Privacy Policy | Emploist

1. Who we are

Emploist is an applicant tracking system for businesses, with hosted careers pages and optional AI ranking of applications. Emploist is operated by Navaneeth CT, an individual based in India ("Emploist", "we", "us").

This policy explains how we handle personal data when you use the Emploist app at app.emploist.com, visit emploist.com, apply for a job on a careers page that runs on Emploist, or contact us.

We take questions and requests by email only, at support@emploist.com. Our privacy contact is Navaneeth CT, at the same address.

Grievance Officer (India)

Under India's Information Technology Act and its rules, our Grievance Officer is Navaneeth CT, reachable at support@emploist.com. We'll acknowledge a grievance within 24 hours and resolve it within 15 days of receiving it.

2. What this policy covers

Data protection laws give different responsibilities to different organizations:

A controller decides why and how personal data is used, and is responsible for it.
A processor handles personal data on a controller's behalf and follows its instructions.

Some laws use other words for the same idea. For example, California law says "business" and "service provider", and India's law says "data fiduciary" and "data processor".

Companies that use Emploist ("customers", called "employers" in the section for job applicants) put their own content into it, such as jobs, careers page content and code, application forms, emails, and comments. Applicants send them applications through it, with resumes and answers. Together with the match scores and other records Emploist creates from them, we call this "Customer Data", as our Terms define it. Each customer is responsible for its Customer Data, usually as its controller (a recruiter may act for a client instead), and we process it on the customer's behalf.

If you are	Our role	What applies
A team member using the Emploist app for your company, as an admin or a member	Controller of your account data, such as your name, email address, sign-in records, and billing contact details. Processor for the work you do for your company, such as your comments, which is part of its Customer Data.	This policy. For your company's Customer Data, also our data processing terms with your company.
A visitor to emploist.com	Controller	This policy
A job applicant who applied through a careers page that runs on Emploist	Processor. The employer is the controller of your application.	The employer's privacy notice. Our data processing terms govern how we handle your application for the employer. For job applicants explains how Emploist works.
Someone named in a customer's content, such as a contact in a job description	Processor for the customer	The customer's privacy notice and our data processing terms
Someone invited to join a company's team on Emploist	Controller of the invitation we send and our record of it. The company decides whom to invite.	This policy

Whatever your role, we're the controller of the technical data our servers record to keep Emploist working and secure, such as IP addresses in request logs. This policy covers that data too.

3. For job applicants

This section is for you if you applied for a job through a careers page that runs on Emploist. These pages are at addresses like company.emploist.com, or on the employer's own domain.

The employer is in charge of your application

The employer whose careers page you applied on decides what the form asks, how your application is used, who on their team has access to Emploist, whether AI ranking is used, and how long your application is kept. That makes the employer the controller of your application. Emploist provides the software and handles your application on the employer's behalf. In this section, "employer" means the organization whose careers page you applied on. If that's a recruiter hiring for a client, the client may also be responsible for your application.

So the employer's privacy notice is the one that applies to your application. Please read it, and contact the employer first with any questions or requests about your data. The rest of this section explains how Emploist itself handles your application.

What a careers page collects

Your full name and email address.
Your resume or CV, as a PDF or Word (DOCX) file.
Your answers to the employer's questions. The employer chooses the questions, which can include your phone number.

Emploist also keeps the date you applied, the hiring stage your application is in, and its history. Everyone on the employer's team in Emploist can see your application. They can comment on it, move it between stages, export it, and delete it.

Your IP address and browser details

Your application's record doesn't include your IP address, browser details, or any cookie or device information. We use your IP address briefly, without saving it, to limit how many applications come from one address, which helps keep out spam. But like any website, our servers keep request logs. They record your IP address and browser details when you visit a careers page or apply, and the log entry for your application includes its ID, so the two can be linked. We're the controller of these logs.

