Privacy policy

1Who we are

HireMagic is a hiring product of ShareSign, Inc. ("HireMagic", "we"). This policy says who is responsible for which data, and what we do with it.

Candidates' data. When a company uses HireMagic to take applications, the company is the controller of its candidates' data. It decides why the data is collected and how long it is kept. ShareSign, Inc. is its processor and handles the data only for the company, on its instructions.

Account holders and visitors. For the people who create a HireMagic account, use the app, visit this website or ask for a demo, ShareSign, Inc. is the controller.

If you applied for a job. Go to the company you applied to first. It decides how your application is used and can answer you. Its privacy policy is linked from its application form or careers page where the company has added one. If you write to us instead, we will pass your request to the company, because we cannot decide it for them.

2What data we collect

Candidates' data, which a candidate gives the company through its application form, and which the company's team then adds to:

• Name, email address and the other contact details the form asks for.
• A CV (PDF, DOC or DOCX) and the answers to the company's questions.
• Notes, feedback and ratings from the company's team, and the steps of the hiring process the application has reached, with who moved it and when.
• Interview times, offers and the candidate's replies to them.
• The emails sent to the candidate through HireMagic, and the date, time and exact wording of the consent the candidate gave.

Account holders' data:

• Name, email address and sign-in details, held by our sign-in provider.
• The company's name, settings, jobs, team members and the email templates it writes.
• Careers page content: text, logos and photos. A page may show photos of named members of staff. The company is responsible for having their agreement.
• Records of what you do in the app that the company needs, such as moving a candidate between steps.

Visitors' data:

• If you use the contact form: your name, email address, the topic and message, and a scrambled (hashed) form of your IP address, which is used only to limit how many messages one sender can leave in an hour. We also email the message to our own team.
• If you ask for a demo: your name, email address, company, how many people you hire a year and the countries you hire in. We also email these details to our own team.
• If you write to us: your message and your address.
• Our hosting provider handles the technical details of each request, such as the network address, so that the site works and can be kept secure.

3Why we use it

For candidates' data, a company uses it to assess candidates for the job they applied for and similar roles, and to run its hiring. We handle it only to provide HireMagic to that company and to follow the law.

For account holders and visitors, we use data to:

• run your account and keep it secure (to carry out our contract with you);
• answer demo requests and support messages (to take steps you ask for, and in our interest in running the business);
• send the emails the product depends on, such as sign-in codes and notices about your account;
• keep records the law requires, and deal with legal claims.

We do not sell personal data. We do not use it for advertising, and we do not use candidates' data to train models. HireMagic does not score, rank or reject candidates automatically. People at the hiring company make those decisions.

4How long we keep it

Each company chooses how long it keeps applications. The default is 12 months. The clock starts when an application is rejected or withdrawn, or when its job is closed while the application is still open. If a candidate submits an email-verified update, the period runs from that update or closure, whichever is later. Updating details does not reopen the hiring process. When the period ends, HireMagic deletes the application, its retained submissions and CVs, and the candidate's details if they have no other applications. Candidates see the period on the application form before they apply. See Privacy and security for how this works.

An application for someone who is hired is not deleted by this process. It stays with the company as part of their employment record, under the company's own rules.

Unverified drafts have a ten-minute verification window and do not appear in the hiring team's application list. Routine cleanup after expiry removes the draft and any CV no retained submission refers to.

A company can also delete a candidate's data at any time, for example when the candidate asks. That removes the candidate's applications, CVs, notes, feedback, offers and emails about those applications.

Interviews booked through TimeWiz are held by TimeWiz as well. When an application is deleted, HireMagic sends TimeWiz a request to delete the interview, and TimeWiz applies its own rules to what it keeps.

Account data is kept while the account exists. If a company asks us to close its account, we delete its jobs, applications and CVs within 30 days of the request, unless the law requires us to keep something. Closing an account is done by hand on request, through the contact form. Demo requests are kept until we delete them or you ask us to. Messages sent through the contact form are deleted 12 months after they arrive.

5Who we share it with

Inside a company, only people on its team can open applications and download CVs. CVs are not public. We share data outside HireMagic only with the companies below, which handle it for us and for the hiring company, and with the people the company chooses: for example, a candidate receives emails the company sends. We may also disclose data where the law requires it.

Each supplier holds a data processing agreement with us and, where it operates outside the EEA or the UK, standard contractual clauses.

Vercel

Purpose: Hosting and delivery of the site and the app.Data: Requests, and application data in transit.Where: The application runs in the EU (Frankfurt), beside the database. Pages and files are delivered through Vercel's network, which has locations worldwide. Vercel is a United States company.

Neon

Purpose: Database.Data: Account, company, job, candidate, application, offer and email records.Where: EU (Frankfurt) for the primary database.

Cloudflare R2

Purpose: Storage for files.Data: CVs, company logos, and photos on careers pages.Where: European Union.

Amazon Web Services

Purpose: Virus scanning of CVs.Data: The contents of a CV, and nothing else: no name, company or candidate. The scanner keeps nothing after it answers..Where: EU (Frankfurt).

Clerk

Purpose: Sign-in and identity for HireMagic accounts.Data: Name, email address, sign-in credentials, sessions.Where: United States.

Resend

Purpose: Sending email, such as application receipts, interview invitations, offers and sign-in codes.Data: Recipient names and email addresses, and the text of each email.Where: United States; messages are delivered from the EU (Ireland).

Stripe

Purpose: Payments. HireMagic does not take payments yet. Stripe will be used once paid plans go on sale..Data: Billing details, and card data, which only Stripe holds.Where: United States, with EU entities.

HireMagic can book interviews through TimeWiz, another product of ShareSign, Inc.. When a company chooses that, details of the interview, such as the time, the job and the names and email addresses of those taking part, are shared with TimeWiz.

We will announce a new supplier on this page. We email company owners at least 30 days before a new supplier starts handling data of an existing company.

6Where it is stored

The application and database run in the EU, in Frankfurt. Files are stored in the European Union. CVs are scanned for viruses in Frankfurt. Pages are delivered through Vercel's network, which has locations worldwide.

ShareSign, Inc. is a United States company, and some suppliers are in the United States. Where data goes outside the EEA or the UK, transfers rely on adequacy decisions or on the European Commission's standard contractual clauses, with the UK addendum.

7Cookies

Visitors and candidates are not given cookies by HireMagic. When team members sign in, our sign-in provider sets the cookies needed to keep them signed in. We use no advertising cookies and no analytics cookies.

HireMagic can record which link brought a visitor to the site in a cookie. That cookie is switched off, and no such cookie is set. If we switch it on, we will ask for consent first and change this policy.

8Your rights

Depending on where you live, you may be able to see the data held about you, correct it, have it deleted, object to or restrict how it is used, and complain to a data protection authority. For candidates' data, these rights are used against the company that is the controller, so start with that company. Where we hold data as a processor, we help the company answer.

For data we hold as the controller, or if you are not sure who to ask, use our contact form. We reply within 30 days. There is no settings page for this yet, so requests are handled by hand.

You can also complain to the data protection authority in your country. We would like the chance to put things right first.

9Changes to this policy

If we change this policy in a way that matters, we will update this page and tell account holders by email. The date at the top of the page is the date of the current version.

10Contact and complaints

For anything about privacy, use our contact form. To report a security problem, use our contact form for security reports. For anything else, use our contact form. You can read the terms of service too.