Privacy Policy

1. Who we are

BuHire is an AI-native recruiting platform developed and operated by NetIT SAS, a French company (SIRET 10309701000013, VAT FR43103097010) with its registered office at 32 rue de Paris, 92100 Boulogne-Billancourt, France. In this policy, “NetIT”, “we” and “us” mean NetIT SAS.

This policy covers our website at www.buhire.com, the BuHire application at app.buhire.com (the “Service”) and the optional Google Calendar integration.

Our role

• Controller. We decide why and how we process personal data about the people who use the Service on behalf of an organization (recruiters, hiring managers and administrators) and about visitors to our website.
• Processor. For personal data about candidates and other individuals that our customers add to BuHire or collect through their career pages, the customer organization decides why and how the data is used, and we process it on the customer’s behalf. If you are a candidate and want to exercise your rights, please contact the organization you applied to. We will assist them as required.

Customers can contact us at contact@buhire.com about the data protection terms that apply to their use of the Service.

2. Information we process

Account and usage information

• Name, work email address, role and organization.
• Password (stored only as a hash) and, if you enable two-factor authentication, an encrypted authenticator secret and hashed recovery codes.
• Session information such as device type, IP address and timestamps, which you can review and revoke in your security settings.
• Notification preferences and activity records needed to run the Service.

Customer content and candidate data

• Job postings, hiring pipelines, notes, interview schedules and scorecards, messages and documents.
• For candidates: contact details, application answers, CVs and other documents, structured information extracted from CVs (experience, education, skills, languages), recruiter notes, match scores, interview feedback and consent records (date and version of the consent text).

AI usage records

When an AI feature runs, we record which feature was used, the model, the number of tokens processed and the time. These records support usage reporting and do not contain the content itself.

Email data

Emails sent through the Service (for example application confirmations, workflow emails and outreach sequences) and basic delivery logs.

Google user data

Only if you connect Google Calendar. See Section 5.

Website visitors

Messages you send us by email and standard server logs (such as IP address and pages requested).

3. How we use personal data

We do not sell personal data, we do not use it for advertising, and we do not use customer content to train our own AI models.

4. AI features

BuHire offers AI features such as drafting job descriptions, rewriting messages, comparing candidates with a role, extracting structured information from CVs and a chat assistant.

• Content needed for a feature is sent to our AI provider (see Section 6) when a user triggers the feature or when an automatic feature, such as CV parsing after an upload, runs.
• AI output is decision support. BuHire does not make final hiring decisions: people review the information and decide.
• Customers remain responsible for how they use AI output in their hiring process and for complying with the laws that apply to them.
• Google Calendar data is never sent to our AI features, and our application logs do not record the content of your calendar events.

5. Google user data

BuHire offers an optional integration with Google Calendar. You decide whether to connect it, and BuHire cannot access anything in your Google account until you grant permission on Google’s consent screen.

What we access and why

What we store, and what we do not

• Stored: the access and refresh tokens (encrypted at rest), the email address of the connected Google account, the permissions granted and the connection status. For each item BuHire exported, we keep the Google event identifier and its synchronization status so that the event can be updated.
• Not stored: events read from your calendar and your free/busy information. They are requested from Google when you open the calendar or schedule an interview, displayed to you, and not saved or cached on our servers.
• Shared: we do not share Google user data with third parties and we do not sell it. Our hosting provider (AWS) stores the connection data on our behalf, and Google user data is not sent to our AI or email providers.
• Sent to Google: for each item BuHire exports, a title, start and end time, location and description. For an interview, the title contains the candidate’s name and the job title (for example “Interview: Jane Doe — Backend Engineer”), the location is the meeting address or video link, and the description is a fixed line giving the interview type. For a calendar event created in BuHire, these fields come from what you entered. BuHire does not add guests, reminders, interview notes or scorecards to the event, and does not send email addresses.

Limited Use

• We use Google user data only to provide the user-facing calendar features described above.
• We do not transfer it to others, except as necessary to provide those features, to comply with applicable law, or as part of a merger, acquisition or sale of assets, with notice to users.
• We do not use it for advertising, including retargeting or interest-based advertising.
• We do not allow people to read it, unless you gave your consent for specific data, it is necessary for security purposes such as investigating abuse, it is necessary to comply with the law, or it is used in aggregated and anonymized form for internal operations.
• We do not use it to develop, improve or train generalized AI or machine-learning models.

Disconnecting and deleting

You can disconnect Google Calendar at any time from the calendar settings in BuHire, BuHire then asks Google to revoke the access token and deletes the stored connection data. Events already added to your Google Calendar stay there, and you can delete them in Google Calendar. You can also revoke BuHire’s access from your Google Account permissions page. If your BuHire account is deleted, the stored connection data is deleted with it.

6. Sharing and service providers

We share personal data only with the service providers that help us run the Service, listed below, and with your organization’s own users according to the roles it has configured.

We may also disclose information when required by law or to protect rights, safety and security, and in connection with a merger, acquisition or sale of assets.

7. International transfers

NetIT is based in France and our primary hosting is in the AWS Paris region. Some of our providers, such as our AI and email providers, may process data outside the European Economic Area, including in the United States. Where this happens, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

8. Retention

• Customer content and candidate data are kept while the customer’s account is active, unless the customer deletes them earlier. The Service lets customers export a candidate’s data and permanently delete it, including stored documents.
• After a customer’s account ends, we delete or return its data within 30 days, unless the law requires us to keep it longer. Application logs are kept for 30 days.
• Google Calendar tokens are deleted when you disconnect the integration or when your account is deleted.

9. Security

We use measures appropriate to the risk, including encrypted connections (HTTPS), hashed passwords, optional two-factor authentication, role-based permissions, encryption of third-party access tokens at rest, session management with the ability to revoke devices, and hosting in a private network environment. No system is completely secure, and we encourage you to use strong credentials and two-factor authentication.

10. Your rights

European Economic Area and United Kingdom

You may have the right to access your personal data, have it corrected or erased, restrict or object to its processing, receive it in a portable format and withdraw consent where processing relies on it. You also have the right to lodge a complaint with a supervisory authority, such as the French CNIL (www.cnil.fr).

California

Where the California Consumer Privacy Act applies, you may have the right to know what personal information we collect, to request its deletion or correction, and not to be discriminated against for exercising these rights. We do not sell personal information and we do not share it for cross-context behavioral advertising. For candidate data we process on behalf of our customers, we act as their service provider.

How to exercise your rights

Email contact@buhire.com. We may need to verify your identity. If your request concerns candidate data held by one of our customers, we will direct you to that organization or help them respond. We aim to answer within one month.

11. Cookies and similar technologies

Our website at www.buhire.com does not use advertising or analytics cookies. The BuHire application stores sign-in tokens and interface preferences in your browser’s local storage. These are strictly necessary to keep you signed in and to make the Service work.

12. Children

The Service is intended for professional use and is not directed to people under 18. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy as the Service evolves. We will change the date at the top and, for material changes, notify account administrators by email or in the application. If we change how BuHire accesses, uses, stores or shares Google user data, we will update Section 5 and notify connected users in the application before the change takes effect, and we will ask for new consent where required.

14. Contact