Emails about your application

The employer can set up emails that go out when you apply or when your application moves to a new stage, such as an interview invitation or a rejection. The employer chooses which of these emails to send and can change what they say. We send them through our email provider, Resend, from Emploist's sending address, in the employer's name. If the employer has set a reply-to address, your replies go to the employer. If the employer hasn't set a reply-to address, replies can't be delivered, and we don't receive them, so contact the employer directly.

AI ranking

Employers can have Emploist rank applications with AI. It's on by default for new companies, and while the company's Plan is active, the employer's admins can turn it off or on for the whole company. Our Terms require employers that use it to tell you about it. While it's on, Emploist's default careers page shows a notice that AI helps review applications.

When AI ranking is on, we send our AI provider, TypeSafe AI, Inc., in the United States:

the text of your resume (for a very long resume, the first 40,000 characters, and for a PDF, the first 20 pages)
your answers to the employer's questions, except phone numbers
the job's title, department, employment type, and description

We don't send your name and email fields, or the job's location, as separate items. But your resume's text is sent as it is, so whatever it contains, such as your name, contact details, and work history, is sent too.

TypeSafe's AI scores how well your application matches the job on four things: skills, experience, seniority fit, and qualifications. Emploist combines these into a match score, shown as a percentage. Skills and experience count most, then seniority fit, then qualifications. If the job doesn't ask for any qualifications, that part is left out. Your answers can adjust the scores slightly.

The match score is meant to help the employer decide whose applications to review first. The employer's team sees it with your application, and their list of applications is sorted by match score unless they choose another order. The match score never rejects you, moves your application to another stage, or sends you an email by itself. Only people on the employer's team move applications. Like any AI, it can be wrong, so our Terms require employers not to rely on the score alone.

While AI ranking is off, new applications aren't sent to TypeSafe. If the employer turns it back on, its admins can choose to rank the applications that arrived in the meantime.

Emploist keeps the match score and its breakdown with your application. We don't keep the text taken from your resume. It's read from your file each time the application is ranked, and discarded afterwards. How TypeSafe handles the data we send is described in Sharing and subprocessors, and how it's protected in International transfers.

Your choices and rights

Contact the employer if you want to:

object to AI ranking of your application, or ask for it to be reviewed by a person without AI
ask how your application was assessed
access, correct, or delete your data, or use any other right you have

The employer makes these decisions. In Emploist, the employer's team can export a job's applications and delete applications or whole jobs, and its admins can delete the company. Admins can turn AI ranking off for the whole company, but Emploist can't turn it off for a single application. Some requests need our help, which we give when the employer asks by email: correcting the details in an application, which Emploist can't edit, providing match scores, their breakdown, and comments, which aren't in the export, and deleting applications or jobs while the employer's company is read-only.

If you contact us about your application instead, we'll forward your request to the employer and let you know we've done so. We can't decide on the employer's behalf. For the request logs and other data we control ourselves, you can contact us directly. See Your rights.

How long your application is kept

The employer decides. Your application stays in Emploist until the employer deletes it, deletes the job, or deletes its company. Under our Terms, if a company has had no active Plan for 12 months in a row, we may delete it and all its data. We'll email its admins at least 30 days before we do.

A few things can outlast your application, such as a notification about it that someone on the employer's team has already read, which keeps your name and the job title, copies in our backups and logs, and data already sent to TypeSafe or Resend. How long we keep information explains these exceptions.

Careers pages and other websites

Emploist sets no cookies on careers pages, and scripts don't run on them. But an employer can design its own careers page and email design, and these can load images, fonts, or styles from other websites. When your browser or email app loads them, those websites may receive your IP address and browser details, and may set their own cookies. They handle this data under their own policies.

4. Information we collect

This section covers the personal data we handle as controller, and what's part of your company's Customer Data. For applicants' data, see For job applicants.

Account information

Name and email address. If you sign in with Google or Microsoft, we get them from your Google or Microsoft account. If you sign in with a code sent to your email, you type them in.
Sign-in codes. When you sign in with an emailed code, we store a scrambled (hashed) copy of the code with your email address. Codes expire after 5 minutes.

