Privacy Policy

1. Scope and Who We Are

This Policy applies to personal information collected through right4hire.com, our mobile applications, our APIs, and services operated by us (collectively, the “Sites”). The Sites are owned and operated by Spark Fire Technologies LLC, which is the data controller for personal information processed on the Sites, except where this Policy identifies a different entity.

Where we provide services to employers — such as hosting employer-managed job postings, operating applicant pipelines on an employer’s behalf, or scheduling and relaying interviews — we act as a service provider or processor under U.S. and EU/UK law for data the employer provides or directs us to process. In those cases, the employer is the controller or business and you should contact the employer first for data-rights requests concerning data they hold.

This Policy does not apply to third-party sites that link to or from the Sites, to services we do not control, or to our relationships with our own employees and contractors (which are covered by a separate internal policy).

2. Important Definitions

Candidate

Any natural person who creates an account with us to search for a job, create or upload a resume, apply to a position, attend an interview, or receive employer messages.

Employer

Any business, organization, or authorized representative that creates an organization on Right4Hire, is verified by us, posts a job, reviews applicants, schedules interviews, or sends offers.

Personal Information / Personal Data

Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. “Personal Data” is used synonymously under the GDPR/UK GDPR.

Sensitive Personal Information / Special Category Data

Government identifiers; precise geolocation; racial or ethnic origin; religious or philosophical beliefs; union membership; genetic data; biometric data processed to uniquely identify a person; data concerning health; data concerning a natural person’s sex life or sexual orientation; the contents of personal communications; and account log-in credentials.

Controller / Business

The entity that determines the purposes and means of processing personal information.

Processor / Service Provider

The entity that processes personal information on behalf of a controller or business and only on documented instructions.

Spot2Meet Meeting

A video or audio interview arranged through our Spot2Meet adapter, where a candidate and an employer representative meet. Recording is off by default and only enabled with explicit, documented consent of every participant required by law.

Resume Assist™

Our candidate-side feature that extracts text from an uploaded resume, offers spelling, grammar, and style suggestions through a self-hosted LanguageTool service, and generates bounded design variants for the candidate to accept or reject.

3. Information We Collect

We collect personal information in three ways: directly from you, automatically through your use of the Sites, and from third parties.

3.1 Information you provide to us

• Account registration: name, email address, password hash, display name, country, role (candidate or employer), and (for employers) organization legal name, DBA, website, country, and authorized representative.
• Candidate profile: headline, summary, phone, location, LinkedIn URL, portfolio URL, work experience, education, credentials and certifications, skills, media (images, video, audio, documents), visibility preferences, and consent version.
• Resumes and supporting documents: PDF or DOCX files you upload, their parsed text, Resume Assist™ suggestions, accepted or rejected revisions, and exported versions.
• Applications: job identifier, cover letter, screening answers, the resume version you selected for that application, and withdrawal if you choose to withdraw.
• Interview content: scheduling details (time, timezone, consent status), participant metadata, and recordings only when every legally required participant has given explicit informed consent.
• Verification evidence (employers): legal name, DBA, website, country, authorized-representative name, and any supporting documents you submit (business registration, EIN, officer identification). Employer verification is manual review performed by our compliance team.
• Communications: messages you send to another user through the Sites, support requests, email replies, survey responses, and any files you attach.
• Payments (if applicable): billing contact and the payment-method identifier returned by our payment processor. We do not store full card numbers.

3.2 Information we collect automatically

• Device and connection: IP address, user agent, device type, operating system, browser language, time zone, screen size, and referring URL.
• Usage: pages viewed, buttons clicked, search terms, jobs viewed, applications submitted, time spent, and error logs.
• Cookies, pixels, and local storage: session identifiers, CSRF tokens, authentication state, preferences, and limited analytics. See our Cookie Policy.
• Approximate location: derived from IP address (country, region, city). We do not collect precise GPS location from the web experience. If a future mobile app collects precise location, it will ask for your explicit permission.

3.3 Information we receive from third parties

• Single sign-on providers you choose to use (name, email, OIDC subject).
• Background-check providers when an employer has engaged such a provider and you have granted written authorization and consent through the FCRA workflow (see §9).
• Public business registries we consult to verify an employer’s legal existence.

4. How We Use Information

We use personal information to:

• Create and maintain your account, authenticate you, and keep the Sites secure.
• Operate candidate and employer features: profile management, resume library, job search, applications, saved jobs, job alerts, interview scheduling, offers, and messaging.
• Analyze a resume you upload through Resume Assist™ and present spelling, grammar, and style suggestions you can accept or reject. We do not silently rewrite resume content.
• Generate bounded, ATS-safe design variants from a cryptographically random seed you own. An original, unmodified copy of your resume is always preserved and downloadable.
• Facilitate interviews through the Spot2Meet adapter and record only when all legally required consents are on file.
• Verify employer business status so candidates can trust the postings they see.
• Prevent fraud, enforce our Terms, respond to security incidents, and defend legal claims.
• Comply with legal obligations and respond to lawful requests from governmental authorities.
• Improve the Sites through aggregated and de-identified analytics.
• Communicate with you about your account, applications, interviews, offers, service changes, and (where you have consented) marketing.

