Privacy Policy

1. Who we are and what this covers

This policy explains how HR Copilot handles personal information: what we collect, why, who we share it with, how long we keep it, and the choices and rights you have.

HR Copilot is an AI hiring platform made by AIA Artificial Intelligence Developing Services L.L.C S.O.C ("AIA", "we", "us"), a company registered in Dubai, United Arab Emirates (trade licence 1615761), at Office No. 43-44, owned by Dubai Municipality, Bur Dubai, Al Fahidi, Dubai.

This policy covers:

• Our customers and their users: the businesses that use HR Copilot to hire, and the recruiters, hiring managers and other people they invite.
• Candidates: people who apply for jobs through an employer's HR Copilot careers page or application form, take an AI interview, book an interview, or complete an assignment.
• Website visitors: people who visit hrcopilot.ae or contact us.
• People who connect accounts: users who connect Google, Microsoft or Zoom to HR Copilot.

Candidates also see a short candidate notice when they apply. It sums up the parts of this policy that matter most to them.

2. Our role: who decides what happens to your information

For our customers' accounts and for our website, we decide how information is used. For job applications, the employer decides, and we handle the information for them.

• Customer accounts, users and website visitors. We are the "controller": we decide why and how this information is used, and we are responsible for it.
• Job applications. When you apply to an employer through HR Copilot, that employer is the controller of your application. It decides why it collects your information, what it asks, how long it keeps it and who on its team sees it. We are its "processor": we store and process your application only on its instructions and under a data processing agreement with it. If you have a question or request about an application, the employer is the best first contact. You can also write to us, and we will pass it on and help.
• Your own candidate account (coming later). We plan to let candidates keep their own HR Copilot account: a profile, CV and list of applications that belongs to them and stays with them even if an employer stops using HR Copilot. We will update this policy before candidate accounts launch.

3. What we collect

We collect what you give us, what the product records as you use it, and a little technical information that keeps the service safe.

From customers and their users

• Account details: name, work email, job title, role in the workspace, profile photo, country, time zone, language and display preferences. Passwords are stored only as a secure hash, never in readable form.
• Company details: company name, logo, careers page content, job descriptions, hiring settings, templates and assignments.
• What you create in HR Copilot: notes, tasks, calendar events, messages, emails written or sent from HR Copilot, interview feedback and decisions.
• Records of activity: what was done in the workspace and by whom, and security events such as sign-ins and changes to access. These are kept in tamper-evident logs.
• Choices: whether you want news and product updates from us (only if you ticked the box), and your notification settings.
• Feedback: feature requests, votes and messages you send us.

From candidates (on behalf of the employer)

• Application details: name, contact details, CV and other documents, answers to the employer's questions, and anything else you choose to send.
• AI interview: the audio and video recording of the interview, its transcript and captions, and still images taken from the camera during the interview for the integrity checks described in section 5.
• Assessments: the employer's scores, notes and decisions, and the AI's scores and summaries (for example of your CV or interview).
• Assignments: what you submit, such as code, files, or video and audio answers and their transcripts.
• Interview booking: the time you pick and your time zone.
• Emails between you and the employer sent through HR Copilot, including your replies.
• Consent records: what you agreed to, the exact wording, and when.

From website visitors

• Messages you send us, such as through the contact form: your name, email, company and message.
• Technical information: IP address, browser and device type, and pages requested. This is kept in server logs for up to one month, to keep the service running and secure.

From accounts you connect

See section 10.

HR Copilot doesn't ask candidates for sensitive information such as religion, health or political views. Our acceptable use policy tells employers not to ask for it through HR Copilot unless the law requires it for the job.

4. How we use information, and why we are allowed to

We use information to run HR Copilot, to keep it secure, to talk to you, to improve it and to meet our legal duties. Each use has a legal basis.

We do not sell personal information, and we do not use it for advertising.

5. AI and automatic decisions

HR Copilot uses AI to help employers review applications. A person at the employer makes hiring decisions, with one exception an employer can choose to enable.

