Privacy and security

Candidate data, kept with care and then deleted

People trust you with their CV, their contact details and their answers when they apply. This page explains what HireMagic does with that information, how long it is kept, and how it is deleted.

How long data is kept

Each company chooses how many months to keep applications. The clock starts when an application is rejected or withdrawn, or when its job closes. A later email-verified update starts a fresh retention period without reopening the hiring process. Candidates see this rule on the application form before they apply.

An application kept for 12 months, the example setting

Day 1AppliesSees the retention period and agrees to it.
Weeks laterJob closesOr the application is rejected or withdrawn.
12 monthsKeptVisible to your team, for this and similar roles.
ThenDeletedApplication, CV and details.

The timeline above assumes no later verified update. Earlier submissions and CVs follow the same retention period. If someone is hired, their application stays with the company as part of their employment record.

An unverified draft has a ten-minute verification window. It is kept out of the hiring team's application list and removed, with any unused CV, during routine cleanup after the window expires.

How data is deleted

Automatically: When the retention period ends, the application, the CV file and the candidate’s contact details are deleted. You do not need to remember to do it.
On request: A candidate can ask the company to delete their data. The company opens their application and chooses to delete it. That removes their applications, CVs, notes, feedback, offers and the emails sent about them. A candidate who writes to HireMagic is sent back to the company, which decides.
If you leave: When a company closes its account, its jobs, applications and CVs are deleted within 30 days of the request, unless the law requires us to keep something. There is no button for this yet: the company asks by email and we do it by hand.

What candidates agree to

Every application form ends with a consent box, written in the language of the job. It names your company, links to your privacy policy and states your retention period. Here is the wording, shown for a company called Harbour Street Coffee that keeps applications for 12 months. It is an example:

“I agree that Harbour Street Coffee may store and process my application to assess me for this and similar roles, as described in its privacy policy. Harbour Street Coffee will delete it 12 months after it closes or after my latest email-verified update, whichever is later, unless I am hired.”

HireMagic records the date, time and exact wording each candidate agreed to, and shows it on their application.

Who can see what

Only people on your team can open applications and download CVs. Candidates’ CVs are never public.
Your team signs in through Clerk, our sign-in provider. Candidates do not need an account.
Owners can change settings and add colleagues. Members can see jobs and candidates.
Every move of a candidate between hiring steps is recorded, with who made it and when.

Accessibility

Every careers page and application form is built to meet WCAG 2.2 at level AA. That includes text contrast of at least 4.5 to 1, visible focus for keyboard users, touch targets of at least 44 pixels, labels on every field, and error messages that say what to do next.

Your brand colour is checked automatically. If it is too pale for text, HireMagic uses a darker shade of the same colour for links and buttons, so the page stays readable without you having to change your brand.

Where data is stored and who handles it

Hosting: Vercel runs the app in Frankfurt, in the EU.
Database: Neon, in Frankfurt.
Files: CVs, logos and photos are kept in Cloudflare R2, in the European Union.
Virus scanning: Each CV is checked for viruses by a scanner run on Amazon Web Services in Frankfurt. The scanner is sent the file and nothing else, and keeps nothing. An infected file is refused and deleted. If the scanner cannot be reached, the application is still accepted and the CV is checked on the next daily run.
Run by: ShareSign, Inc. runs HireMagic. For candidates' data the hiring company is the controller and we are its processor.

Vercel: Purpose: Hosting and delivery of the site and the app.Data: Requests, and application data in transit.Where: The application runs in the EU (Frankfurt), beside the database. Pages and files are delivered through Vercel's network, which has locations worldwide. Vercel is a United States company.
Neon: Purpose: Database.Data: Account, company, job, candidate, application, offer and email records.Where: EU (Frankfurt) for the primary database.
Cloudflare R2: Purpose: Storage for files.Data: CVs, company logos, and photos on careers pages.Where: European Union.
Amazon Web Services: Purpose: Virus scanning of CVs.Data: The contents of a CV, and nothing else: no name, company or candidate. The scanner keeps nothing after it answers..Where: EU (Frankfurt).
Clerk: Purpose: Sign-in and identity for HireMagic accounts.Data: Name, email address, sign-in credentials, sessions.Where: United States.
Resend: Purpose: Sending email, such as application receipts, interview invitations, offers and sign-in codes.Data: Recipient names and email addresses, and the text of each email.Where: United States; messages are delivered from the EU (Ireland).
Stripe: Purpose: Payments. HireMagic does not take payments yet. Stripe will be used once paid plans go on sale..Data: Billing details, and card data, which only Stripe holds.Where: United States, with EU entities.

For the full legal detail, read our privacy policy. To report a security concern, use our contact form for security reports. For questions about personal data, use our contact form.