We do not use your personal information to make automated adverse employment decisions. Employers must make their own hiring decisions. Any ranking or matching signal we show an employer is a sortable aid, not a decision. See §7 for more.

5. Legal Bases for Processing (GDPR / UK GDPR)

Where European law applies, we rely on the following legal bases:

• Contract (Art. 6(1)(b)) — to provide the Services you have requested and to administer your account.
• Legitimate interests (Art. 6(1)(f)) — to keep the Sites secure, prevent fraud, improve the Services, and defend legal claims.
• Consent (Art. 6(1)(a) and Art. 9(2)(a)) — for optional demographic information, interview recordings, marketing communications, non-essential cookies, and other elective features.
• Legal obligation (Art. 6(1)(c)) — to comply with tax, employment, and consumer-protection laws.
• Vital interests (Art. 6(1)(d)) — in rare cases where processing is necessary to protect someone’s life or safety.

6. Who We Share Information With

We share personal information only in the ways described below. We do not sell your personal information for money.

• Employers you apply to. When you submit an application, we transmit the application, the specific resume version you selected, your cover letter, and your answers to the employer’s screening questions. The employer becomes a controller of that data and will handle future data-rights requests about it directly.
• Candidates (through employer actions). When an employer messages you, invites you to an interview, or sends an offer, we deliver that content to you and record metadata (timestamps, consent status).
• Service providers / processors. We use vetted third parties for cloud infrastructure, email delivery, object storage, grammar engines, meeting facilitation, error logging, and background-check facilitation. Each is bound by a written data-processing agreement that limits what they can do with your information.
• Public business registries for employer verification.
• Successors. In the event of a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets, personal information may be transferred as part of the transaction, subject to a continuation of this Policy.
• Law enforcement and legal process. When required by law, subpoena, court order, or other valid legal process, or when we believe disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of others.
• With your consent. For any other purpose, with your explicit consent.

We do not provide personal information to data brokers for monetary consideration, and we do not use personal information to train external third-party AI models. See Your U.S. Privacy Rights for the full opt-out framework.

7. Automated Processing, Profiling, and AI

We use software to parse resumes, suggest grammar corrections (Resume Assist™), match candidates to roles based on tags and search filters, and detect fraudulent activity. These are decision-support tools, not decision-makers.

• Resume Assist™ suggestions require your explicit accept/reject per change.
• Design variant generation uses a cryptographically random seed that you can regenerate.
• Employer search sorting is driven by filters the employer enters; we do not inject hidden ranking signals derived from protected characteristics.
• We do not sell applicant-ranking black-box scores to third parties.
• You may object to automated decision-making to the extent it produces legal or similarly significant effects on you by writing to [email protected].

Right4Hire follows the fair-hiring principles reflected in Title VII, ADA, ADEA, the EEOC Uniform Guidelines on Employee Selection Procedures, and emerging state laws governing Automated Employment Decision Tools (AEDTs). We do not use arrest-only records, protected characteristics, or inferred demographics as decision inputs.

8. Interview Recordings and Consent (Spot2Meet)

Spot2Meet rooms used for Right4Hire interviews default to recording off. A recording may be enabled only after each legally required participant has given explicit, informed, and documented consent. In two-party-consent jurisdictions, that means every participant; in one-party jurisdictions, it still means every participant when the interview is organized by Right4Hire.

• Consent is recorded with a timestamp, policy version, IP address, and user agent.
• Consent can be revoked at any time. Revocation stops future recording and invalidates future access to any existing recording for the party who revoked.
• Recordings are stored encrypted at rest, access is role-based, and retention is bounded (default 90 days unless the parties agree in writing to a longer retention).
• Right4Hire never sells, licenses, or exposes recordings for advertising or AI training.

9. Background Checks and Screening (FCRA, EEOC, Fair-Chance Laws)

Where an employer requests a background check through Right4Hire, we only facilitate the process using a qualified consumer reporting agency (CRA). Before any report is procured about you:

• You receive a clear and conspicuous written disclosure in a document consisting solely of the disclosure.
• You provide written authorization.
• Any pre-adverse action and adverse action notices follow the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.), including a copy of the report and a summary of your rights under FCRA.
• We follow EEOC guidance on the use of arrest and conviction records in employment decisions, applicable fair-chance (ban-the-box) laws, and state-specific caps on how far back a report may reach.
• Arrest records that did not result in conviction are never treated as proof of misconduct.