You need to give us your name and email address to use Emploist. Without them, we can't create your account.

Google and Microsoft sign-in

If you sign in with Google or Microsoft, this is how we handle the data they give us:

What we get. Your name, email address, whether your email address is verified, account ID, a link to your profile picture if they send one, and sign-in tokens. Microsoft sign-in also asks for permission to read your basic profile and to keep that access over time, so Microsoft also gives us a long-lived token (a "refresh token"). We don't ask for access to your email, files, calendar, contacts, or anything else in your account.
How we use it. Only to sign you in, recognize you, and show your name and email address in Emploist, for example to your teammates and to people you invite. We don't use the tokens to access your Google or Microsoft account or any data in it, and we don't show your profile picture.
How we store it. With your Emploist account, in the European Union, protected as Security describes, until you delete your account.
Who we share it with. Only as Sharing and subprocessors describes. We don't share the tokens, sell this data, or use it for advertising.
Your controls. You can remove Emploist's access in your Google Account or Microsoft account settings. For a work or school Microsoft account, your organization's administrator may manage this. Removing access doesn't delete your Emploist account or the tokens we've stored. Deleting your Emploist account does. You can also ask us for a copy of this data, as Your rights explains.

What you create for your company

When you set up a company, you add its name and careers page address and, if you like, a logo, a description, and a brand color. Admins can also add a reply-to address for emails to applicants and connect a custom domain. Your logo is public, on your careers page and in emails to applicants.

The work you do in Emploist for your company, such as the jobs you create, the comments you write and the people you mention, and the applications you move, is stored with your name. Your teammates can see your name, your email address, and this activity. All of this is part of your company's Customer Data. Your company controls it, and we handle it on your company's behalf, so it stays with your company if you leave or delete your account.

Invitations

When an admin invites someone, we store the invited person's email address, their role, who invited them, and the invitation's status. We email them a link that expires after 7 days, and we store only a scrambled (hashed) version of the link's secret part. The email and the page it opens show the name of the person who sent the invitation, or their email address if they haven't set a name.

Billing information

Dodo Payments is the reseller and merchant of record for our plan and credit packs. Dodo sells them to customers, takes payment, handles sales tax, and issues invoices.

When an admin first checks out, we send Dodo that admin's email address and the company's name. We don't update that email later, for example if that admin leaves the company.
You enter payment details on Dodo's own pages, and we never receive your full card number. Dodo's messages to us about payments can include billing details, such as the billing address and the last four digits of the card, but we don't store them.
From Dodo, we receive and store your company's Dodo customer ID, your plan's status and dates, and payment IDs that we use to add AI credits. We also keep records of your AI credits and how they're used.
To keep free trials to one per company and per person, we keep a record of the admins of a deleted company that used its free trial.

Security and technical information

Sessions. When you sign in, we create a session with a secret session token, which your browser keeps in a cookie. We record the session with your IP address and your browser's user agent, which describes your browser and device. For IPv6 addresses, we store only the network part, not the full address.
Request logs. Our servers log each request to the app and to careers pages. A log entry includes the IP address, browser details, the page the request came from (if the browser sends it), the address of the page or data requested, and the response's status and headers. Some of these can include applicants' details. A search for an applicant's name in the app puts it in the logged address. When someone on a team opens a resume, its file name, which often includes the applicant's name, is logged with the response. And the log entry for each application received links the applicant's IP address and browser details to the application's ID. We don't log the contents of applications, comments, or uploaded files, and we remove cookies, sign-in secrets, and invitation links from our logs.
Rate limits. We use IP addresses briefly, in memory, to limit how many requests come from one address. These counts aren't saved.

Support

If you email us, we receive your email address, your message, and anything you include with it. Our email inbox provider stores these emails for us.

