Privacy Policy

What this policy covers, and what it does not

This policy covers this website — the pages at hirecall.ai, the "book a demo" form, and the newsletter sign-up in the footer. For those, HireCall decides what is collected and why, so HireCall is the data controller.

It does not cover the HireCall interview product. When a company uses HireCall to interview its applicants, that company decides who is interviewed and why; it is the controller and HireCall acts as its processor. If you are a job applicant, the notice that applies to you is the Candidate Privacy Notice, and your rights are exercised against the employer that invited you.

The two roles are genuinely different, and we have kept them in separate documents so that neither has to be read through the other.

Who we are

DIGITSOLUTIONS, a société par actions simplifiée registered with the RCS of Rennes under number 977 519 586, registered office 2 Allée des Terrasses, 35230 Noyal-Châtillon-sur-Seiche, France. HireCall is a trading name of DIGITSOLUTIONS.

Privacy contact: privacy@hirecall.ai Postal: 2 Allée des Terrasses, 35230 Noyal-Châtillon-sur-Seiche, marked for the attention of the privacy contact

What we collect, and why

1. If you book a demo

The demo form asks for:

What happens to it. The form does not write to a database. It sends the contents to HireCall by email, using Resend, with your address set as the reply-to. In plain terms: the data ends up in a HireCall mailbox, and a copy sits in Resend's sending records for as long as Resend keeps them.

We say this precisely because "we don't store it in a database" is not the same as "we don't keep it", and we would rather not leave you with the wrong impression.

Why we may use it: to reply to you, prepare and hold the demo, and follow up about it.

Legal basis: our legitimate interests in responding to a business enquiry you sent us and in pursuing the commercial relationship you initiated (Article 6(1)(f) GDPR). Where the exchange turns into steps towards a contract, Article 6(1)(b) also applies. You asked us to get in touch, so we think the balance plainly favours replying; if you disagree, you can object at any time (see Your rights).

A word about the free-text field. The "job post / role" box accepts up to 5,000 characters, and we do not inspect what goes into it. Please do not paste anything you would not want sitting in an inbox: CVs, applicant details, the name and contact details of colleagues who have not agreed to it, or anything confidential. If you do send us personal data about other people, you are the one who needs a basis for sharing it, and we will delete it if you tell us it should not have been sent.

2. If you sign up to the newsletter

We collect your email address only. It is added as a contact in a Resend "audience" and used to send occasional updates about HireCall.

Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link in any message, or by emailing privacy@hirecall.ai. Withdrawing does not affect anything sent before.

3. When you simply visit

The site is a static site. To serve it at all, our host receives ordinary technical data — your IP address, the page requested, the time, your user agent — and keeps it in server and security logs. We do not use those logs to build a profile of you.

We also measure how the site is used and how fast it loads, with a cookieless tool from our host: Cloudflare Web Analytics. Nothing is stored on or read from your device, and nothing tries to recognise you — there is no visitor identifier at all, not even a short-lived one. For each page view, Cloudflare records for us: the page and the referrer, coarse location derived from your IP address (country — the address itself is not kept in the analytics data), browser and version, device type and operating system, and page performance metrics. The data we see is aggregated, cannot identify you, is not shared across sites and is not used for advertising.

Legal basis: our legitimate interests in delivering the site securely, keeping it working, and understanding in aggregate how it is used (Article 6(1)(f) GDPR). You can object at any time (see Your rights). Because we cannot single you out in the analytics data, the most effective route is a browser content blocker: it stops these tools loading, and the site works identically without them.

Google Analytics — only if you say yes

Your first visit asks one question at the bottom of the page. Nothing Google-related is fetched, executed or transmitted until you answer — not even the "cookieless ping" Google's own recommended setup sends while consent is pending. If you refuse, nothing loads, your refusal is remembered for six months, and the site works exactly as it did. If you accept, Google Analytics 4 sets two first-party cookies (13 months) and records for us the pages you view, how you arrived — including which advertisement, if you came from one — coarse location derived from your IP address, your browser, device type and operating system, and three events describing how far you got in the demo funnel (which role you picked, whether the interview started, whether you reached the brief). Those three events are typed in the site's code so that they cannot carry anything about you: no name, no email, no answers, no transcript.

