1. Introduction

This Privacy Policy describes how Tidemark, Inc. (dba Recruiting Insight) (“HiringCenter,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you:

visit our websites, including hiringcenterpro.com and related pages (the “Site”);
use the HiringCenter recruiting engagement platform at app.hiringcenterpro.com and related applications (the “Platform”); and
interact with us by email, phone, or other channels in connection with our services (collectively, the “Services”).

HiringCenter is a business software platform that helps organizations manage recruiting pipelines, communicate with candidates and prospects, schedule meetings, run campaigns, and related workflows.

If you do not agree with this Privacy Policy, please do not use the Services.

2. Roles: Controller and Processor

Depending on the context, we may act as:

Controller when we process personal information for our own purposes, such as operating the Site, managing Platform accounts, billing, security, product improvement, and communicating with our customers.
Processor / service provider when we process personal information on behalf of a HiringCenter customer (for example, candidate or prospect records, messages, call recordings, and application data stored in that customer's account). In those cases, the customer's privacy policy and terms govern how they collect and use that information. Questions about a specific employer's or recruiter's use of your data should be directed to that organization.

3. Information We Collect

A. Information you provide directly

Platform users (customers and their team members)

We may collect:

name, email address, phone number, job title, and profile details;
account credentials and authentication information;
organization and billing details;
communications with us, including support requests and feedback;
content you upload or create in the Platform, such as notes, templates, tasks, and settings.

Prospects, candidates, and other individuals interacting with our customers

If you apply for a job, schedule a meeting, respond to a message, or otherwise interact through a customer's use of HiringCenter, we may process information such as:

name, email address, phone number, and mailing address;
résumé, application responses, licensing or qualification information, and related recruiting data;
messages and communications (email, SMS, in-app messages, voicemails, and call-related data);
meeting preferences and scheduling information;
assessment or questionnaire responses, where applicable.

Website visitors

We may collect information you submit through contact forms, demo requests, newsletter sign-ups, or similar features, such as name, email, company, and message content.

B. Information collected automatically

When you use the Site or Platform, we may automatically collect:

device and browser information;
IP address and approximate location derived from IP;
log data, including pages viewed, features used, timestamps, and referring URLs;
cookies, pixels, and similar technologies (see Section 12);
performance and usage analytics.

If you enable push notifications in the Platform, we may collect device identifiers and notification tokens needed to deliver alerts.

C. Information from third parties

We may receive information from:

Authentication and connected account providers (such as Google or Microsoft), if you choose to connect an email or calendar account;
Payment processors (such as Stripe), including billing status and limited payment metadata—we do not store full payment card numbers;
Communications providers (such as Twilio, SendGrid, and Resend), including message delivery status and telephony metadata;
Integrations your organization enables (such as CRM or marketing tools);
Data enrichment or location services used to validate or enrich contact or address information;
Your employer or organization, if you are invited to a HiringCenter account.

D. Call, voicemail, and recording data

If you participate in phone communications through HiringCenter, we and our telecommunications partners may process:

call metadata (numbers, duration, timestamps, status);
voicemails and call recordings, where enabled;
transcripts or derived summaries, where transcription or analysis features are used.

Applicable law may require notice or consent before recording. Customers are responsible for providing any required notice to call participants.

4. How We Use Personal Information

We use personal information to:

provide, operate, maintain, and improve the Services;
create and manage accounts and authenticate users;
send and receive emails, SMS messages, and phone communications on behalf of customers;
schedule and manage meetings and calendar-related workflows;
process subscriptions, invoices, and payments;
provide customer support and respond to inquiries;
monitor, detect, prevent, and address fraud, abuse, and security incidents;
comply with legal obligations and enforce our terms;
analyze usage and performance to improve reliability and user experience;
develop and operate AI-assisted features, such as drafting assistance, summaries, and internal productivity tools, in accordance with applicable law and our agreements with customers.

That statement does not allow Google or Microsoft user data to be used to develop, improve, or train generalized or non-personalized AI or machine-learning models. Connected Google Accounts and Connected Microsoft Accounts describe the limits that apply to information received from those services.