Visitors to emploist.com

Our website has no analytics, cookies, forms, or third-party scripts. The provider that hosts it receives standard request data, such as your IP address, your browser details, and the page you asked for, in its server logs.

Sensitive information

We don't ask for health, biometric, bank account, or payment card information, and Emploist doesn't ask you to create a password. We do keep some secrets that sign people in, which some laws treat as passwords:

sign-in codes, stored only in hashed form
session tokens, which keep you signed in
Google or Microsoft sign-in tokens, stored with your account
the secret part of invitation links, stored only in hashed form

We use them only to sign people in. Applicants sometimes include sensitive details in their resumes. The employer is responsible for that data.

5. How we use information

We use personal data only for the purposes below. If you're in the European Economic Area (EEA) or the UK, the table also shows the legal basis we rely on.

Purpose	Information used	Legal basis
Providing Emploist: running your account and company, showing your team's work, running careers pages, and sending the emails your company sets up	Account information. We also process your company's Customer Data, including your work for it, as our data processing terms describe.	Legitimate interests: providing the service your company signed up for
Signing you in and keeping Emploist secure: checking sign-ins, keeping sessions, limiting request rates, and preventing and investigating spam and abuse	Account, session, and log information, including IP addresses	Legitimate interests: keeping Emploist, our users, and applicants safe
Billing: running free trials and the plan with Dodo, tracking AI credits, and preventing repeat trials	Billing information and your email address	Legitimate interests: running your company's plan with Dodo, preventing trial abuse, and keeping the tax and accounting records required by the laws that apply to us
Support: answering your questions and requests	Your emails and any account information we need to help	Legitimate interests: helping the people who use Emploist
Service emails: sign-in codes, invitations, and important notices, such as changes to our prices, Terms, subprocessors, or this policy, security incidents, and planned deletion of an inactive company	Name and email address	Legitimate interests: signing you in, letting companies invite their team, and keeping customers informed
Finding and fixing problems and keeping Emploist working, using our logs and support conversations	Log and support information. When these include Customer Data, such as an applicant's name in a search, we use it only to fix problems for the customer.	Legitimate interests: keeping Emploist working well
Running emploist.com	Standard request data, such as IP addresses	Legitimate interests: running and securing our website
Complying with the law, enforcing our Terms, and handling legal claims	Any relevant information	Legitimate interests: complying with the laws that apply to us, such as Indian law, and protecting our rights. Legal obligation, where EU or UK law requires the processing.

If you're personally a party to our contract, we also rely on that contract for providing Emploist, billing, support, and service emails.

Your right to object

If you're in the EEA or the UK, you can object at any time, for reasons related to your situation, to our use of your personal data based on legitimate interests. Most of what this section describes relies on legitimate interests. To object, email support@emploist.com. We'll then stop, unless we have compelling legitimate grounds that override your interests, rights, and freedoms, or we need the data for legal claims. If we ever send you marketing emails, you can object to them at any time, and we'll stop.

What we don't do

We don't sell personal data, and we don't "share" it for cross-context behavioral advertising, as California law defines those terms.
We don't use personal data for advertising, and we don't use analytics or tracking tools.
We don't use Customer Data, including applications and resumes, to train AI models. TypeSafe's published terms say it won't use the data we send to train its AI models without our consent, and we don't give that consent.
We use Customer Data only to provide, secure, and support Emploist for the customer, including finding and fixing problems, as our data processing terms describe. That includes Customer Data that appears in our logs or in emails to our support address.
We don't make decisions about our users based solely on automated processing that have legal or similarly significant effects on them. For how AI ranking works for applicants, see For job applicants.
We don't send marketing emails. Emploist sends sign-in codes, invitations, and the emails customers send to applicants. We also email customers' admins about important matters, such as changes to our prices, Terms, or subprocessors, security incidents, and planned deletion of an inactive company, and we email everyone with an account about material changes to this policy. If we ever send marketing emails, we'll do so only as the law allows, with an unsubscribe link in each one.

