Privacy policy

Hire Pad (hire-pad.com) is a service for running live and take-home technical interviews. It's operated by [COMPANY NAME], [POSTAL ADDRESS] ("we"). Questions about this policy or your data: [CONTACT EMAIL].

Interviewers (and the organisations they work for) decide to use Hire Pad and invite candidates. For candidate data, we process it on the interviewer's behalf. [LAWYER: confirm controller and processor roles.]

What we collect

Interviewers: your email address and name for your account (your password is stored hashed by our sign-in provider), and what you create: interviews, take-homes, questions with their test cases and solution notes (for SQL questions, also the database setup you write, its table list, and any extra data for a test case), and your private notes about candidates.

Candidates:

• the display name you enter when you join or start;
• your name and email address, if the interviewer entered them when setting up the interview;
• the room's contents: your code, whiteboard drawings, the selected language, and the question shown;
• each time code is run: the code, its input and output, how long it took, and who ran it (the display name they joined with, and whether they were the interviewer or the candidate);
• in a SQL interview, the interviewer may set up a database for your queries to run against. You can see its table definitions and query all of its data; you never receive the setup script itself or any hidden test data;
• when you joined and left, and for take-homes when you started and submitted;
• the interviewer's private notes about the interview, which you never see;
• if the interviewer turned on AI analysis (you're told before you join): a summary of your session written by an AI provider from your final code, the question, and the results of your code runs;
• if the interviewer allowed AI hints (you're told before you join) and you ask for one: what you typed and your current code, and the hint you got back.

AI-assisted review

An interviewer can turn on AI analysis for an interview, only before the candidate joins, and you are told on the join screen when it's on. If it is, the interviewer may ask an AI provider (through OpenRouter) to summarise the session. That sends your final code, the question shown, and the results of your code runs. It doesn't send your name, email address, or the interviewer's notes. We ask the provider not to keep the request or train on it, and use only providers we have chosen. The summary describes what the code shows; it doesn't score or rank you and makes no decision about you. The interviewer can also use AI on their own notes or to draft questions; that never includes your details beyond what the interviewer writes in their notes.

AI hints. An interviewer can also let you ask an AI for a hint, again only before you join, and you are told on the join screen. If you ask, your question, your current code, what your latest run printed or the error it gave, and the problem statement you're working on are sent to an AI provider, which is told to nudge you and not give the answer. A few hints are allowed per interview. The interviewer sees every hint you ask for and receive, live and afterwards in the replay. [LAWYER: confirm the lawful basis, the provider terms, and whether candidates may object or opt out.]

Email. If an interviewer clicks “Send invite”, your name and email address (as they entered them), the interview title and your link are sent to our email provider (Resend, or Zoho when the service is set to use it) to deliver the message; it is sent only to the address the interviewer saved, at most three times a day per interview. When someone requests early access (below), we also email our administrators the details they entered, and if we approve the request we email that person a single-use link to choose a password. If you use “Forgot your password?”, we email the address you give (only if it has an account) a single-use link to choose a new one; we keep a keyed hash of the address for an hour, not the address, to limit how many links one address can request. [LAWYER: confirm Resend and Zoho as subprocessors and the wording; add them to the data-processing terms.]

If you request early access: your name and work email, and optionally your company, team size, and a message. We use them only to reply about access, and keep them for [ACCESS REQUEST RETENTION PERIOD].

Everyone: your IP address, which is used to limit how often code can be run (kept for about a minute) and appears in our hosting providers' request logs. Your theme and editor settings are stored only in your own browser. A sign-in cookie is set for interviewers. We count page views and measure how fast pages load with Vercel Web Analytics and Vercel Speed Insights. Neither sets cookies or records personal data or interview content: they record the page's route, the referring site, the country, the kind of browser, operating system and device, timing figures, and an anonymous visitor identifier that changes daily. A room, take-home or sign-in link is reduced to its route before it is sent, never its address. We use no advertising trackers. [LAWYER: confirm the wording for Vercel Web Analytics and Speed Insights.]

Errors: when something fails, we may send the error's type and stack trace (not its message text), the kind of browser or server, and the route of the page or request to our error-reporting provider (Sentry). A room, take-home or sign-in link is reduced to its route first, and no cookies, request contents, account details or IP addresses are sent. [LAWYER: confirm Sentry as a subprocessor, its region and retention.]

How we use it

• to run the interview: sync the shared editor and whiteboard, and run code in an isolated sandbox;
• to let the interviewer review the interview afterwards, including a replay of the session;
• to keep the service secure and prevent abuse, for example rate-limiting code runs;
• to operate and fix the service, using logs.

We don't sell personal data or use it for advertising.

Who can see it

An interview's recording, code runs, and notes are visible only to the interviewer who created it. Candidates don't have accounts and can't see interviewer notes, hidden test cases, or solutions. Our staff access data only to operate the service or when the law requires it. [LAWYER: confirm.]

How long we keep it

• An interview's recording, code runs, participant list, notes, any AI summary, and any AI hints are deleted automatically 180 days after the interview ends. The candidate's name and email address are removed from the interview at the same time; its title and date are kept for the interviewer's records. (An interviewer may have written a name in the title.)
• An interview nobody finishes ends automatically after 7 days without activity, and the 180 days run from its last activity.
• An interviewer can delete an interview at any time, which deletes all of it immediately.
• Interviewer accounts are kept until the account is closed.
• Logs are kept for [LOG RETENTION PERIOD].

Service providers (subprocessors)

We use these providers to run Hire Pad. Each processes data only to provide its service to us.

Security

Connections between your browser and Hire Pad are encrypted. [OWNER: confirm TLS between our services and the database.] Code runs in a sandbox with no network access and strict time and memory limits. Database access is restricted per account, and room access uses short-lived signed tokens.

Your rights

You can ask to see, correct, or delete your data. Candidates can also ask the interviewer's organisation, who can delete an interview at any time. Contact [CONTACT EMAIL]; we reply within [30] days. [LAWYER: GDPR/UK GDPR/CCPA rights and the right to complain to a regulator, as applicable.]

International transfers

Our providers may process data outside your country, including in the United States. [LAWYER: transfer mechanism, e.g. standard contractual clauses.]

Changes

We'll post changes to this page and update the effective date above.