We may also use aggregated or de-identified information that cannot reasonably identify you for analytics, research, and product improvement.

5. Legal Bases for Processing (EEA, UK, and Switzerland)

Where applicable, we rely on one or more of the following legal bases:

Contract: to provide the Services and perform our agreement with you or your organization;
Legitimate interests: to secure and improve the Services, prevent abuse, and support our business operations, balanced against your rights;
Consent: where required, such as for certain cookies, marketing communications, or optional integrations;
Legal obligation: to comply with applicable laws and lawful requests.

6. How We Share Personal Information

We may share personal information with:

Service providers and subprocessors that help us operate the Services, including providers of cloud hosting, authentication, email delivery, SMS/voice, payment processing, analytics, customer support, and security;
Customers, when you interact with a customer's recruiting workflow (for example, your application data is visible to that customer's authorized users);
Integration partners, when a customer connects third-party tools;
Professional advisors, such as lawyers, auditors, and insurers, under confidentiality obligations;
Authorities, if required by law, regulation, legal process, or to protect rights, safety, and security;
Business transferees, in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate safeguards. Google user data and Microsoft user data are transferred in a merger, acquisition, or sale of assets only after we obtain your explicit prior consent, as described in Connected Google Accounts and Connected Microsoft Accounts.

We do not sell personal information for money. We do not share personal information for cross-context behavioral advertising as those terms are defined under California law, except as described in this policy or with your consent. That exception does not apply to Google user data or Microsoft user data. We do not use Google or Microsoft user data for advertising, and we do not sell it.

7. Third-Party Services

The Services may link to or integrate with third-party websites and services that have their own privacy policies. We are not responsible for the practices of third parties outside our control. Examples of categories of third parties we use may include:

cloud infrastructure and database providers;
identity and authentication services;
email and SMS/voice communications providers;
payment processors;
analytics and performance monitoring tools;
AI model providers, where AI features are enabled;
calendar and mailbox providers, when users connect Google or Microsoft accounts.

When you connect a third-party account, we access only the data and permissions you authorize. For a connected Google account, those permissions are described in Connected Google Accounts: Gmail access is send-only, and Calendar access reads event details on the primary calendar and creates events. For a connected Microsoft account, those permissions are described in Connected Microsoft Accounts: mail access can send, and can read the inbox only when Inbox sync is on; Calendar access reads event details on the default calendar and creates events.

Connected Google Accounts

Connecting Google is optional. HiringCenter works without it. A signed-in user connects an account from Your Profile → Connected Email & Calendar Accounts by choosing Sign in with Google and approving HiringCenter on Google's consent screen. While Google's app is in testing, that button may first ask for the Google email address so HiringCenter can allow it; Google's consent screen appears only after that access is enabled.

We request only these permissions:

Permission	Why
OpenID, email, and profile	Identify the Google account: email address, name, and Google account ID.
Gmail send (`https://www.googleapis.com/auth/gmail.send`)	Send email from that mailbox.
Calendar events (`https://www.googleapis.com/auth/calendar.events`)	Read events on the user's primary Google Calendar, and create events and email invitations when the user sends a meeting invite.

We do not request permission to read Gmail messages. We do not read, import, or sync the Gmail inbox. After you connect, we make one Gmail profile check to see whether that Google account has an active mailbox. We store only the yes-or-no result. Replies are not retrieved from Gmail. A reply appears in HiringCenter only if it is forwarded to the HiringCenter identity address.

Email. Sending stays off until the mailbox is linked to a HiringCenter identity and Send email is on. A user can then send from that address in Conversations. The same linked mailbox can send email that an account admin configures as an automation or campaign, including scheduled sends. Each message is email the user or their organization composed in HiringCenter. We can include recipients, subject, body, and attachments the user added in HiringCenter. Google returns a message ID and thread ID, which we store with the conversation so later replies in that thread can be sent correctly. We do not download attachments from Gmail.

