Privacy Policy

1. Who we are

HirePadi ("we", "us", "our") is a job-search platform operated at hirepadi.com. We help job seekers track applications, match CVs to job listings, and manage their pipeline, and help recruiters and employers publish job listings. For the purposes of applicable data-protection law, HirePadi is the data controller for the personal data described in this policy.

2. Information we collect

• Account data: name, email address, and password (hashed).
• CV / resume data: text content you upload or paste to enable job matching.
• Pipeline data: job listings you save and their application status.
• Recruiter / employer data: if you apply to post jobs on HirePadi, we collect your company name, website, logo, LinkedIn URL, industry, and company size to review your application and, if approved, to publish and administer your job postings.
• Payment data: if you subscribe to a paid plan, our payment processor (Paystack) collects your card and billing details directly on their own secure page — we never see or store your full card number. We retain only your subscription tier, status, and billing history.
• Gmail data (optional): if you connect Gmail, we read limited metadata about messages from companies in your pipeline. See Section 4 for exactly what this includes and where it goes.
• Browser extension data: if you install the HirePadi Chrome extension, it reads job listing details (title, company, description) from LinkedIn pages you have open, in order to save and sync jobs to your pipeline. It does not read or transmit any other browsing activity.
• Cookies and session data: we use essential cookies to keep you signed in and maintain your session. We do not use third-party advertising or tracking cookies.
• Usage data: standard server logs (IP address, browser, pages visited) for security and debugging.

3. How we use information

• To provide and improve the HirePadi service.
• To match your CV against job listings and display a fit score.
• To send email digests and pipeline reports you have opted into.
• To automatically update your pipeline when recruiter replies are detected (Gmail feature, opt-in only).
• To review recruiter applications and moderate job postings before and after publication.
• To process subscription payments and manage your billing.
• We do not sell, rent or share your personal data with third parties for advertising.

4. Gmail and Google API data

The Gmail integration is opt-in and can be disconnected at any time from Settings. Here is exactly what it does:

• What we read from Google: using Gmail's restricted gmail.metadata scope, we read only the sender, subject line, and a short snippet of messages from companies already in your job pipeline. We never read, store, or transmit the full body of any email.
• Where that data goes: the sender, subject, and the company name from your pipeline are sent to Anthropic's Claude API, which classifies the message (e.g. interview invite, offer, rejection, follow-up) and returns a short summary. This is the only external service that receives Gmail-derived text — it is never sent to Voyage AI, which handles only CV and job-description embeddings and never touches Gmail data.
• Where it's stored: the classification result and any resulting pipeline status change are stored in our Supabase database, associated with your account. Gmail access and refresh tokens are also stored there, encrypted at rest.
• What we never do: we never send, delete, or modify your emails, and we never transmit Gmail data to any party other than Anthropic for the classification described above.

This use adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI/ML training: Gmail data — including message metadata, sender information, and any content derived from Gmail — is never used to train, fine-tune, evaluate, or otherwise improve any artificial intelligence or machine learning model, whether operated by HirePadi or by a third-party AI provider such as Anthropic. It is used solely, in real time, to classify recruiter replies for the individual user who granted access.

5. AI and automated processing

Beyond Gmail, HirePadi uses AI to power CV parsing, job matching, tailored CVs, cover letters, interview prep, and digest emails. This is separate from the Gmail data flow above and uses different data:

• Anthropic (Claude): receives your CV text and job descriptions to parse your CV into structured fields, score CV-to-job fit, and generate documents (tailored CVs, cover letters, interview prep, digest emails) at your request.
• Voyage AI: receives your CV text and job descriptions to generate vector embeddings used to find and rank relevant job matches. Voyage does not receive Gmail data, payment data, or recruiter application data.

Under our commercial agreements with these providers, your CV and job data sent to them is processed only to return a result to HirePadi and is not used to train, fine-tune, or improve their underlying models.

6. How we share information / sub-processors

We use the following sub-processors, each solely to provide the function described: Supabase (database hosting for all account, CV, pipeline, and job data), Vercel (application hosting), Resend (transactional email and digests), Anthropic and Voyage AI (AI processing described in Sections 4–5), Paystack (payment processing), and Cloudflare (network-level bot and abuse protection — it sees connection metadata such as IP address, not the content of your CVs, emails, or messages). Each operates under its own privacy policy and a data processing agreement with us. We do not sell, rent, or share your personal data with third parties for advertising.

7. International data transfers

Your data may be processed on servers located outside your country of residence, including in the United States, by the sub-processors listed in Section 6. Where we transfer personal data internationally, we rely on those providers' contractual and technical safeguards (such as standard contractual clauses, where applicable) to protect it in transit and at rest.

8. Data retention and deletion

• While your account is active: account, CV, pipeline, and recruiter data are retained for as long as your account exists.
• On account deletion: deleting your account from Settings → Danger Zone immediately and permanently removes your personal data from our primary database. Gmail access and refresh tokens are revoked and deleted at the same time. A copy may persist briefly in encrypted backups (typically no more than 30 days) before being purged in the normal backup rotation.
• Billing records: transaction and subscription history is retained for as long as required by applicable tax and financial record-keeping law, even after account deletion.
• Fraud-prevention and moderation records: we may retain records of rejected recruiter applications or job postings removed for fraud, spam, or abuse beyond account deletion, to prevent repeat bad actors from rejoining the platform.
• Published job listings: a listing you published may remain visible after your account is deleted, since other users may already have saved or applied to it — but your personal login credentials and any non-public account data are deleted.

You may also request deletion by contacting hello@hirepadi.com.

9. Children's privacy

The Service is not directed to children under 16, and we do not knowingly collect personal data from anyone under 16. If we become aware that we have collected personal data from a child under 16, we will delete it. Contact hello@hirepadi.com if you believe this has occurred.

10. Your privacy rights

You have the right to access, correct, export, or delete your personal data at any time. To exercise these rights, contact us at hello@hirepadi.com.

Nigeria: as a data controller under the Nigeria Data Protection Act 2023, we process your data on the bases described below and you have the right to access, rectify, erase, and restrict processing of your data, and to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

EEA / UK: if you are located in the European Economic Area or the United Kingdom, we rely on the following legal bases to process your data: contract (to provide the Service you signed up for), consent (for optional features like Gmail integration and marketing emails, which you can withdraw at any time), legitimate interests (for security, fraud prevention, and improving the Service), and legal obligation (for billing and tax records). You also have the right to object to or restrict certain processing, to receive your data in a portable format, and to lodge a complaint with your local data protection authority.

California: we do not sell personal information, so there is nothing to opt out of under California law, but you may still request details of what we hold about you using the contact above.

11. Security

We protect your data with: TLS encryption for all data in transit; encrypted storage for OAuth tokens and other credentials; row-level security policies enforced at the database level so a user can only access their own data; and breach notification to affected users and relevant authorities where required by applicable law.

12. Changes to this policy

We may update this policy from time to time. When we do, we will update the "Last updated" date above, and where a change is material we will provide notice — such as an email or an in-app notice — before it takes effect. The latest version is always available at hirepadi.com/privacy.

13. Contact

Questions? Email us at hello@hirepadi.com.