Google's advertising features are off, at the property level and through Consent Mode: accepting permits audience measurement and nothing else. We do not use Google Tag Manager, so everything Google receives is loaded by code that can be read.

Legal basis: your consent (Article 6(1)(a) GDPR), and — for the cookies themselves — consent under Article 82 of the French loi Informatique et Libertés. Consent is the basis, not legitimate interests, and that is why nothing loads before you give it. You can withdraw at any time from the Cookie choices link in the footer of every page: the tag stops sending immediately and the cookies it set are deleted from your device. Withdrawing is one click, in the same place, in the same style as accepting was.

Google Analytics data goes to Google in the United States; see Transfers outside the EU.

4. If you try the interview from the landing page

The landing page has a button that invites you to take a sample interview yourself. That button does not run an interview on this site. It hands you over to the HireCall product application at interview.hirecall.ai, passing the role you picked and a return address so you can be brought back afterwards. No personal data is placed in that link — including your address, if you left one.

You can leave an email address before you start, and you do not have to. The field above the start button is optional and says so; leaving it blank starts exactly the same demo. If you do fill it in, we are told that a demo has started, with your address, so somebody here can get back to you about it. We do not send you anything automatically: the brief you see at the end is shown on the page, not emailed. Beside it is a separate, never pre-ticked box for whether we may contact you about HireCall. The two are deliberately not bundled: giving us an address is not agreeing to be marketed to, and the demo does not depend on either.

Legal basis: for getting back to you about the demo you just ran, our legitimate interests in responding to someone who has just tried the product (Article 6(1)(f) GDPR). For contacting you about HireCall, your consent (Article 6(1)(a)) — the separate box, and nothing else. You can withdraw either at any time by writing to privacy@hirecall.ai, or from the unsubscribe link in anything we send.

Where your address goes. To us, and to nowhere else: it is sent from our own server to our internal notification channel. It is not put in the handoff link, it is not sent to the product application, and it does not reach Google Analytics — the demo events that go there are typed in the site's code so that they cannot carry it.

We are also told when a demo finishes, which means you came back and opened the brief. That signal carries the role and the time and no address at all, and it cannot be matched to a particular person — not even to an address left at the start.

Once you are on the product application, the notice that applies is the one shown there before the interview begins, and the Candidate Privacy Notice explains what an interview means in general.

The demo is not recorded. Your audio is never captured — and that is not a setting somebody could change by accident. Interviews taken from this site run as preview sessions, which the recording service refuses to record whatever its configuration says, and a test in the product pins that refusal so it cannot regress unnoticed. A temporary transcript drives the conversation and is destroyed five minutes after the demo ends, or as soon as you return to this site. Nothing you said reaches this website: the brief you are shown afterwards is a worked example written in advance, identical for everyone who tries that role, and it is labelled as such on the page.

If you ask for your three free interviews after the demo

At the end of the demo you can ask us to set up a workspace. That form collects your work email address, and — as a separate, optional tick box — whether you also want us to contact you about it. The setup request is honoured whether or not you tick it: the two are deliberately not bundled, and the box is never pre-ticked.

The request travels with a single-use code, valid thirty minutes, that ties it to the demo you just took. The code says which of the predefined roles you were reading. It carries nothing you said.

If you tick the optional box we record the fact, the wording you were shown and the moment you ticked it, so we can show what you agreed to. You can withdraw at any time from the link in any message we send, or by writing to privacy@hirecall.ai.