Calendar. With Calendar sync on, HiringCenter reads the primary calendar for the date range shown in the product. For each event we receive the title, start and end, whether it is all-day or busy, location, description, link, video-meeting link, organizer, and attendees (name, email, and response). We use that to show the calendar in HiringCenter. We do not keep a stored copy of those events. We do not update or delete Google Calendar events. When someone scheduling a meeting chooses to send a calendar invite, we create one event on the meeting owner's primary calendar, or the additional meeting owner's calendar if the owner has none connected, and Google emails the invitations. The event can include the meeting type, prospect name, host names, prospect email and phone, location, and notes. We store the resulting event ID, calendar link, organizer email, and invitee emails on that HiringCenter meeting.

Who can see it. Share calendar details is off by default. While it is off, users see only busy blocks, not titles, descriptions, locations, attendees, or links. The connected user can turn Share calendar details on to show titles, descriptions, attendees, and other calendar information. Account admins and owners can view another member's connected calendar under that same setting. Email sent through the connected mailbox is visible to authorized users of that customer's HiringCenter account in the same way as other conversation email. HiringCenter does not sell Google user data, use it for advertising, or give it to data brokers or information resellers.

What we store. On the user profile we store the Google email address, display name, Google account ID, granted permissions, send/calendar/sharing preferences, mailbox availability, connection status, and the OAuth access and refresh tokens. Tokens are encrypted at rest with AES-256-GCM envelope encryption and Google Cloud KMS. They are not sent to the browser, and Firestore rules deny direct client access to the connection record. Traffic to Google uses HTTPS. We also store the outbound message in the conversation and in email logs, plus the Gmail IDs above, and the meeting-invite IDs above.

How long we keep it, and how to delete it. We keep the connection and tokens while the account stays connected. Disconnect on that same Profile page deletes the connection record, unlinks it from identities in every HiringCenter account, and attempts to revoke the token at Google. Revocation is best-effort and may fail. Revoking HiringCenter in the user's Google Account stops future access. Neither disconnect nor a Google-side revocation deletes messages already stored in conversations, email logs, or meeting-invite details. To ask us to delete stored Google account data, email solutions@recruitinginsight.net. We will delete the connection and tokens if they are still present. Conversation and meeting records are deleted with the customer's other HiringCenter records, or sooner when you or that customer deletes them. We have not confirmed a separate automatic deletion of the Google connection when a HiringCenter user or account is deleted, and we have not confirmed how long copies may remain in backups.

AI. If you use HiringCenter's in-app AI agent, that feature can receive the connected mailbox address, provider, connection status, and whether send, calendar, and detail-sharing are on. It does not receive Gmail message contents or the calendar events we read from Google. AI features that work on conversations can process the copy of an email that was composed in HiringCenter and sent through Gmail, in the same way they process other conversation content. We do not use information received from Google APIs, or data derived from it, to develop, improve, or train generalized or non-personalized AI or machine-learning models.

Other limits. These Google terms control wherever another section of this policy is broader:

We do not use Google user data for advertising, sale, credit, or lending.
We do not transfer it except to provide this feature, for security, to comply with law, or as part of a merger, acquisition, or sale of assets after we obtain your explicit prior consent.
HiringCenter personnel do not read Google user data unless you agree to a specific review, it is necessary for security, it is necessary to comply with law, or the data is aggregated and used for internal operations as the Google policy allows.
If we want to use Google user data for a new purpose, we will describe that purpose and obtain consent before doing so. Continued use of HiringCenter is not consent to a new use of Google user data.

HiringCenter's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Connected Microsoft Accounts

Connecting Microsoft is optional. HiringCenter works without it. A signed-in user connects an account from Your Profile → Connected Email & Calendar Accounts by choosing Sign in with Microsoft and approving HiringCenter on Microsoft's consent screen. In some organizations, a Microsoft administrator must approve HiringCenter before that connection completes.

