Privacy Policy

1. Information we collect

1.1 Information you provide directly

When you create an account, book a call, or contact us, we collect:

• Account data: name, work email address, company name, job title, and password.
• Billing data: payment card details (processed by our payment processor; we do not store raw card numbers), billing address, and invoice history.
• Communications: the content of messages you send us via email, chat, or our contact form.
• Platform inputs: search queries, role briefs, sequence content, and candidate notes you create inside the platform.

1.2 Information collected automatically

When you use the Service, we collect:

• Log data: IP address, browser type, operating system, pages visited, timestamps, and referring URLs.
• Usage data: feature interactions, searches run, sequences created, candidate actions (viewed, shortlisted, contacted), and agent activity.
• Device data: device identifiers, screen resolution, and language settings.
• Cookies: see Section 5 for details.

1.3 Information from connected services

If you connect your Google Workspace or Microsoft Outlook inbox, or your LinkedIn account, we access only the permissions you explicitly grant and use those credentials solely to send outreach on your behalf. We do not read, store, or index your personal emails or messages beyond what is necessary to deliver the Service.

2. How we use your information

We use information we collect to:

• Create and manage your account and workspace.
• Provide, operate, and improve the Service: including AI match scoring, outreach sequencing, and agent functionality.
• Process payments and send billing-related communications.
• Send product updates, feature announcements, and (where you have opted in) marketing communications.
• Respond to your support requests and enquiries.
• Monitor for fraud, abuse, and security threats.
• Comply with applicable legal obligations.
• Analyse aggregated, anonymised usage patterns to improve our product.

We process your data on the following legal bases (where GDPR applies): performance of a contract (providing the Service), legitimate interests (product improvement, fraud prevention, marketing to business contacts), legal obligation, and: where required: explicit consent.

3. Candidate data and third-party sources

Hayasa surfaces candidate profiles from LinkedIn and 30+ third-party data sources including Apollo, Gong, Crunchbase, and Sales Navigator. This data is publicly available professional information: names, job titles, employers, career history, and public attainment signals.

If you are a candidate whose profile appears in Hayasa: you have the right to request removal of your data by emailing privacy@hayasa.ai. We will action opt-out requests within 10 business days. Opted-out profiles are suppressed from all future searches and outreach.

Customer workspaces (including saved searches, shortlists, and candidate notes) belong to the customer. We act as a data processor for that data. Our data processing addendum (DPA) is available on request.

4. How we share your information

We do not sell your personal data. We share information only in the following circumstances:

• Service providers: we share data with trusted vendors who help us operate the Service (cloud hosting, payment processing, analytics, customer support tooling). All vendors are bound by data processing agreements.
• ATS integrations: if you connect Greenhouse, Lever, or Ashby, candidate data you push from Hayasa is shared with that system in accordance with your instruction.
• Legal requirements: we disclose data when required by law, court order, or to protect the rights and safety of Hayasa or others.
• Business transfers: if Hayasa is acquired or merges with another entity, your data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
• With your consent: in any other circumstances where you have given explicit permission.

5. Cookies and tracking technologies

We use cookies and similar technologies for the following purposes:

• Essential cookies: required for the Service to function (authentication, session management, security). Cannot be disabled.
• Analytics cookies: help us understand how the Service is used so we can improve it. We use privacy-focused analytics that anonymise IP addresses.
• Preference cookies: remember your settings (theme, language, table configurations).

You can manage cookie preferences via your browser settings. Disabling analytics cookies does not affect core functionality.

6. Data retention

We retain your account data for as long as your account is active and for a reasonable period thereafter to allow for reactivation. When you delete your account, we delete or anonymise your personal data within 60 days, except where retention is required by law or to resolve disputes.

Candidate data sourced from third parties is refreshed on a rolling basis. Opted-out candidate records are suppressed permanently.

7. Security

We implement industry-standard security measures including encryption in transit (TLS 1.2+), encryption at rest (AES-256), access controls, and regular security audits. We are working toward SOC 2 Type II certification. No system is completely secure; if you believe your account has been compromised, contact us immediately at security@hayasa.ai.

8. Your rights

Depending on your location, you may have the following rights:

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to correct inaccurate or incomplete data.
• Deletion: request that we delete your personal data.
• Portability: receive your data in a structured, machine-readable format.
• Restriction: ask us to restrict processing in certain circumstances.
• Objection: object to processing based on legitimate interests, including direct marketing.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

To exercise any of these rights, email privacy@hayasa.ai. We will respond within 30 days. EU/UK residents may also lodge a complaint with your local supervisory authority.

9. International transfers

Hayasa operates infrastructure in multiple regions globally. If you access the Service from the European Economic Area (EEA) or United Kingdom, your data may be transferred to and processed in countries outside the EEA/UK. We rely on Standard Contractual Clauses (SCCs) and other approved transfer mechanisms to ensure your data receives adequate protection.

10. Children's privacy

The Service is intended for business use by adults. We do not knowingly collect personal data from anyone under 16 years of age. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (at the address associated with your account) and by posting an updated policy on this page with a revised effective date. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

12. Contact us

If you have questions or concerns about this Privacy Policy or our data practices, contact us at: