Privacy Policy

1. Who is responsible

• For HR users, their colleagues and website visitors, we are the controller of personal data.
• For candidates, the employer that created the assessment is the controller, and we process candidate data on the employer's behalf and on its instructions.
• For payments, Dodo Payments Inc. is the Merchant of Record and handles payment data as an independent controller under its own privacy policy. We never receive your card details.

2. Data we collect

HR users and colleagues:

• name, email, phone and company name;
• password (stored only as a hash), or your basic Google profile if you sign in with Google;
• assessments you create, and activity in your account;
• purchases: package, amount, currency and payment status, received from Dodo Payments.

Candidates:

• name, email, phone and, if uploaded, a CV;
• answers, scores and time spent on each question;
• integrity signals recorded during the test: leaving the test tab or window, copy, cut and paste, exiting full screen, opening developer tools, changes of IP address and parallel sessions;
• IP address, browser and device information, and a device identifier used to detect repeated or shared attempts;
• emails a candidate sends to an assessment's email address.

Everyone:

• technical logs: IP address, time and requested pages, used for security and troubleshooting.

3. Why we use data and on what basis

We do not sell personal data and do not send marketing emails. Scores are calculated automatically, but decisions about candidates are made by the employer, not by us.

• To provide the service and your account — performance of our contract with you.
• To run assessments and show results to the employer, including integrity signals — on the employer's instructions, and in our legitimate interest in fair, cheat-resistant tests.
• To send service emails such as sign-in codes, password resets and replies to candidates — performance of the contract.
• To process purchases, keep accounting records and meet tax rules — performance of the contract and legal obligations.
• To protect the service from abuse and keep it secure — our legitimate interests.

4. Who receives data

• Employers see the data of candidates who took their assessments.
• Service providers that work for us: Hostinger (server hosting), Brevo (sending and receiving email), Cloudflare (DNS, email forwarding and bot protection on the test page), Google (sign-in, only if you choose it).
• Dodo Payments Inc., as Merchant of Record, for purchases.
• Professional advisers, and authorities when the law requires it.

5. International transfers

Our providers may process data outside your country, including in the European Union and the United States. Where the law requires it, we rely on safeguards such as the European Commission's Standard Contractual Clauses offered by those providers.

6. How long we keep data

• Account data — while the account is open. After a deletion request we delete or anonymise it within 30 days, except records we must keep by law, such as accounting records.
• Candidate data — while the employer keeps the assessment in its account. The employer can ask us to delete it, and it is deleted when the employer's account is deleted.
• Technical logs — for a limited period needed for security and troubleshooting.

7. Your rights

Depending on the law that applies to you, you can ask to access your data, correct it, delete it, restrict or object to its use, receive it in a portable format, and withdraw consent where we rely on consent. Write to support@hirolab.app; we answer within one month.

Candidates can also contact the employer that invited them; we will help the employer respond.

You can complain to a data protection authority — in Georgia, the Personal Data Protection Service; in the EU or UK, the authority in your country.

8. Security

We use encrypted connections (HTTPS), store passwords only as hashes, separate each company's data and limit access to people who need it. No system is perfectly secure, and we will inform affected users of a breach where the law requires.

9. Cookies and browser storage

We do not use advertising or analytics cookies. Hiro keeps your sign-in session, chosen language and a package you picked before signing up in your browser's local storage. The Dodo Payments checkout and Cloudflare's bot protection may set their own cookies that are needed for payment and security.

10. Children

Hiro is not intended for children under 16, and we do not knowingly collect their data.

11. Changes and contact

We will publish changes on this page with a new date. Contact: IE Nijat Kazimzade, Ponichala 3, Building 5, 4th Floor, Krtsanisi District, Tbilisi, Georgia. Email: support@hirolab.app.