Privacy Policy

What this policy covers, and what it does not

This policy covers this website — the pages at [[SITE DOMAIN]], the "book a demo" form, and the newsletter sign-up in the footer. For those, HireCall decides what is collected and why, so HireCall is the data controller.

It does not cover the HireCall interview product. When a company uses HireCall to interview its applicants, that company decides who is interviewed and why; it is the controller and HireCall acts as its processor. If you are a job applicant, the notice that applies to you is the Candidate Privacy Notice, and your rights are exercised against the employer that invited you.

The two roles are genuinely different, and we have kept them in separate documents so that neither has to be read through the other.

Who we are

DIGITSOLUTIONS, a société par actions simplifiée registered with the RCS of Rennes under number 977 519 586, registered office [[REGISTERED ADDRESS]], France. HireCall is a trading name of DIGITSOLUTIONS.

Blocked on the same point as the mentions légales. The registered address must appear here too. See the blocking note at the top of mentions-legales.md — the recommended fix is to move the siège social to a commercial domiciliation address before publishing either page.

Privacy contact: privacy@hirecall.ai Postal: [[REGISTERED ADDRESS]], marked for the attention of [[PRIVACY CONTACT ROLE]]

To confirm. Whether HireCall must appoint a Data Protection Officer under Article 37 GDPR is a real question, not a formality: the core activity is large-scale processing of candidate data on behalf of employers, including voice recordings. Even if no DPO is legally required, one should be named here as a contact point — procurement teams will ask. See README.

What we collect, and why

1. If you book a demo

The demo form asks for:

What happens to it. The form does not write to a database. It sends the contents to HireCall by email, using Resend, with your address set as the reply-to. In plain terms: the data ends up in a HireCall mailbox, and a copy sits in Resend's sending records for as long as Resend keeps them.

We say this precisely because "we don't store it in a database" is not the same as "we don't keep it", and we would rather not leave you with the wrong impression.

Why we may use it: to reply to you, prepare and hold the demo, and follow up about it.

Legal basis: our legitimate interests in responding to a business enquiry you sent us and in pursuing the commercial relationship you initiated (Article 6(1)(f) GDPR). Where the exchange turns into steps towards a contract, Article 6(1)(b) also applies. You asked us to get in touch, so we think the balance plainly favours replying; if you disagree, you can object at any time (see Your rights).

A word about the free-text field. The "job post / role" box accepts up to 5,000 characters, and we do not inspect what goes into it. Please do not paste anything you would not want sitting in an inbox: CVs, applicant details, the name and contact details of colleagues who have not agreed to it, or anything confidential. If you do send us personal data about other people, you are the one who needs a basis for sharing it, and we will delete it if you tell us it should not have been sent.

2. If you sign up to the newsletter

We collect your email address only. It is added as a contact in a Resend "audience" and used to send occasional updates about HireCall.

Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time using the unsubscribe link in any message, or by emailing privacy@hirecall.ai. Withdrawing does not affect anything sent before.

3. When you simply visit

The site is a static site. To serve it at all, our host receives ordinary technical data — your IP address, the page requested, the time, your user agent — and keeps it in server and security logs. We do not use those logs to build a profile of you.

We also measure how the site is used and how fast it loads, with two cookieless tools from our host, Vercel: Web Analytics and Speed Insights. Nothing is stored on or read from your device. For each page view, Vercel records for us: the page and the referrer, filtered query parameters, coarse location derived from your IP address (country, region, city — the address itself is not kept in the analytics data), browser and version, device type and operating system, and page performance metrics. Visits are counted with a short-lived hash derived from the incoming request and discarded within 24 hours. The data we see is aggregated, cannot identify you, is not shared across sites and is not used for advertising.

Legal basis: our legitimate interests in delivering the site securely, keeping it working, and understanding in aggregate how it is used (Article 6(1)(f) GDPR). You can object at any time (see Your rights). Because we cannot single you out in the analytics data, the most effective route is a browser content blocker: it stops these tools loading, and the site works identically without them.

To confirm. The exact retention period of Vercel's request and firewall logs, and of the aggregated analytics data, depends on the plan. Both must be stated here as numbers, not left vague. The description of what the analytics collect is taken from Vercel's published documentation (re-verified 20 August 2026) and should be re-checked when the packages are upgraded.

4. If you try the interview from the landing page

The landing page has a button that invites you to take a sample interview yourself. That button does not run an interview on this site. It hands you over to the HireCall product application at [[APP DOMAIN]], passing the role you picked and a return address so you can be brought back afterwards. No personal data is placed in that link.

Once you are on the product application, the notice that applies is the one shown there before the interview begins, and the Candidate Privacy Notice explains what an interview means in general.

The demo is not recorded. Your audio is never captured. A temporary transcript drives the conversation and is destroyed when you return to this site, or automatically shortly afterwards if you never come back. Nothing you said reaches this website: the brief you are shown afterwards is a worked example written in advance, identical for everyone who tries that role, and it is labelled as such on the page.

