Privacy policy
Last updated 29 September 2026
How [Business name, e.g. Your Name EI or PlainHire SAS] handles personal data about the people who use PlainHire and visit plainhire.app. If you've applied for a job through PlainHire, the notice for candidates is the one for you.
1. Two roles
- For your account and this website, we are the controller: we decide how that data is used, and this policy covers it.
- For candidates' data, the employer is the controller and we process it only on their instructions, under our data processing agreement. Candidates should contact the employer, or read the candidate notice.
Contact for anything about privacy: privacy@plainhire.app, or [Business name, e.g. Your Name EI or PlainHire SAS], [registered address, or a domiciliation address if you don't want your home address public].
Our representative in the UK (Article 27 UK GDPR): [representative's name and address].
2. What we collect, and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, email, organisation name, role in the team; a password hash if you set one; two-factor settings | To run your account and sign you in | Contract |
| Billing: amounts, currency, billing country, VAT number (card details stay with Stripe) | To take payment and keep tax records | Contract; legal obligation |
| What you do in the app (e.g. who changed a status, sent an email or downloaded data) | An audit trail for you, security, and the EU AI Act's record-keeping | Legitimate interests; legal obligation |
| IP address and email address, in scrambled (hashed) form, for sign-in attempts | To stop password guessing and abuse | Legitimate interests |
| How you found us: campaign tags on the link you followed, the site you came from, or a referral or promo code | To understand which marketing works, and to apply referral credits and discounts | Legitimate interests; contract |
| Emails you send us, and our replies | Support | Legitimate interests |
We don't sell personal data, use it for advertising, or use it to train AI models.
3. Cookies
We use only cookies that the site needs, or that you ask for. There are no advertising or tracking cookies, so there's no cookie banner.
- Signing in: your session, and a short-lived one during two-factor sign-in.
- Your currency choice, if you pick one.
- A referral or promo code, set only when you follow a referral or promo link, so the discount reaches checkout (30 days).
4. Who we share it with
Service providers who process data for us under contract:
| Provider | What for | Where |
|---|---|---|
| TypeSafe (Jev), via OpenRouter | Assesses redacted application text against the employer's criteria | USA (SCCs) |
| Anthropic (Claude), via OpenRouter | Reads contact details from CVs; drafts candidate emails and interview questions from the assessment | USA (SCCs) |
| OpenRouter | Routes requests to the two models above, with prompt logging off | USA (SCCs) |
| Supabase | Database and encrypted file storage | EU region |
| Render | Application hosting | EU region |
| Postmark | Receiving applications and sending candidate and team email | USA (SCCs) |
| Stripe | Payments | USA/EU (SCCs) |
Stripe also acts as a controller for some payment data (for example, fraud checks). We may disclose data if the law requires it, or to protect our rights. If PlainHire is ever sold or merged, data would pass to the new owner under this policy.
5. International transfers
Our main data stores are in the EU. Where a provider processes data in the United States, transfers are protected by the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum.
6. How long we keep it
- Account data: while your account is open, and deleted when an owner deletes the organisation (backups roll off within 35 days).
- Payment and tax records: 10 years, as French accounting law requires.
- Sign-in attempt records: 7 days. Sessions: 30 days. Inbound email logs: 90 days.
- Candidate data: as set by the employer (30 to 365 days after each hiring process closes, 90 by default).
7. Your rights
Under UK and EU data protection law you can ask for a copy of your data, and ask us to correct it, delete it, restrict or object to how we use it, or send it to you in a portable form. Email privacy@plainhire.app; we'll reply within a month. You can also complain to the CNIL (cnil.fr), or to the data protection authority where you live.
8. Security
Data is encrypted in transit and at rest (uploaded documents with our own key). Access is limited by role, sign-ins are rate-limited, two-factor sign-in is available, uploaded files are checked for harmful content, and important actions are logged. See how we meet the EU AI Act and GDPR.
9. Changes
We'll update this page when things change, and email account holders about significant changes.