What we do not do

We want to be specific rather than reassuring:

• No analytics that runs without being asked. The only measurement running today is Cloudflare's cookieless Web Analytics, described above. Google Analytics is merged and switched off, and when it is switched on it will not run for anyone who has not accepted it — no Plausible, no PostHog, nothing else at all.
• No advertising or tracking pixels. None, from anyone. Unlike the analytics above, none of these is built, dormant or planned in the site's code.
• No Google Tag Manager. A tag manager exists so that tags can be added without a code change, which would make the rest of this list unverifiable.
• No cookies today. The site sets no cookies and writes nothing to local storage. This will need re-checking when the anti-bot challenge on the /demo page is switched on — see Cookies, which says exactly what must be verified on that day.
• No cross-site tracking, no session recording, no heatmaps. Cloudflare's measurement has no visitor identifier at all. Google Analytics, once accepted, identifies a browser only to this site: its advertising features and cross-device signals are off.
• Fonts are served from our own domain. The typefaces come from Google Fonts but are downloaded when the site is built and served from our host, so your browser makes no request to Google when you visit.
• No selling or sharing for others' marketing. We do not sell personal data and do not share it with third parties for their own marketing.
• No automated decision-making in the sense of Article 22 GDPR happens on this website.

How long we keep things

Where a shorter period is possible, we apply it. Where we must keep something longer to defend a legal claim or meet an accounting obligation, we keep only what that requires.

Who else sees this data

We use a small number of service providers. They act on our instructions and may not use the data for their own purposes.

These three are the only providers involved in the website. The longer list of sub-processors that appears in the DPA relates to the interview product, not to this site. Do not read the two lists as one.

Beyond these, we may disclose data to our professional advisers, or to a public authority or court where the law requires it.

Transfers outside the EU

The interview product lets a customer keep candidate data in the EU or the US. This website is a separate question, and the honest answer is that website data is not confined to the EU. Requests are served from whichever of Cloudflare's edge locations you reach — usually one near you, sometimes not, and never restricted to Europe by us. Cloudflare, Resend and Google are all US companies.

Google Analytics is the one of the three that transfers data to the United States because you chose to let it. If you refuse it, or simply do not answer the banner, nothing reaches Google and this paragraph does not apply to you. That is the practical reason consent is the legal basis for it rather than legitimate interests: it puts the transfer in your hands.

Where data goes to the United States, we rely on one of:

• the European Commission's adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework, where the provider is certified under it; or
• the European Commission's standard contractual clauses (Decision 2021/914), together with an assessment of the transfer.

You can ask us for a copy of the safeguards in place by writing to privacy@hirecall.ai.

Your rights

Under the GDPR and the French loi Informatique et Libertés you may ask us to:

• See the personal data we hold about you, and get a copy;
• Correct it if it is wrong or incomplete;
• Delete it, where the law allows;
• Restrict what we do with it while a dispute is resolved;
• Receive it in a portable form, where we hold it on the basis of consent or a contract and process it by automated means;
• Object to processing based on our legitimate interests, on grounds relating to your situation — and, for direct marketing, at any time and without needing a reason;
• Withdraw consent where we rely on it;
• Give directions about what happens to your data after your death, as Article 85 of the French loi Informatique et Libertés allows.

Write to privacy@hirecall.ai. We will reply within one month, and will tell you if we need longer because the request is complex. We may need to check who you are before acting — we will ask for the least we can get away with.

If you are unhappy with how we have handled it, you can complain to the CNIL:

CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr

You may also go to court.

Security

We keep the site static, which removes most of the ways a marketing site gets attacked: there is no database behind it and no user accounts on it. Traffic is encrypted with TLS. Access to the mailbox that receives demo requests, and to the Resend account, is limited to the people who need it and protected by multi-factor authentication.

Children

This site is aimed at employers and recruitment teams. It is not directed at children and we do not knowingly collect their data.

Changes

If we change this policy we will update the date below and, where the change matters, say so on the site. Material changes affecting newsletter subscribers will be sent by email.

Last updated: 3 September 2026