6. Sharing and subprocessors

We share personal data only as described in this section.

Subprocessors

These providers process personal data on our behalf to run Emploist. For Customer Data, they're our subprocessors. This is the subprocessor list that our data processing terms refer to.

Provider	What it does	Personal data	Location
Our cloud hosting provider	Servers, database, and file storage for the app and careers pages	All data in Emploist, including Customer Data and account information	European Union
TypeSafe AI, Inc. (privacy policy)	AI ranking of applications, only for companies that have it on	Resume text, answers to the employer's questions (except phone numbers), and the job's title, department, employment type, and description	United States
Resend, operated by Plus Five Five, Inc. (privacy policy)	Sending emails	Recipients' email addresses, names, and the contents of sign-in codes, invitations, and emails to applicants	United States (email data is stored in the US)
Our email inbox provider	Receiving and storing emails sent to our support address	Whatever people send us, which can include Customer Data that customers or applicants send, for example in a request to correct an application	May be outside the European Union

About TypeSafe. TypeSafe's published terms say it won't use the data we send to train its AI models (that is, to change the models' weights) without our consent, and we don't give that consent. The terms also let TypeSafe keep and use that data to monitor for fraud and abuse, to comply with the law, and to derive service telemetry, such as technical logs, statistics, classifications, and learnings about how its service is used. TypeSafe may use telemetry without restriction, including to improve its services. The terms don't set a fixed period for how long TypeSafe keeps the data. You can read more in TypeSafe's privacy policy and data processing addendum.

We also use providers for our own operations, such as the host of emploist.com, which receives standard request data from website visitors. As our website host, it doesn't receive the data in the Emploist app.

Changes to our subprocessors

We keep this list up to date. Before we add or replace a subprocessor on this list, we'll update the list and email each customer's admins at least 30 days in advance. Customers can object, as our data processing terms explain. For our subprocessors' own providers, we rely on the notice they give us. Customers can also ask us for more details about our subprocessors.

Independent third parties

These companies receive personal data and decide how to use it under their own privacy policies. They aren't our subprocessors.

Company	Why	Personal data
Dodo Payments (privacy policy)	Reseller and merchant of record for our plan and credit packs	From us, the email address of the admin who first checks out, and the company's name. We don't update that email later. Dodo also collects payment and billing details from you directly.
Google (privacy policy)	Sign-in, if you choose to sign in with Google	Google gives us the details in Google and Microsoft sign-in, and knows you signed in to Emploist.
Microsoft (privacy statement)	Sign-in, if you choose to sign in with Microsoft	Microsoft gives us the details in Google and Microsoft sign-in, and knows you signed in to Emploist.

Others

Your company. Your teammates can see your name, email address, and activity in Emploist. People you invite see your name, or your email address if you haven't set a name.
Professional advisers, such as lawyers and accountants, who must keep it confidential.
Authorities and others, when the law requires it, or when it's needed to protect the rights, safety, or security of our users, applicants, the public, or Emploist.
A successor. If Emploist's business is transferred, for example to a company set up to run it or to a buyer, personal data may be transferred with it. We'll tell customers if that happens.

7. International transfers

Our servers, database, and file storage are in the European Union. Personal data still goes to other countries:

We're based in India, and we access data from there to run, support, and secure Emploist.
TypeSafe (AI ranking) and Resend (email) process data in the United States.
Our email inbox provider may process data outside the European Union.
Dodo Payments, Google, and Microsoft process data under their own policies, which can involve other countries.

