Skip to main content
Hiretea
Legal & Compliance

Privacy Policy

How we collect, process, and protect your personal information and candidate recruitment data.

Last updated: September 2026

1. Introduction & Overview

Hiretea (“we”, “us”, or “our”) is committed to protecting the privacy of our customers, workspace operators, and candidates who apply for open roles through our platform.

This Privacy Policy explains how personal information is collected, used, disclosed, and safeguarded when you visit our website, register for a workspace, submit an employment application, or participate in a live technical interview. We adhere to global data protection principles, including the General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK).

2. Roles in Data Processing

Workspace Customer (Employer): Acts as the Data Controller for all candidate records, applicant CVs, test responses, and hiring pipeline data managed within their workspace.

Hiretea: Acts as the Data Processor carrying out processing activities solely in accordance with the Customer's instructions and our service agreement. For direct account registration and website visitors, Hiretea acts as a Data Controller.

3. Information We Collect

A. Account & Customer Data

When you create a workspace, we collect your name, business email address, company name, and password hash. Payment and credit card details are collected and processed directly by our Merchant of Record, Lemon Squeezy; we do not store full payment card numbers on our servers.

B. Candidate & Applicant Data

When candidates submit an application for an open role, we process:

  • Full name, email address, phone number, and location details.
  • Resumes (CVs), cover letters, portfolio links, and screening answers.
  • Source code commits, branches, and diffs submitted for repository challenges.
  • Automated assessment scores, written question ratings, and evaluator rubrics.
  • Consent snapshots captured at the exact moment of public application submission.

C. Live Video & Audio Interview Data

When interviewers and candidates join a Hiretea Live video room, our WebRTC infrastructure processes real-time media streams (camera video, microphone audio, screen sharing) and signaling metadata (participant identities, connection status, data channel chat messages).

Interview media is relayed in real time only: video and audio streams are transmitted with transport encryption and are never recorded, stored, or persisted. Hiretea Live does not currently offer a recording feature, and no interview recordings exist on our infrastructure. Screen sharing content is likewise forwarded live and not captured.

4. How We Use Information

We use the collected information for the following purposes:

  • To provision and administer customer workspaces and user authentication.
  • To process candidate applications, maintain stage progression history, and facilitate hiring decisions.
  • To execute candidate challenge tests inside isolated, sandboxed runner containers.
  • To generate advisory AI candidate summaries and code review proposals when requested by workspace operators.
  • To maintain immutable audit trails of all sensitive hiring actions (stage transitions, offer generations, data views).

5. Subprocessors & Third-Party Sharing

We never sell, rent, or monetize your candidate or company data. We share data only with verified subprocessors strictly required to operate our service:

  • Lemon Squeezy: Billing, tax compliance, invoicing, and Merchant of Record services.
  • AI Evaluation Providers (OpenAI / OpenRouter): When a workspace operator requests an AI candidate summary or code review proposal, the relevant candidate data (such as resume content or challenge code) is sent to these providers solely to generate that output. These providers are contractually prohibited from using submitted data to train their models, and we do not send candidate data to AI providers unless the operator explicitly requests the generation. AI outputs are advisory only and hiring decisions remain with the workspace operators.
  • Live Video Conferencing (LiveKit): We operate LiveKit, an open-source WebRTC selective forwarding unit (SFU), on our own infrastructure. Live interview media is relayed in real time through our servers and is never routed through or shared with a third-party video conferencing provider.
  • Cloud Hosting & Storage: Encrypted database and S3-compatible file storage providers.
  • Email Delivery (SMTP/IMAP): Transactional email delivery for interview calendar invites and notifications.

6. Data Retention & Erasure

Candidate data is retained in accordance with the retention periods configured by the respective workspace administrator (e.g., 180 days, 365 days). Once a candidate record exceeds the configured retention window, it is automatically marked for purge or queued for human compliance review.

Candidates may request the deletion, rectification, or export of their data at any time by contacting the hiring company or using the privacy compliance link provided in their confirmation emails.

7. Security Standards

We employ defense-in-depth technical and organizational measures, including TLS 1.3 encryption in transit, AES-256 encryption at rest, isolated per-workspace database row partitioning, strict least-privilege API token scopes, and sandboxed Docker containers for code execution.

8. Contact

For any questions, data subject requests, or privacy compliance inquiries, please contact us at:

Email: [email protected]