Privacy policy

About the HyperVerge employees who use HyperTalent: your name and email, from Google’s identity token when you sign in with your existing @hyperverge.co Google account. We never see or store a password. If you connect your calendar (a separate consent step from sign-in), we hold an OAuth token scoped to Calendar, Drive, and Gmail-send, tied to your account, so the app can create interview events and send emails as you. If you opt in to WhatsApp notifications (see “WhatsApp” below), we also hold the work phone number you give us for it.

About candidates, entered by a TA through one of several paths — manual entry, the LinkedIn Sourcing Chrome extension, CSV import of an external Google Form, or LinkedIn sourcing via a connected account:

• Name, headline, location, current title & company, email, phone, LinkedIn URL
• Notes and feedback, source, and free-form application answers (including a resume link)
• Interview questions/answers/scores, interviewer names, meeting and recording links
• Weighted evaluation ratings and comments
• An activity/event log and a message log tied to the candidate
• If a resume file is uploaded, we extract structured fields (name, email, phone, LinkedIn, location, title, company, years of experience, education, skills) from it. We do not keep the original file — only the extracted text.
• If sourced from LinkedIn, public profile fields from that LinkedIn profile
• If a hiring manager gives interview feedback through our Slack app, that feedback (verdict + comments) is written into the candidate’s record
• AI-generated outputs tied to a candidate or role — scorecards, persona/sourcing-kit content, and an assistive “fit summary” (see “AI features” below)

• A HyperVerge employee’s password — sign-in is Google OAuth only
• The contents of a TA’s mailbox — the Gmail permission is send-only; we never read, list, or store anything already in your inbox
• The original bytes of an uploaded resume file — only the structured text we extract from it
• A TA’s LinkedIn login credentials — our LinkedIn sourcing connection holds that session on our behalf, never visible to us
• Health, financial, or payment information
• Anything via an advertising, analytics, or tracking SDK — none is present anywhere in the app

Candidate data lives in two systems kept in sync: a Google Sheet per open role, and a Supabase (Postgres) database for structured and derived data — resume extraction, AI outputs, sourcing capture, calendar tokens, Slack feedback records.

Access to a role’s candidates is limited to the TAs, hiring managers, and admins/managers assigned to that specific role.

A gap we’re naming, not hiding:when a hiring manager’s interview-feedback request is posted to Slack, it’s visible to everyone in that role’s configured Slack channel — which can include people who aren’t otherwise granted access to that role in the app itself. Closing that gap is open work, not yet done.

We don’t sell candidate or employee data to anyone, for any purpose.

Sub-processors — vendors that process data on our behalf:

• Vercel — application hosting
• Supabase — database
• Google Workspace — OAuth sign-in, Sheets, Calendar, Drive, Gmail-send, and a legacy Apps Script email fallback
• OpenAI — AI features (see below)
• Slack — interview feedback collection
• Unipile — the LinkedIn sourcing connection
• Meta — the WhatsApp Business Cloud API, behind the internal WhatsApp bot described below

HyperTalent uses OpenAI’s gpt-4o-mini model — no other AI vendor or model — for several assistive features:

• Position/JD prefill — turns a hiring-kickoff transcript into structured role fields. No candidate data involved.
• Scorecard, persona, and sourcing-kit generation — works from role and job-description content, not candidate personal data.
• Fit summary— compares a candidate’s parsed resume text and interview notes against scorecard criteria. Deliberately excludes email and phone from what’s sent. By design, it never outputs a numeric score, verdict, or hiring recommendation — a person always reviews it and makes the actual call. That’s a real constraint built into how the feature works, not just a description of intent.
• Role-relevance classification — the same non-scoring, advisory-only, human-reviewed constraint, applied to sourced LinkedIn/resume text.
• Resume parsing— extracts structured fields from uploaded resume text; doesn’t produce a score.
• Slack channel-intelligence— reads recruiting-channel Slack messages, in two passes, to auto-detect events like “candidate confirmed the interview time.” One of those passes strips identifying information before the message text is sent.

Data in transit — your sign-in token, and anything the app reads or writes — travels over HTTPS end to end. Where it lands (a role’s Google Sheet, the Supabase database) is access-controlled the same way throughout HyperTalent: scoped to the TAs, hiring managers, admins, and managers assigned to that role, not open to the whole company.

We use two cookies, both functional, neither for tracking or advertising:

• A standard sign-in session cookie
• A short-lived security cookie — an OAuth CSRF-state nonce used only during the Calendar-connection flow, expiring after 10 minutes

No analytics, advertising, or tracking technology of any kind is used anywhere in HyperTalent.

A candidate’s data is kept for as long as their record exists in HyperTalent. There is currently no automated deletion or purge process — we’re stating that honestly rather than glossing over it, and it’s something we intend to address.

Ask your TA lead or an admin to correct or remove a candidate record, or to review what’s stored for a specific candidate. Signing out of HyperTalent clears your session immediately.

You never sign in to or directly use HyperTalent. Every piece of your information got into the system because a HyperVerge recruiter put it there — by typing it in manually, by using our LinkedIn Sourcing extension, by importing a form you filled out, or by finding your public LinkedIn profile through our sourcing tool. If you’d like to know what’s stored about you, correct it, or have it removed, contact us below and we’ll route it to the right TA lead.

One of the ways candidate data enters HyperTalent is a Chrome extension HyperVerge recruiters use directly on LinkedIn. When a recruiter explicitly clicks to save a profile, the public LinkedIn fields visible on that page are captured into the same candidate record described above. For the extension’s exact Chrome permissions and the full list of fields it reads, see its own privacy page:

The internal WhatsApp bot.We’re building a WhatsApp bot for HyperVerge staff — the same idea as the Slack app we already run, delivering interview-feedback requests, reminders, and pipeline notifications to a TA’s or hiring manager’s own WhatsApp instead of Slack. It is internal only: it messages HyperVerge employees, never candidates. How it handles your data:

• It runs on Meta’s WhatsApp Business Cloud API, from a HyperVerge business number. Meta handles every message on its way to you, which is why they’re listed as a sub-processor above.
• The only new personal data we hold about you is the work phone number you give us for it, plus a log of what the bot sent you and when.
• What you send backto the bot — an interview verdict, a comment — goes into the candidate’s record, exactly the way hiring-manager feedback given through our Slack app does today.
• It’s opt-in per person. Having a phone number somewhere in the system does not enrol you, and you can turn it off at any time.
• Candidate details — a name, a role, an interview time — will appear inside those messages, because that’s the point of them. So candidate data does travel through Meta in this flow. We’ll send only what’s needed to identify the candidate and act on the notification, and nothing more.

As designed, the bot does not message candidates and there is no candidate-facing WhatsApp number. If that ever changes, we’ll update this policy before it ships, not after.

If anything here changes, we’ll update the effective date at the top of this page.

riyan.b@hyperverge.co