We request only these permissions:

Permission	Why
OpenID, email, and profile	Identify the Microsoft account: email address, name, and account ID.
Offline access (`offline_access`)	Keep the connection signed in so HiringCenter can refresh access without asking again.
User.Read (`https://graph.microsoft.com/User.Read`)	Read the signed-in user's basic profile.
Mail.Send (`https://graph.microsoft.com/Mail.Send`)	Send email from that mailbox.
Mail.Read (`https://graph.microsoft.com/Mail.Read`)	Read the inbox when the user turns Inbox sync on.
Calendars.ReadWrite (`https://graph.microsoft.com/Calendars.ReadWrite`)	Read events on the user's default calendar, and create events and email invitations when the user sends a meeting invite.

Inbox. Inbox sync is off by default. While it is off, we do not pull the Microsoft inbox. A reply appears in HiringCenter only if it is forwarded to the HiringCenter identity address. The user can turn Inbox sync on. HiringCenter reads only the Inbox folder, and only after the mailbox is linked to a HiringCenter identity and Inbox sync is on. It reads that folder about every five minutes. The first time sync runs, we set a starting time and do not import older mail. We receive the subject, body, and recipients long enough to apply the rules below. Messages that fail them are not stored.

A message is stored only when all of these are true:

It is not a draft, and it was not sent by the connected mailbox.
The mailbox is on To or Cc. Mail that reached the mailbox only by Bcc is dropped. If Microsoft omits Bcc and the mailbox is on neither To nor Cc, that message is dropped too.
From matches a prospect in that customer's account.
From, To, or Cc also includes a prospect who is not an account user and is not the synced mailbox.

Teammate-only mail is not stored. A mailbox linked in more than one HiringCenter account is checked against each account separately. When a message is stored, a copy can also be written onto the conversations of other non-user prospects on To or Cc. Those copies are history on those threads. Each poll handles up to 50 new messages; the rest wait for the next run. The user can turn Inbox sync off at any time, which stops later pulls. Turning it off does not delete messages already imported.

Email. Sending stays off until the mailbox is linked to a HiringCenter identity and Send email is on. A user can then send from that address in Conversations. The same linked mailbox can send email that an account admin configures as an automation or campaign, including scheduled sends. Each message is email the user or their organization composed in HiringCenter. We can include recipients, subject, body, and attachments the user added in HiringCenter. Microsoft returns a message ID and conversation ID, which we store with the conversation so later replies in that thread can be sent correctly. We do not download attachments from the mailbox when sending. If Inbox sync imports a matched message that has file attachments, we download those files and store them with that conversation.

Calendar. With Calendar sync on, HiringCenter reads the default calendar for the date range shown in the product. For each event we use the title, start and end, whether it is all-day or busy, location, link, video-meeting link, and organizer. On the calendar overlay, the description is Microsoft's short preview, not the full event body, and the attendee list is capped at 25 (name, email, and response). We use that to show the calendar in HiringCenter. We do not keep a stored copy of events we only read. We do not update or delete Microsoft calendar events. When someone scheduling a meeting chooses to send a calendar invite, we create one event on the meeting owner's default calendar, or the additional meeting owner's calendar if the owner has none connected, and Microsoft emails the invitations. The event can include the meeting type, prospect name, host names, prospect email and phone, location, and notes. We store the resulting event ID, calendar link, organizer email, and invitee emails on that HiringCenter meeting.

Who can see it. Share calendar details is off by default. The connected user always sees full details on their own calendar, including while Share calendar details is off. That setting controls everyone else. Account admins and owners can open another member's calendar; while sharing is off they see only the busy block (start, end, all-day, and busy). Other members cannot open someone else's connected calendar. Email sent through the connected mailbox, and email imported by Inbox sync, is visible to authorized users of that customer's HiringCenter account in the same way as other conversation email. HiringCenter does not sell Microsoft user data, use it for advertising, or give it to data brokers or information resellers.

