If we learn that we hold such data without a valid legal basis, we delete it within 30 days and notify the relevant workspace administrator.

We update this policy when our processing changes. For material changes we post the revised policy here and notify workspace administrators by email at least 30 days before the change takes effect. The effective date at the top of this page always reflects the current version, and prior versions are available on request.

Privacy questions, rights requests, and Data Protection Officer correspondence go to privacy@novexhire.com. You can also write to Novexhire, Inc., Attn: Privacy, 1100 Congress Ave, Suite 1400, Austin, TX 78701, United States, or call +1 (512) 555-0142. Our EU representative for the purposes of Article 27 GDPR is reachable at our Madrid office: Paseo de la Castellana 95, Planta 28, 28046 Madrid, Spain.