India doesn't have an adequacy decision from the European Commission or the UK. The US has one only for companies certified under the EU-US Data Privacy Framework and its UK Extension. This is how we protect personal data from the EEA and the UK that goes outside them:

Customer Data. Our data processing terms include the European Commission's Standard Contractual Clauses, with the UK Addendum for UK data. They cover our access from India.
Your account data and other data we control. We're based in India, so when you use Emploist or email us, you give this data to us directly. It's stored in the European Union, and we protect it as this policy describes wherever we access it.
TypeSafe and Resend. Their data processing terms include the Standard Contractual Clauses and the UK Addendum. Resend also states that it's certified under the EU-US Data Privacy Framework and its UK Extension.
Our email inbox provider. Where it processes data outside the European Union, we use the safeguards that data protection laws require.
Dodo Payments. For the details we send Dodo at checkout, Dodo's data processing agreement with us includes the Standard Contractual Clauses, with the module for transfers between independent controllers, and the UK Addendum.

You can ask for a copy of these safeguards by emailing support@emploist.com. We may leave out commercial details that aren't relevant.

8. How long we keep information

Apart from sign-in codes, logs, and backups, we don't delete data automatically on a fixed schedule. Most data stays until you or your company deletes it, as the table shows.

Information	How long we keep it
Account information	Until you delete your account. If you're not in any company, for example because you left it or it was deleted, you can't delete your account in the app, so email us and we'll delete it. When your account is deleted, we delete your profile picture link, sessions, sign-in methods (including Google or Microsoft tokens), company membership, and notifications, and remove your email address from your account. We keep your name, so your teammates can still see who wrote your comments and moved applications. Your comments show it with a "Deleted account" label, and it stays in teammates' notifications about your comments until their accounts or the company are deleted. Invitations sent to your email address stay in the inviting company's records until that company is deleted. If you leave a company or are removed from it, your comments and activity stay with that company's data.
Sessions	A session expires after 7 days, extended while you use the app. Its record, with your IP address and user agent, may be kept until you delete your account.
Sign-in codes	Valid for 5 minutes. Deleted once used, and expired codes are cleared out automatically.
Company information and Customer Data	Until an admin deletes the company. If a company has had no active Plan (a free trial, a paid Plan, or a Plan in the grace period after a failed payment) for 12 months in a row, we may delete it and all its data. We'll email its admins at least 30 days before we do. See our Terms.
Invitations	Kept with the company's records until the company is deleted, including after they're accepted, canceled, or expired.
Notifications	Until the person's account or the company is deleted. Read notifications keep the applicant's name and the job title, even after the application is deleted.
Applicants' data	The employer decides. It's deleted when the employer deletes the application, the job, or the company, with the exceptions below.
Billing records	Plan and credit records stay until the company is deleted. Records of who used a free trial are kept after that, even if the person deletes their account, to prevent repeat trials. Records we need for tax and accounting are kept as long as the law requires. Dodo keeps its own records, including the email address of the admin who first checked out, under its privacy policy.
Support emails	Until your question or request is resolved, and then only as long as we might need the record, for example for a follow-up, a complaint, or a legal claim.
Request logs	Only as long as we need them to find and fix problems and to investigate abuse, then deleted.
Backups	Only as long as we need them to restore Emploist after a problem. Older backups are deleted or overwritten as newer ones replace them.

When an application, job, or company is deleted, we delete it from our active systems, except:

Notifications that a team member has already read keep the applicant's name and the job title until that team member's account or the company is deleted.
Copies in backups and logs are removed over time, as they're deleted or overwritten.
Rarely, if deleting a stored file, such as a resume, fails, the file can remain until we remove it. We'll remove it when we find it, or when asked.
Data already sent to our subprocessors is kept under their terms. For TypeSafe, see About TypeSafe. Dodo keeps its own records under its privacy policy.

9. Security

We protect personal data with measures such as these:

Encrypted connections (HTTPS) to the app, careers pages, and our website, and encryption of stored data at rest.
In the app, only team members of a company can access its data, and admin-only actions are checked on our servers. Resumes are kept in private storage, and every request to open one is checked to make sure it comes from a signed-in team member of the right company.
You don't create a password for Emploist. Sign-in codes and invitation links are stored only in hashed form, and sign-in codes expire after 5 minutes and allow 3 tries.
Strict security headers and content security policies. Careers pages run in a sandbox that blocks scripts.
Checks on untrusted content. Customers' careers page code runs in worker threads with time and memory limits. Uploaded files are checked by their contents and size, and resumes are read in worker threads with limits. Rich text, email designs, and SVG logos are cleaned of unsafe code.
Rate limits on sign-in, the app, careers pages, and applications, and a spam trap on application forms.
Cookies, sign-in secrets, and invitation links are removed from our request logs.
Card details are handled by Dodo.
Regular backups, with the ability to restore them, and an incident response process.

