Skip to main content
Hiretea
Legal & Compliance

Privacy Policy

How we collect, process, and protect your personal information and candidate recruitment data.

Last updated: October 2026

1. Introduction & Overview

Hiretea (“we”, “us”, or “our”) is committed to protecting the privacy of our customers, workspace operators, and candidates who apply for open roles through our platform.

This Privacy Policy explains how personal information is collected, used, disclosed, and safeguarded when you visit our website, register for a workspace, submit an employment application, or participate in a live technical interview. We adhere to global data protection principles, including the General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK).

2. Roles in Data Processing

Workspace Customer (Employer): Acts as the Data Controller for all candidate records, applicant CVs, test responses, and hiring pipeline data managed within their workspace.

Hiretea: Acts as the Data Processor carrying out processing activities solely in accordance with the Customer's instructions and our service agreement. For direct account registration and website visitors, Hiretea acts as a Data Controller.

3. Information We Collect

A. Account & Customer Data

When you create a workspace, we collect your name, business email address, company name, and password hash. Payment and credit card details are collected and processed directly by our payment provider; we do not store full payment card numbers on our servers.

B. Candidate & Applicant Data

When candidates submit an application for an open role, we process:

  • Full name, email address, phone number, and location details.
  • Resumes (CVs), cover letters, portfolio links, and screening answers.
  • Source code commits, branches, and diffs submitted for repository challenges.
  • Automated assessment scores, written question ratings, and evaluator rubrics.
  • Consent snapshots captured at the exact moment of public application submission.

C. Live Video & Audio Interview Data

When interviewers and candidates join a Hiretea Live video room, our WebRTC infrastructure processes real-time media streams (camera video, microphone audio, screen sharing) and signaling metadata (participant identities, connection status, data channel chat messages).

Interview media is relayed in real time only: video and audio streams are transmitted with transport encryption and are never recorded, stored, or persisted. Hiretea Live does not currently offer a recording feature, and no interview recordings exist on our infrastructure. Screen sharing content is likewise forwarded live and not captured.

D. Website & Product Analytics Data

When you visit our website or use the hosted platform, we use Google Analytics to understand aggregate usage. It collects standard measurement data such as the pages viewed, visit timestamps, referring pages, approximate geographic region derived from your IP address, and device and browser characteristics. The tag runs under Google Consent Mode: until you accept analytics in the cookie banner, measurement is cookieless and no _ga cookie or client identifier is stored in your browser; after you accept, it additionally relies on first-party cookies (such as the _ga cookie) and similar identifiers stored in your browser.

Public pages of our website are also measured with Umami, a self-hosted, open-source analytics tool that runs entirely on our own infrastructure. Umami is cookieless: it sets no cookies and stores no identifiers in your browser. Page views are recorded with the page URL, the referring page, screen dimensions, browser language and an approximate country derived from your IP address, which is used only for that lookup and is not stored. On these same public pages, sessions may additionally be recorded for replay so we can understand how visitors actually use the site. In those recordings, everything typed into input fields is always masked before anything leaves your browser. The Umami scripts are never loaded on authenticated platform pages such as the dashboard, workspaces, live interviews or assessments, and no data collected by Umami is shared with third parties.

To understand whether visits to our website come from our own advertising on Reddit and to measure the performance of those campaigns, we also use the Reddit Pixel, a first-party measurement tag operated by Reddit. It receives the URL and referrer of the pages you view on our website and stores a pseudonymous identifier in a first-party cookie (such as _rdt_uuid). We do not enable Reddit's advanced matching, so no contact details such as email addresses are shared with Reddit through the pixel.

The same applies to our advertising on LinkedIn: we use the LinkedIn Insight Tag to understand whether visits to our website come from our LinkedIn campaigns and to measure their performance. It receives the URL and referrer of the pages you view on our website and stores a pseudonymous identifier in first-party cookies (such as li_sugr). Like the Reddit pixel, it is not loaded at all until you accept measurement cookies in the banner.

We also use Google Ads (Google Tag) to measure the performance of our own advertising on Google Search and other Google properties. Under Google Consent Mode, advertising cookies and personalization pings are only stored or transmitted after you grant consent in the cookie banner; if you decline, measurement remains cookieless and personalized ad features remain disabled.

Measurement data, including any session recordings, is used only to understand our own website and to measure our own advertising performance. We do not use it for profiling or selling data, and it is never combined with candidate application records.

4. How We Use Information

We use the collected information for the following purposes:

  • To provision and administer customer workspaces and user authentication.
  • To process candidate applications, maintain stage progression history, and facilitate hiring decisions.
  • To execute candidate challenge tests inside isolated, sandboxed runner containers.
  • To generate advisory AI candidate summaries and code review proposals when requested by workspace operators.
  • To maintain immutable audit trails of all sensitive hiring actions (stage transitions, offer generations, data views).
  • To measure aggregate website and platform usage through analytics, and the performance of our own advertising campaigns, so we can improve performance, reliability, and product decisions.