• What the AI does: reads CVs against the job's requirements and gives a score; runs the AI interview, asks follow-up questions and scores the answers against the employer's criteria; writes summaries; transcribes speech; translates; and helps recruiters write.
• A person decides: AI scores and summaries are shown to the employer's team as help. The team decides who moves forward and who is hired.
• Automatic rejection: an employer can choose to enable automatic rejection for a job. Then a CV that scores under a level the employer sets is rejected automatically after a short wait, during which the team is told and can stop it. If you're rejected this way, you can ask for a person at the employer to review the decision by replying to the rejection email.
• Integrity checks: during an AI interview, we check for signs that someone else is helping, such as another voice or another person on camera, and flag them for the employer to review. A flag never rejects anyone on its own.
• No voiceprints or face templates: we don't build or keep voiceprints or face templates, and we never use someone's voice or face to work out who they are.

6. Who we share information with

Only with the people and companies needed to run HR Copilot, and never for their own marketing.

• The employer you apply to, and the people on its team it gives access to.
• Our service providers, under contracts that require them to protect the information and use it only to provide their service to us:
  • cloud hosting and storage: Amazon Web Services (AWS), in Singapore
  • AI services that process text and audio for HR Copilot's features (United States)
  • email delivery (Japan) and email receiving (Singapore)
  • our own company tools, such as company email
• The services you choose to connect, such as Google, Microsoft and Zoom, when you use those features (see section 10).
• Professional advisers, such as lawyers and auditors, under a duty of confidentiality.
• Authorities, when the law requires it or to protect someone's safety, after checking the request is valid.
• A buyer or investor, if all or part of our business is sold or reorganised. They would have to protect the information as this policy describes.

Apart from our host, we don't publish our providers' names. Customers can ask for them at privacy@hrcopilot.ae.

7. Where information is stored and sent

Information is stored in Singapore. Some of our providers process it in other countries, including the United States. Every transfer is protected by contract.

• Storage: HR Copilot's database and files are kept in Singapore, on Amazon Web Services (AWS).
• Processing elsewhere: some providers process information in other countries. In particular, our AI services process text and audio in the United States, and our email delivery provider sends emails from Japan.
• Protection: each transfer is covered by a data agreement with the provider. For information about people in the EU, EEA or UK, these include the European Commission's standard contractual clauses where needed. For transfers from the UAE, we follow the UAE data protection law's rules on sending data abroad.

8. How long we keep information

We keep information only as long as it's needed, and we delete it when it isn't.

• Customer accounts and workspaces: while the customer uses HR Copilot. When a workspace is closed or a subscription ends, we keep the data for 30 days so the customer can ask for a copy, then delete it. Deleted data clears from our backups within 30 more days.
• Candidates' applications: as long as the employer keeps them for its hiring and legal needs. The employer can delete an application at any time. When an employer's workspace is closed, its candidates' applications are deleted with it, as above.
• Interview recordings: deleted automatically after the period the employer chooses, between 30 days and 2 years (1 year unless the employer changes it), unless the employer chooses to keep them.
• Activity records: one year. Security and audit records: seven years, as evidence that the workspace was used properly.
• Anonymised statistics: kept, because no one can be identified from them.
• Server logs: up to one month.
• Business and billing records, such as invoices: as long as tax and accounting law requires, currently up to 7 years in the UAE.
• Marketing choices: as long as you're subscribed, plus a record of your consent.

9. Cookies

We only use the cookies needed for HR Copilot to work: to keep you signed in, protect sign-ins and remember your language and theme. No tracking and no advertising cookies.

Because these cookies are needed for the service, we don't ask for consent and there's no cookie banner. If we ever add other cookies, we'll ask first. The Cookies page lists each one.

10. Accounts you connect: Google, Microsoft and Zoom

When you connect one of these accounts, we use it only for the feature you enabled, and you can disconnect it at any time.

Each person connects their own accounts. Connections are never made for a whole company.

