Privacy Policy

We handle data about two groups of people, and our role differs between them. Knowing which one applies tells you who to ask about your data.

• For ACCOUNT HOLDERS — recruiters and employers who sign up — we are the controller: we decide what we collect and why.
• For APPLICANTS who respond to a vacancy, the employer who published that vacancy is the controller. We are their processor and act only on their instructions.

If you applied for a job and want your data removed, the fastest route is the employer. You can also write to us and we will act on it and tell the employer.

Account holders:

• email address, and either a password hash or an identifier from the sign-in provider you used;
• name and company name, if you give them;
• country, interface language and billing region;
• payment records: dates, amounts, statuses, the payment identifier from the payment provider, and a label for a saved card such as "•••• 4242" — never the full card number;
• technical data: IP address, timestamps, browser information.

Applicants:

• name, email address and phone number;
• the CV file and the text extracted from it, including work history, education, skills and links;
• answers to the employer's screening questions;
• the assessment produced for the employer: score, category and written comments;
• the fact, date, time and IP address of the consent given when applying;
• the status of the application.

We do not ask for special categories of data — health, beliefs, biometrics, criminal records. If a CV contains such information because the applicant chose to include it, it is processed only as part of the CV.

• to provide the Service and keep your account working — performance of our contract with you;
• to receive applications and confirm that the email address belongs to the applicant — the employer's instructions and the applicant's consent;
• to produce the automated assessment — the employer's instructions;
• to send transactional email about new applications and decisions — performance of the contract and the employer's instructions;
• to take payment and keep accounting records — legal obligation;
• to keep the Service secure, detect abuse and rate-limit requests — our legitimate interest in a service that stays up and is not abused.

Databases and CV files are stored in Ireland (Dublin). We use sub-processors in these categories:

Cloud database provider

database and file storage — Dublin, Ireland

Hosting provider

application hosting and request handling

Email delivery service

transactional email delivery

AI model providers

processing de-identified CV text and answers to produce an assessment; data is not used to train their models

Payment service YooKassa (YooMoney)

payment processing for customers in Russia and Belarus; card details go to the payment provider, never to us

AI model providers may process de-identified applicant information in other countries, including countries without an adequacy decision. Applicant data goes to them only with the applicant's explicit consent, which covers this transfer and is signed by entering the code we email; without it, nothing is sent to the models. The names of our sub-processors are available on request at support@hrmate.app. We are established in the Russian Federation, so data stored in Ireland is accessible to us from there; access is limited to what is needed to operate and support the Service. We do not sell personal data and do not share it for anyone else's advertising. We disclose data to authorities only where a valid legal request requires it.

• account data — while the account exists and for up to three years after it is closed, unless the law requires otherwise;
• unconfirmed applications, where the email was never verified — up to 24 hours, then deleted together with the uploaded CV;
• email confirmation codes — 15 minutes, stored only as a hash;
• applicant data — until the purpose is met, consent is withdrawn, the employer deletes it or the vacancy is removed; never longer than the employer's account;
• payment records — for the periods required by tax and accounting law.

Wherever you live, we will act on a request to access, correct, delete or export your personal data, to object to processing or to withdraw consent. Where you are an applicant, we pass the request to the employer as controller and act on our side as well.

Write to support@hrmate.app from the address you used in the Service. We answer within thirty days. If we cannot act on a request, we will tell you why.

The Service scores applications automatically and shows the result to the employer. That score is advisory. We do not make decisions about applicants, and our terms require employers not to decide solely on the basis of automated processing. Personal data is not used to train artificial-intelligence models.

Before assessment, the applicant's name, contact details, school name and graduation year are removed, so the model receives nothing that identifies the person or their age. Criteria, weights and the calculation are published in the scoring methodology: hrmate.app/legal/scoring.

• HTTPS for all traffic between the browser and the Service;
• row-level isolation in the database: an account can read only its own data;
• CV files kept in a private bucket and served through short-lived signed links;
• passwords and confirmation codes stored only as hashes;
• rate limits on the application and confirmation forms;
• data minimisation — we do not ask for what an application does not need.

We set only the cookies the Service needs: your sign-in session and your language choice. We do not use advertising cookies. Our web analytics is aggregate and does not build a profile of you.

One exception applies to the Russian-language version of the site (addresses beginning with /ru). There, we ask for your consent before loading a Yandex.Metrica counter operated by YANDEX LLC. Until you accept, the counter’s script is not loaded and none of its cookies are set. If you accept, it sets its own cookies and collects pseudonymous visit data: page address, referrer, device and browser type, approximate location from your IP address, and clicks. Session recording is switched off, and the counter is never present in the employer dashboard or on any page in English. You can withdraw your consent at any time through the “Cookie settings” link in the footer of the home page.

We may update this policy; the current version and its date are always on this page, and we email account holders about significant changes.

Service

HR Mate, hrmate.app

Email

support@hrmate.app