5. Subprocessors & Third-Party Sharing

We never sell, rent, or monetize your candidate or company data. We share data only with verified subprocessors strictly required to operate our service:

  • AI Evaluation Providers (OpenAI / OpenRouter): When a workspace operator requests an AI candidate summary or code review proposal, the relevant candidate data (such as resume content or challenge code) is sent to these providers solely to generate that output. These providers are contractually prohibited from using submitted data to train their models, and we do not send candidate data to AI providers unless the operator explicitly requests the generation. AI outputs are advisory only and hiring decisions remain with the workspace operators.
  • Live Video Conferencing (LiveKit): We operate LiveKit, an open-source WebRTC selective forwarding unit (SFU), on our own infrastructure. Live interview media is relayed in real time through our servers and is never routed through or shared with a third-party video conferencing provider.
  • Cloud Hosting & Storage: Encrypted database and S3-compatible file storage providers.
  • Email Delivery (SMTP/IMAP): Transactional email delivery for interview calendar invites and notifications.
  • Website & Product Analytics (Google Analytics): Aggregated measurement of pages viewed and platform usage on our website and hosted service, as described in Section 3.D. The collected data is limited to usage measurement data (first-party cookies, device and browser metadata, approximate region). Google processes this data on our behalf under Google's Data Processing Terms, and we do not use it for advertising or profiling.
  • Advertising Measurement (Reddit): The Reddit Pixel measures the performance of our own advertising on Reddit, as described in Section 3.D. Only the website visit data described there (viewed pages, referrer, a pseudonymous identifier) is processed, only after your consent, and never candidate or customer workspace data.
  • Advertising Measurement (LinkedIn): The LinkedIn Insight Tag measures the performance of our own advertising on LinkedIn, as described in Section 3.D. Only the website visit data described there (viewed pages, referrer, a pseudonymous identifier) is processed, only after your consent, and never candidate or customer workspace data.
  • Advertising Measurement (Google Ads): The Google Tag measures the performance of our own advertising on Google, as described in Section 3.D. It operates under Google Consent Mode, ensuring advertising cookies and personalization features are active only after your consent, and never accesses candidate or customer workspace data.

6. Data Retention & Erasure

Candidate data is retained in accordance with the retention periods configured by the respective workspace administrator (e.g., 180 days, 365 days). Once a candidate record exceeds the configured retention window, it is automatically marked for purge or queued for human compliance review.

Candidates may request the deletion, rectification, or export of their data at any time by contacting the hiring company or using the privacy compliance link provided in their confirmation emails.

7. Security Standards

We employ defense-in-depth technical and organizational measures, including TLS 1.3 encryption in transit, AES-256 encryption at rest, isolated per-workspace database row partitioning, strict least-privilege API token scopes, and sandboxed Docker containers for code execution.

8. Cookies

Consistent with the KVKK cookie guideline and the EU ePrivacy rules, we ask for your consent before setting any non-essential cookie. We use the following categories:

  • Strictly necessary cookies: Session and authentication cookies required to sign you in, keep you signed in, and protect forms against cross-site request forgery. These are always set and cannot be disabled.
  • Analytics cookies (Google Analytics): First-party measurement cookies such as _ga and _ga_* that store a pseudonymous client identifier for the aggregate usage statistics described in Section 3.D. These are only set after you accept them in the cookie banner. The Google tag itself loads under Google Consent Mode: if you decline, it sends only cookieless pings, sets no analytics cookies, and stores no client identifier.
  • Measurement cookies (Reddit Pixel): A first-party cookie such as _rdt_uuid that stores a pseudonymous identifier so we can measure the performance of our own Reddit advertising (Section 3.D). Like the analytics cookies, it is only set after you accept them in the cookie banner; if you decline, the pixel is not loaded at all and no measurement cookie is created.
  • Measurement cookies (LinkedIn Insight Tag): First-party cookies such as li_sugr that store a pseudonymous identifier so we can measure the performance of our own LinkedIn advertising (Section 3.D). Like the Reddit pixel, the tag is only loaded after you accept them in the cookie banner; if you decline, it is not loaded at all and no measurement cookie is created.
  • Measurement cookies (Google Ads): First-party measurement and conversion cookies (such as _gcl_*) that store a pseudonymous click identifier so we can measure the performance of our own advertising on Google (Section 3.D). Governed by Google Consent Mode, these cookies are only stored after you accept them in the cookie banner; if you decline, the tag operates in cookieless ping mode only.
  • Consent record: A small first-party cookie (hiretea_cookie_consent) that stores your choice for six months, after which we ask again.

Declining analytics and measurement cookies is as easy as accepting them and causes no loss of platform functionality. You can withdraw your consent at any time by clearing cookies for our site in your browser settings; analytics and measurement cookies are then no longer set or read.

Our self-hosted Umami analytics (Section 3.D) is cookieless and sets no cookies at all, so it is unaffected by this choice and keeps measuring the public pages without them either way.

9. Contact

For any questions, data subject requests, or privacy compliance inquiries, please contact us at:

Email: [email protected]