Privacy Policy

1. Information We Collect

We collect information directly from you, automatically when you use our Services, and from third-party Applicant Tracking Systems (ATS) connected to your workspace.

• Account & Recruiter Data: Full name, work email address, company title, agency name, website URL, and workspace configuration preferences.
• Candidate Resume & Intake Data: Resumes, CVs, cover letters, portfolios, job descriptions, screening rubrics, and evaluation criteria uploaded directly via manual file ingestion (PDF, DOCX, TXT) or talent pool batching.
• ATS OAuth Credentials: Encrypted API tokens, account keys, and stage identifiers (e.g., "jj vets" filters) for Spott ATS, Greenhouse, Lever, Workable, and connected Merge endpoints.
• Interview Telemetry & Transcripts: Recorded candidate responses, automated transcription logs, scoring metrics, and AI evaluation feedback generated during interview workflows.

2. How We Use Information & AI Disclosures

Candidate information and workspace data are processed strictly for delivering automated vetting services to your workspace.

NO AI MODEL TRAINING DISCLOSURE: JJ does NOT sell, rent, or cross-train public AI models on your proprietary candidate resumes, internal evaluation rubrics, or workspace hiring pipeline data.

• Parsing and cross-referencing candidate experience against client job descriptions.
• Generating match percentage scores (0-100%), bulleted strength highlights, and qualification gap analyses.
• Compiling ranked candidate slates (Top 3, Top 5, Top 15, Top 20) for shortlisting.
• Synchronizing candidate status updates directly with your authorized ATS endpoints.

3. Data Security & Storage Architecture

We implement enterprise-grade technical and organizational safeguards designed to protect candidate and workspace data against unauthorized access, loss, or alteration:

• Encryption in Transit & Rest: All data transmitted to JJ is encrypted via TLS 1.3. Database records and stored ATS credentials are encrypted at rest using AES-256 bit protocols.
• Database Tenant Isolation: Data isolation between enterprise subscribers is strictly maintained via Supabase Row-Level Security (RLS) policies tied directly to authenticated user UUIDs.
• Access Restrictions: Employee access to customer workspace database records is strictly limited on a need-to-know basis for customer support and system maintenance.

4. Data Retention and Deletion

Subscribers retain full ownership and administrative control over their candidate evaluations and intake history.

• Integration Revocation: Clicking "Clear Credentials" in Profile -> ATS Integrations immediately deletes saved API keys and OAuth tokens from your database row.
• Complete Purge Requests: Account owners may request a complete database purge of historical candidate screening records and evaluation logs at any time by contacting our privacy office.

5. Regional Rights (GDPR, CCPA & International Data Transfers)

Depending on your regional jurisdiction (European Economic Area, United Kingdom, California), you and your candidates maintain statutory rights regarding personal data:

• The right to access, rectify, or update incomplete personal records.
• The right to request permanent erasure ("Right to be Forgotten") of candidate candidate profiles.
• The right to restrict or object to automated data processing.

To exercise any of these rights, please contact our Data Protection Officer at [email protected].

6. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in platform capabilities, legal mandates, or cloud architecture. We will notify registered workspace administrators of material changes via email or in-app notifications prior to enforcement.

7. Contact Privacy Counsel

For privacy requests, data processing agreements (DPAs), or security disclosures, reach out directly to:

JJ Technologies Inc. — Data Protection Office
Email: [email protected]