Privacy policy

OleeHire is an AI hiring platform operated by Oleon (Private) Limited at hire.oleon.io. In this policy "we" and "us" mean Oleon (Private) Limited, and "you" means whoever is reading it, whether you are a recruiter using the platform or a candidate applying through it.

For anything about this policy, write to privacy@oleon.io and we will answer within 30 days.

Who controls your data depends on how you reached us. The distinction matters, because it decides who you ask when you want a copy or a deletion.

• chevron_rightRecruiters and employers. We are the controller of your account data: your name, email, the organisation you belong to, your billing details and how you use the product.
• chevron_rightCandidates. The employer that published the apply link is the controller of your application. We are their processor, acting on their instructions. We only handle your CV, interview and scores to run the hiring process for them.

We collect only what the hiring process needs, plus basic analytics about how the site is used. There is no advertising network here, nothing is sold on, and no profile is built for any purpose other than the role you applied to or the account you run.

• chevron_rightAccount details: name, work email, role in the organisation, and the password hash or Google account identifier used to sign in.
• chevron_rightOrganisation details: company name, team members you invite, plan and billing information.
• chevron_rightContent you create: job descriptions, screening criteria, interview questions, notes, messages to candidates.
• chevron_rightUsage and diagnostic data: pages visited inside the app, actions taken, IP address, browser and device type, error logs.

• chevron_rightApplication data: your CV or resume file and everything inside it, plus any answers you give on the apply form.
• chevron_rightContact details: name, email address, phone number if you provide one.
• chevron_rightInterview data: audio of your answers, the transcript generated from that audio, and timing information for the session.
• chevron_rightAssessment data: scores, rankings, evidence citations and the written reasoning the AI produced against the employer's criteria.
• chevron_rightTechnical data: IP address, browser and device type, and the Google account identifier if the employer requires a Google sign-in to reach the interview.

• chevron_rightTo run the hiring process: collect applications, score CVs against the employer's criteria, conduct voice interviews, and produce the ranked report.
• chevron_rightTo operate accounts: authentication, permissions, billing, support, and service notices about outages or changes.
• chevron_rightTo keep the platform safe: rate limiting, abuse and fraud detection, and the insert-only audit log that records every state change on an application.
• chevron_rightTo improve the product: aggregated and de-identified usage statistics that cannot be traced back to a person.
• chevron_rightTo meet legal obligations: tax records, and equal opportunity or anti-discrimination records where an employer is required to keep them.

OleeHire uses Google Vertex AI to read CVs, generate interview questions, transcribe and grade answers, and write the reasoning behind each score. This is a substantial use of automated processing and we want you to understand its limits.

• chevron_rightA human always decides. The AI produces a recommendation and a score. Selecting or rejecting a candidate is an action taken by a named person in the employer's team, recorded against that person in the audit log, never against the model.
• chevron_rightEvery score cites evidence. Scores reference the line in the CV or the moment in the interview that produced them, so a decision can be reviewed and challenged.
• chevron_rightAI can be wrong. Models misread documents, mishear audio and miss context. Treat output as a first pass, not a verdict.
• chevron_rightYou can ask for a review. Candidates may request human review of any assessment, contest the result, and give their point of view. Ask the employer first, or write to privacy@oleon.io.

Where the GDPR or a similar law applies, we rely on the following bases.

• chevron_rightContract: to provide the platform to a recruiter who has signed up, and to run an application a candidate has submitted.
• chevron_rightLegitimate interests: to secure the service, prevent abuse, keep audit records, and improve the product using aggregated data.
• chevron_rightConsent: for optional things such as keeping a candidate record in an employer's talent pool after the role closes, or marketing email. Consent can be withdrawn at any time.
• chevron_rightLegal obligation: where we must keep records for tax, accounting or employment law.

We share personal data with the employer running the role, and with the service providers below who process it on our instructions under contract. We do not sell it and we do not share it for advertising.

We may also disclose data where the law requires it, to enforce our terms, or as part of a merger or acquisition, in which case we will tell you before your data moves to a new controller.

Data is stored in the region an organisation selects, EU by default. Some providers process data outside that region. Where personal data leaves the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, the UK Addendum, or an adequacy decision, together with encryption in transit and at rest.

Employers set retention windows for their own organisation, within the limits below. When a window ends, the record is deleted automatically rather than archived.

Backups roll off on their own schedule and are fully replaced within 35 days of a deletion.

• chevron_rightRow Level Security in Postgres denies access by default. Every table has a policy, so one organisation can never read another's data.
• chevron_rightCVs and recordings live in private storage buckets and are served only through short-lived signed URLs.
• chevron_rightCandidates never receive an account password. Access to a status page or an interview uses an opaque, single-purpose, expiring token.
• chevron_rightService credentials for the database and the AI provider exist only in server-side code and are never sent to a browser.
• chevron_rightData is encrypted in transit with TLS and at rest by our infrastructure providers.
• chevron_rightEvery state change on an application is appended to an insert-only audit log.

Depending on where you live you may have the right to access a copy of your data, correct it, delete it, restrict or object to processing, receive it in a portable format, withdraw consent, and complain to your data protection authority.

• chevron_rightRecruiters: most of this is self-service in Settings. Anything else, write to privacy@oleon.io.
• chevron_rightCandidates: ask the employer that published the role first, since they control your application. Copy us at privacy@oleon.io and we will make sure the request is actioned.

We do not charge for these requests and we will not treat you differently for making one.

We use a small number of cookies. We do not run advertising cookies and we do not sell any of this to an ad network.

• chevron_rightSession cookies that keep you signed in and hold your Supabase auth session. Necessary.
• chevron_rightSecurity cookies that protect forms against cross-site request forgery. Necessary.
• chevron_rightPreference cookies that remember settings such as the last pipeline view you opened. Necessary.
• chevron_rightGoogle Analytics cookies, _ga and similar, that count visits and show us which pages people use. Analytics, not advertising. They record a random identifier, the pages you view and rough location from a truncated IP address.

In the EEA, the UK and Switzerland the analytics cookies are switched off until you accept them on the banner, and declining is a single click. Elsewhere they are on by default and you can turn them off with your browser, the Global Privacy Control signal, or the Google Analytics opt-out add-on. Blocking them does not change how the platform behaves.

OleeHire is a workplace tool and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has submitted data through the platform, write to privacy@oleon.io and we will delete it.

We update this policy when the product or the law changes. The date at the top always reflects the current version. For material changes we will email account holders and show a notice in the app at least 14 days before the change takes effect.

Privacy questions, data requests and complaints: privacy@oleon.io.

Postal address: Oleon (Private) Limited, hire.oleon.io. If you are in the EEA or the UK and are unhappy with our response, you may complain to your local supervisory authority.

See also our terms of service.