• Sign in with Google or Microsoft: your name, email address and account ID, to sign you in.
• Google Calendar or Outlook Calendar: your free and busy times, so candidates are only offered times you're free; your events, so they show on HR Copilot's Calendar and changes go both ways; and the interviews and events you schedule, which we create, move and delete on your calendar.
• Google Meet, Microsoft Teams or Zoom: we create a meeting for each video interview you schedule, and move or delete it with the interview. For Zoom we also read your Zoom user ID, email and plan type, to show which account is connected and whether its calls have a time limit.
• Gmail: we send the emails you write in HR Copilot, and the automatic emails you choose, from your Gmail address. We do not read your Gmail.
• Outlook Mail: we send emails from your Outlook address, and read your new mail to keep only the messages that belong to a conversation in HR Copilot or are with one of your candidates. Other messages are not kept.

Access to these accounts is stored encrypted, with a key made for each person. You can disconnect any account in Integrations, which deletes our access to it. You can also remove HR Copilot's access from your Google, Microsoft or Zoom account settings.

Google user data. We never use information we receive from your Google account to train or improve AI models. HR Copilot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

11. How we protect information

We protect information with encryption, separation between customers and strict access controls. Our controls are aligned with SOC 2.

• Information is encrypted in storage and in transit.
• Each customer's information is kept separate. One customer can never see another's.
• Access by our team is limited to the people who need it, and protected by multi-factor sign-in.
• Data is backed up, and backups are encrypted too.
• Our security controls are aligned with the SOC 2 framework. We don't claim a certification we haven't been awarded.

If a security breach affects personal information, we tell the affected customers without undue delay, and within 72 hours of finding out, so they can meet their own duties. Where the law requires, we also tell the authorities and the people affected.

12. Your rights

You can ask to see, correct, delete or move your information, and to object or limit how it's used. You can also complain to a regulator.

Depending on where you live, you have the right to:

• know what information we hold about you and get a copy
• correct information that's wrong or incomplete
• have your information deleted
• limit how it's used, or object to it being used
• get it in a format you can move to another service
• withdraw consent you gave, at any time (this doesn't affect what happened before)
• ask for a person to review a decision made automatically, and give your view
• complain to a data protection regulator

How to ask. If you're a candidate, contact the employer you applied to first, as it decides about your application. You can also write to us at privacy@hrcopilot.ae and we will pass your request on and help. Everyone else can write to us directly. We may need to confirm who you are first. We reply within 30 days, and there's no charge.

13. Children

HR Copilot is not for anyone under 18.

Candidates must be 18 or older to apply through HR Copilot, and confirm this when they apply. If we learn we hold information about someone under 18, we will delete it.

14. Links to other websites

Other websites and services have their own privacy policies.

HR Copilot links to other websites, and employers' careers pages may link to their own sites. This policy doesn't cover them.

15. Changes to this policy

When we make important changes, we email our customers 30 days before they apply.

The date at the top always shows when this policy last changed. For small changes, such as fixing wording, we update the date. For important changes, we email customers 30 days in advance. Candidates see the current version whenever they apply.

16. Contact us

Write to privacy@hrcopilot.ae with any question about privacy.

AIA Artificial Intelligence Developing Services L.L.C S.O.C Office No. 43-44, owned by Dubai Municipality, Bur Dubai, Al Fahidi, Dubai, United Arab Emirates Email: privacy@hrcopilot.ae

17. Notes for specific places

The same protections apply everywhere. These notes add what's specific to each place.

• United Arab Emirates. We follow the UAE's federal Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). You can complain to the UAE Data Office.
• European Union, EEA and United Kingdom. We apply the standards of the GDPR (and the UK GDPR) to information about people there, and you have the rights it gives you, as in section 12. The legal bases for each use are in section 4. You can complain to the data protection authority where you live or work.
• Other countries. We give everyone the same rights described in this policy, as far as local law allows.

An Arabic version of this policy will follow. If the English and Arabic versions ever differ, the English version applies.