What we store. On the user profile we store the Microsoft email address, display name, Microsoft account ID, granted permissions, send/calendar/inbox-sync/sharing preferences, connection status, and the OAuth access and refresh tokens. Tokens are encrypted at rest with AES-256-GCM envelope encryption and Google Cloud KMS. They are not sent to the browser, and Firestore rules deny direct client access to the connection record. Traffic to Microsoft uses HTTPS. On that same connection we store the inbound-sync cursor: last synced time, last message id, when sync started, last run, and last error. If an import fails repeatedly, a retry record can keep the sender, subject, received time, and Microsoft message ids. That record does not include the body. We also store the outbound message in the conversation and in email logs, plus the Microsoft IDs above, and the meeting-invite IDs above. When Inbox sync stores a message, we store that message in the conversation, including the sender, recipients, subject, body, and file attachments we downloaded. Linked OneDrive or other non-file attachments are not downloaded.

How long we keep it, and how to delete it. We keep the connection and tokens while the account stays connected. Disconnect on that same Profile page deletes the connection record, unlinks it from identities in every HiringCenter account, and attempts to revoke the Microsoft sign-in session. That revoke is best-effort and often fails, because the granted scopes do not include permission to revoke sessions, and personal Microsoft accounts do not support that call. Removing HiringCenter in the user's Microsoft account is what stops future access. Neither disconnect, turning Inbox sync off, nor a Microsoft-side revocation deletes messages already stored in conversations, email logs, or meeting-invite details. To ask us to delete stored Microsoft account data, email solutions@recruitinginsight.net. We will delete the connection and tokens if they are still present. Conversation and meeting records are deleted with the customer's other HiringCenter records, or sooner when you or that customer deletes them. We have not confirmed a separate automatic deletion of the Microsoft connection when a HiringCenter user or account is deleted, and we have not confirmed how long copies may remain in backups.

AI. For the signed-in user, HiringCenter's in-app AI agent can receive the connected mailbox address, provider, connection status, and whether send, calendar, inbox sync, and detail-sharing are on. For an account admin or owner, it can also receive other members' connected mailbox addresses, providers, status, and whether send, calendar, and inbox sync are currently on. It does not receive inbox message contents or the calendar events we read from Microsoft. AI features that work on conversations can process mail composed in HiringCenter and mail Inbox sync stored, in the same way they process other conversation content. We do not use information received from Microsoft APIs, or data derived from it, to develop, improve, or train generalized or non-personalized AI or machine-learning models.

Other limits. These Microsoft terms control wherever another section of this policy is broader:

We do not use Microsoft user data for advertising, sale, credit, or lending.
We do not transfer it except to provide this feature, for security, to comply with law, or as part of a merger, acquisition, or sale of assets after we obtain your explicit prior consent.
HiringCenter personnel do not read Microsoft user data unless you agree to a specific review, it is necessary for security, it is necessary to comply with law, or the data is aggregated and used for internal operations.
If we want to use Microsoft user data for a new purpose, we will describe that purpose and obtain consent before doing so. Continued use of HiringCenter is not consent to a new use of Microsoft user data.

HiringCenter's use of information received from Microsoft Graph follows the Microsoft APIs Terms of Use.

8. Data Retention

We retain personal information for as long as reasonably necessary to:

provide the Services;
fulfill the purposes described in this Privacy Policy;
comply with legal, tax, accounting, and regulatory requirements;
resolve disputes and enforce agreements.

Retention periods vary by data type. For example:

account and billing records may be retained for the life of the account and for a period afterward as required by law;
communications content may be retained according to customer settings and operational needs;
call recordings and related media may be retained for a limited period (for example, up to twelve (12) months unless a customer deletes them sooner or law requires otherwise);
security and audit logs may be retained for a shorter operational period;
when customer users delete records such as prospects, notes, tasks, meetings, or hires, we keep a copy for up to 180 days so they can be recovered, and then permanently delete it.

Customers may delete or export certain data through the Platform, subject to their account permissions and our data retention policies.

9. Security

We implement administrative, technical, and organizational measures designed to protect personal information, including access controls, encryption in transit, monitoring, and least-privilege access for sensitive systems such as connected mailbox credentials.