No system is perfectly secure, and we can't guarantee that personal data will never be accessed without permission. If a breach affects your personal data, we'll notify you and the relevant authorities as the law requires. For Customer Data, we'll notify affected customers without undue delay, and within 72 hours of becoming aware of the breach, as our data processing terms describe.

10. Your rights

Depending on where you live, you may have the right to:

Access your personal data and get a copy of it
Correct data that's inaccurate or incomplete
Delete your data
Restrict how we use it
Take it with you (portability): receive it in a machine-readable format, or have it sent to another provider
Object to how we use it, including when we rely on legitimate interests. See Your right to object.
Withdraw consent where we rely on it, without affecting what we did before
Complain to a data protection authority

These rights have limits. For example, we may need to keep some data to meet legal obligations. If we can't fully meet a request, we'll explain why.

How to make a request

Email support@emploist.com, ideally from the email address on your Emploist account. We may need to confirm your identity before we act. We'll respond within the time the law sets, which is generally one month. We won't charge you, unless the law allows a fee, for example for requests that are clearly unfounded or excessive.

What you can do in the app

If you're in a company, delete your account in Settings, under Danger zone. If you're the only admin, make someone else an admin first. If you're the only team member, your company is deleted too. If you're not in a company, for example because you left it or it was deleted, email us and we'll delete your account.
Your team can export a job's applications and delete applications and jobs. Admins can delete the whole company. Deleting applications and jobs needs an active Plan. Exporting and deleting the company or your account don't.
Some things need our help. Email us, and we'll delete individual applications or jobs while your company is read-only, correct an applicant's details, which the app can't edit, provide match scores, their breakdown, and comments, which aren't in the export, or change your name or email address, which you can't change in the app yet.

Job applicants

If you applied for a job, contact the employer first about your application. For the request logs and other data we control ourselves, you can contact us directly. See For job applicants.

EEA and UK

The legal bases we rely on are in How we use information. You can object at any time to our use of your data based on legitimate interests, as Your right to object explains. You can also complain to the data protection authority where you live or work, or where you think an infringement happened. In the UK, that's the Information Commissioner's Office (ICO).

We'd appreciate the chance to help first. You can complain to us by email at support@emploist.com. We'll acknowledge your complaint within 30 days, look into it, keep you updated, and tell you the outcome without undue delay.

United States, including California

We collect these categories of personal information, as described in Information we collect:

Category	Examples	Sources
Identifiers	Name, email address, IP address, and account IDs	You, Google or Microsoft, an admin who invites you, and your device
Commercial information	Plan status, and AI credit purchases and use	You and Dodo Payments
Internet or other network activity	Sessions and request logs, including the pages and data you request in the app	Your browser and device, and your use of Emploist
Professional information	The company you belong to and your role in it	You and your company's admins
Sensitive personal information	Account sign-in credentials: sign-in codes and invitation link secrets (both stored hashed), session tokens, and Google or Microsoft sign-in tokens	Created when you sign in or are invited, or given to us by Google or Microsoft

We use this information for the purposes in How we use information, disclose it for those business purposes to the recipients in Sharing and subprocessors, and keep it as described in How long we keep information. For applicants' data, we're a service provider to the employer.

