Hire Up

ENID

Privacy policy

Hire Up stores account data, master CVs, preferences, screening answers, and application history in Supabase. This data is used to match jobs and run applications at your request.

Processing by other services

CV information and job descriptions are sent to Sumopod using a DeepSeek model to extract and tailor documents. When an application is submitted, the required data is shared with the destination employer and its recruitment system. Those providers' policies apply to processing in their services.

Gmail and application verification

Connecting Gmail is optional and requests read-only access. This Google permission technically covers reading email; Hire Up restricts searches to Greenhouse security-code emails for the recipient, employer, and application currently being processed. The app does not send, modify, delete, or mark emails as read. Email contents and codes are not given to the AI model, used for advertising, or sold.

Connection tokens, manually entered codes, and browser session snapshots are encrypted on the server. Codes and session snapshots are deleted after processing finishes or the session expires, within 15 minutes while the worker is active. When the worker stops, cleanup resumes when it becomes active again. Tokens are retained until the connection is removed or the account is deleted. Disconnect Gmail in Settings to remove the stored token and request revocation of Google access. Access can also be revoked in your Google Account settings.

Use of information from the Gmail API follows the Google API Services User Data Policy, including the Limited Use requirements. Google API Services User Data Policy.

Matching email contents are processed temporarily in worker memory, not copied into a mailbox archive. Used message identifiers may remain in verification records to prevent repeated code use. Gmail data is not used to train general-purpose AI models.

You can also revoke access through Google Account third-party connections.

Data controls

You can update your master CV, delete screening answers, pause Autopilot, and cancel applications that have not been processed. Bookmarks are stored in your browser. Permanent account deletion is not yet available as a self-service feature; contact the deployment administrator to request deletion.

Security

Account data is restricted through Row Level Security. The server worker uses service access to process the queue. API keys are not sent to the browser. Avoid entering sensitive information that is not needed for an application.