No method of transmission or storage is completely secure. You are responsible for maintaining the confidentiality of your account credentials and for configuring appropriate permissions within your organization.

10. Your Privacy Rights and Choices

Depending on where you live, you may have rights to:

access personal information we hold about you;
correct inaccurate information;
delete certain information;
restrict or object to certain processing;
receive a portable copy of certain information;
withdraw consent where processing is based on consent;
opt out of certain marketing communications.

To exercise rights relating to data processed by HiringCenter as controller, contact us at solutions@recruitinginsight.net or solutions@recruitinginsight.net. We may need to verify your identity before responding.

If your information was collected by one of our customers, please contact that organization directly. We will assist customers in responding to valid requests as required by law and our agreements.

You may opt out of promotional emails by using the unsubscribe link in those messages. Even if you opt out of marketing, we may still send transactional or service-related communications.

11. California Privacy Notice

If you are a California resident, the following additional terms apply.

Categories collected (last 12 months) may include identifiers, contact information, commercial information, internet activity, geolocation derived from IP, professional or employment-related information, audio/electronic information (such as voicemails or recordings), and inferences drawn from the above.

Business purposes include those listed in Section 4.

Retention is described in Section 8.

Rights under the CCPA/CPRA may include the right to know, delete, correct, and opt out of certain sharing. We do not sell personal information. We do not use or disclose sensitive personal information for purposes requiring a “limit” right under CPRA, except as permitted by law.

Authorized agents may submit requests on your behalf with appropriate authorization.

Non-discrimination: we will not discriminate against you for exercising privacy rights.

To submit a request: solutions@recruitinginsight.net

12. Cookies and Similar Technologies

We use cookies and similar technologies on the Site and Platform to:

keep you signed in;
remember preferences;
understand usage and performance;
improve security.

Types of cookies may include:

Strictly necessary cookies required for authentication and core functionality;
Functional cookies that remember settings;
Analytics cookies that help us understand how the Services are used.

You can control cookies through your browser settings. Disabling certain cookies may affect functionality. Where required by law, we will obtain consent before using non-essential cookies.

13. SMS and Telephone Communications

If you receive SMS or phone communications through HiringCenter:

message and data rates may apply;
message frequency varies;
you may opt out of texts at any time by replying STOP (or STOPALL, UNSUBSCRIBE, CANCEL, END, or QUIT); reply START to resubscribe;
for help, reply HELP or contact solutions@recruitinginsight.net.

Recruiting and transactional messages sent on behalf of a customer may be subject to that customer's policies and applicable consent rules.

14. AI and Automated Processing

HiringCenter may use automated tools, including artificial intelligence, to assist with drafting, summarization, routing, analytics, and productivity features. These tools process information submitted to or generated within the Services. We do not use customer content to train public third-party models unless explicitly disclosed and agreed otherwise. That statement does not allow Google or Microsoft user data to be used to develop, improve, or train generalized or non-personalized AI or machine-learning models.

Customers are responsible for reviewing AI-generated output before relying on it for employment or legal decisions.

15. International Data Transfers

We are based in the United States. If you access the Services from outside the U.S., your information may be transferred to, stored in, and processed in the U.S. and other countries where we or our service providers operate. Those countries may have different data protection laws than your country.

Where required, we use appropriate safeguards for cross-border transfers, such as standard contractual clauses or equivalent mechanisms.

16. Children's Privacy

The Services are intended for business use and are not directed to children under 16. We do not knowingly collect personal information from children under 16. If you believe we have collected such information, contact us and we will take appropriate steps to delete it.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated policy on the Site and update the “Last updated” date. Where required by law, we will provide additional notice. Your continued use of the Services after the effective date constitutes acceptance of the updated policy, to the extent permitted by law. Continued use does not authorize a new use of Google or Microsoft user data. A new use of that data requires your consent first.

18. Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact:

Tidemark, Inc. (dba Recruiting Insight)
14623 NE N Woodinville Way, Suite 103
Woodinville, WA 98072
United States

Email: solutions@recruitinginsight.net
Support: solutions@recruitinginsight.net