We don't sell or share personal information, and haven't in the last 12 months. We have no actual knowledge of selling or sharing personal information of anyone under 16.
We collect sensitive personal information only as part of signing you in, and we never use it to infer characteristics about you.
You can ask to know what personal information we've collected about you and how we use and disclose it, to get a copy, and to have it deleted or corrected.
You can use an authorized agent. We may ask the agent for proof that you authorized them, and ask you to confirm your identity directly with us.
We won't discriminate against you for using your rights.
We honor Global Privacy Control signals as a request to opt out of selling and sharing. Since we don't sell or share personal information, there's nothing more we need to do when we receive one.

If you live in another US state with a privacy law, you can make the same requests. If we decline your request, you can appeal by replying to our decision, and we'll respond as the law requires.

India

Under India's Information Technology Act and its rules on sensitive personal data, you can review the information you've given us and ask us to correct or update it. You can also choose not to give us information, or withdraw consent you've given, by emailing us. If you do, we may not be able to provide Emploist to you. These rights cover the information we collect from you as controller. For an application you sent to an employer, contact the employer.

These rules treat passwords as sensitive personal data, and define a password broadly, as a secret code or key used to gain access. So the sign-in secrets listed in Sensitive information may count as sensitive personal data. We collect them only to sign people in, keep sign-in codes and invitation link secrets only in hashed form, and share them only as Sharing and subprocessors describes.

You can raise any grievance with our Grievance Officer, Navaneeth CT, at support@emploist.com. We'll acknowledge it within 24 hours and resolve it within 15 days of receiving it.

If you're in India, then as India's Digital Personal Data Protection Act, 2023 comes into force, you'll also have the rights it gives, such as to get a summary of your personal data and how we use it, to have it corrected or erased, to have your grievances addressed, to nominate someone to act for you, and, after first raising a grievance with us, to complain to the Data Protection Board of India.

Other countries

If you live elsewhere, for example in Canada, Australia, or Brazil, your local law may give you similar rights. Email us, and we'll respond as your law requires. Navaneeth CT is responsible for privacy at Emploist. You can also complain to your local data protection authority.

11. Cookies and similar technologies

The Emploist app uses only strictly necessary cookies:

Cookie	What it does	How long it lasts
`emploist.session_token`	Keeps you signed in	7 days, renewed while you use the app
`emploist.state`	Protects your sign-in with Google or Microsoft	5 minutes, and removed once you're signed in

On app.emploist.com, which uses HTTPS, both names start with __Secure-. Both cookies are HttpOnly, so scripts on the page can't read them, and they're sent only to the app, not to careers pages.

The app also uses your browser's local storage to remember your theme (emploist-theme) and whether the sidebar is collapsed (emploist-sidebar-collapsed). These stay in your browser and aren't sent to us.

Emploist sets no cookies on careers pages, and scripts don't run on them. If an employer's own careers page design loads content from other websites, those websites may set their own cookies, as For job applicants explains. emploist.com sets no cookies, uses no local storage, and runs no analytics.

Because these cookies and storage are needed for the app to work, or only remember choices you make, they don't need your consent, and we don't show a cookie banner. If you block cookies, you won't be able to sign in.

12. Children

Emploist is for businesses. You must be 18 or older to use the app. We don't knowingly collect personal data from children as a controller. If you believe a child has given us personal data, email us and we'll delete it.

Employers decide who can apply for their jobs. If an employer accepts applications from people under 18, the employer is responsible for meeting the law's requirements, such as getting a parent's consent where needed.

13. Changes to this policy

We may update this policy when Emploist or the law changes, and we'll change the "Last updated" date at the top of this page. If a change is material, we'll email everyone with an Emploist account at least 30 days before it takes effect. If the law requires a change sooner, we'll give as much notice as we can.

14. Contact

For privacy questions and requests, or to reach our Grievance Officer, email support@emploist.com. We handle these by email only.

Operator: Navaneeth CT, an individual based in India, trading as Emploist
Privacy contact and Grievance Officer: Navaneeth CT
Email: support@emploist.com

If you applied for a job, please contact the employer first about your application. See For job applicants.

The short version