We do not perform indiscriminate name-based scraping of arrest records. You may dispute inaccurate information in a report by contacting the CRA directly; the CRA’s contact information is provided in the pre-adverse action notice.

10. Retention

We retain personal information only as long as necessary for the purpose we collected it or as required by law.

• Account data: for the life of your account plus 24 months after closure, then deleted or anonymized, except where law requires a longer period.
• Applications and submitted resume versions: for 24 months after the associated job is closed. The historical snapshot of your submitted resume cannot be altered after submission.
• Interview recordings: 90 days by default; may be extended by written agreement.
• Verification records: for the life of the organization’s account plus 7 years to meet audit obligations.
• Audit logs: up to 7 years for compliance review.
• Backups: up to 90 days.

11. Security

We take reasonable administrative, technical, and physical safeguards to protect personal information, including: TLS 1.2+ in transit, encryption at rest for private object storage, bcrypt password hashing, PostgreSQL row-level security, per-tenant database query scoping, least-privilege service identities, short-lived presigned upload/download URLs, malware scanning on uploads, CSRF double-submit tokens, rate limiting, pino log redaction, audit logging of all sensitive actions, dependency and container vulnerability scanning, isolated staging and production environments, and tested disaster-recovery procedures. No system is perfectly secure. If we become aware of a breach of personal information that is likely to result in material risk to you, we will notify you consistent with applicable law.

12. International Data Transfers

Right4Hire is operated from the United States. If you access the Sites from outside the United States, your personal information will be transferred to and processed in the United States. Where European law applies, international transfers rely on the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, and transfer impact assessments where appropriate. You may request a copy of the clauses by writing to our privacy address below.

13. Your Rights

Depending on where you live, you may have the following rights:

• Access — obtain a copy of personal information we hold about you.
• Portability — receive your personal information in a structured, commonly used, machine-readable format.
• Correction / Rectification — correct inaccurate or incomplete information.
• Deletion / Erasure — have your personal information erased, subject to legal retention obligations.
• Objection / Opt-Out — object to processing based on legitimate interests or opt out of certain data uses, including sale, sharing for targeted advertising, and profiling with legal effects.
• Restriction — restrict processing in defined circumstances.
• Withdraw consent — at any time, without affecting the lawfulness of processing already carried out.
• Non-discrimination — we will not discriminate against you for exercising a privacy right.
• Appeal — if we deny a request, you may appeal to our Privacy Officer and, if still unsatisfied, lodge a complaint with your state attorney general or data protection authority.

To exercise a right, write to [email protected]or visit the Settings page while signed in. We will verify your identity through your account credentials or, for non-account requests, through documentary identity verification. We will respond within 45 days (CCPA/CPRA, VA, CO, CT) or 30 days (GDPR), extendable once if we need more time.

14. State-Specific U.S. Rights

For a comprehensive view of your U.S. privacy rights — including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia — and to submit a Do Not Sell or Share request, visit our Your U.S. Privacy Rights page. We honor the Global Privacy Control (GPC) browser signal as a valid opt-out where applicable law requires.

We do not currently sell personal information for money. Certain third-party cookies and analytics tools we use may constitute “sharing” for targeted advertising under CCPA/CPRA. The opt-out page lets you turn these off.

15. Children’s Privacy

Right4Hire is not directed to children under 16. In the European Economic Area, the United Kingdom, Switzerland, Turkey, and Ukraine, the Services are intended for users 18 years of age or older. We do not knowingly collect personal information from children. If you believe we have collected information from a child under the applicable age, write to [email protected] and we will delete it.

16. Do Not Track and Global Privacy Control

Right4Hire honors the Global Privacy Control (GPC) browser signal where state law requires. The World Wide Web Consortium’s Do Not Track specification was never finalized; we do not alter site behavior based on legacy DNT headers, but you can achieve the same practical effect using GPC or by configuring your preferences on the Your U.S. Privacy Rights page.

17. Cookies and Similar Technologies

We use cookies and similar storage technologies for essential site operation (session, CSRF, load balancing), analytics (aggregated usage), and feature preferences. The Sites do not run third-party advertising cookies on candidate-facing pages. Full details, including a per-cookie list and the controls you can use in your browser, are in our Cookie Policy.

18. Changes to This Policy

We may update this Policy from time to time. If we make a material change, we will post the updated Policy here with a new “Last updated” date and, where required, email you or display a prominent notice on the Sites for at least 30 days. Your continued use of the Sites after an update constitutes acceptance of the updated Policy.

19. How to Contact Us

Spark Fire Technologies LLC — Operator of Right4Hire.com
Privacy Officer: [email protected]
General support: [email protected]
Postal mail: Right4Hire Privacy, c/o Spark Fire Technologies LLC. (Mailing address available on written request.)

European and United Kingdom users may lodge a complaint with their local data protection authority. California residents may submit complaints to the California Privacy Protection Agency. Residents of other U.S. states may contact their state attorney general.