To confirm. For demo interviews taken from the marketing site there is no employer, so HireCall is the controller — not a processor — for the short-lived processing that happens during the call. The product application must present a HireCall-as-controller notice in that case, with its own legal basis (consent) and its own retention period. This is a genuine gap between the two applications and needs to be closed before launch. See README.

If you ask for your three free interviews after the demo

At the end of the demo you can ask us to set up a workspace. That form collects your work email address, and — as a separate, optional tick box — whether you also want us to contact you about it. The setup request is honoured whether or not you tick it: the two are deliberately not bundled, and the box is never pre-ticked.

The request travels with a single-use code, valid thirty minutes, that ties it to the demo you just took. The code says which of the predefined roles you were reading. It carries nothing you said.

If you tick the optional box we record the fact, the wording you were shown and the moment you ticked it, so we can show what you agreed to. You can withdraw at any time from the link in any message we send, or by writing to privacy@hirecall.ai.

What we do not do

We want to be specific rather than reassuring:

• No cookie-based and no third-party analytics. The only measurement is Vercel's cookieless Web Analytics and Speed Insights, described above — no Google Analytics, no Plausible, no PostHog, nothing that stores or reads anything on your device.
• No advertising or tracking pixels. None, from anyone.
• No cookies today. The site sets no cookies and writes nothing to local storage. This will need re-checking when the anti-bot challenge on the /demo page is switched on — see Cookies, which says exactly what must be verified on that day.
• No cross-site tracking, no session recording, no heatmaps. The analytics identifier is a daily-rotating hash that means nothing outside this site.
• Fonts are served from our own domain. The typefaces come from Google Fonts but are downloaded when the site is built and served from our host, so your browser makes no request to Google when you visit.
• No selling or sharing for others' marketing. We do not sell personal data and do not share it with third parties for their own marketing.
• No automated decision-making in the sense of Article 22 GDPR happens on this website.

How long we keep things

Where a shorter period is possible, we apply it. Where we must keep something longer to defend a legal claim or meet an accounting obligation, we keep only what that requires.

Who else sees this data

We use a small number of service providers. They act on our instructions and may not use the data for their own purposes.

These three are the only providers involved in the website. The longer list of sub-processors that appears in the DPA relates to the interview product, not to this site. Do not read the two lists as one.

To confirm — all of it. The provider list above is HireCall's current understanding and has not been verified against signed contracts. Cloudflare is listed because the code that calls it is merged, not because it is live: no Turnstile key is configured today, so no visitor's browser has yet contacted Cloudflare. Confirm its contracting entity and transfer mechanism before the key is set, not after. Before publication, confirm for each one: the contracting entity, the data location, the transfer mechanism, and that a data processing agreement is actually in place. Publishing an unverified list is worse than publishing none, because it is a statement customers and the CNIL are entitled to rely on.

Beyond these, we may disclose data to our professional advisers, or to a public authority or court where the law requires it.

Transfers outside the EU

The interview product lets a customer keep candidate data in the EU or the US. This website is a separate question, and the honest answer is that at least some website data is likely to be handled in the United States, because Vercel and Resend are US companies.

Where data goes to the United States, we rely on one of:

• the European Commission's adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework, where the provider is certified under it; or
• the European Commission's standard contractual clauses (Decision 2021/914), together with an assessment of the transfer.

You can ask us for a copy of the safeguards in place by writing to privacy@hirecall.ai.

For review. The Data Privacy Framework is currently valid: the General Court dismissed the challenge to it in Latombe (T-553/23) on 3 September 2025, and the appeal filed on 31 October 2025 is pending before the Court of Justice (Case C-703/25 P; no hearing date as at 19 August 2026). Two things follow. First, HireCall should verify each US provider's live certification rather than assume it. Second, the DPA should already contain a fallback to standard contractual clauses so that an adverse judgment does not stop processing overnight. See dpa.md.

Your rights

Under the GDPR and the French loi Informatique et Libertés you may ask us to:

• See the personal data we hold about you, and get a copy;
• Correct it if it is wrong or incomplete;
• Delete it, where the law allows;
• Restrict what we do with it while a dispute is resolved;
• Receive it in a portable form, where we hold it on the basis of consent or a contract and process it by automated means;
• Object to processing based on our legitimate interests, on grounds relating to your situation — and, for direct marketing, at any time and without needing a reason;
• Withdraw consent where we rely on it;
• Give directions about what happens to your data after your death, as Article 85 of the French loi Informatique et Libertés allows.

Write to privacy@hirecall.ai. We will reply within one month, and will tell you if we need longer because the request is complex. We may need to check who you are before acting — we will ask for the least we can get away with.

If you are unhappy with how we have handled it, you can complain to the CNIL:

CNIL — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr

You may also go to court.

Security

We keep the site static, which removes most of the ways a marketing site gets attacked: there is no database behind it and no user accounts on it. Traffic is encrypted with TLS. Access to the mailbox that receives demo requests, and to the Resend account, is limited to the people who need it and protected by multi-factor authentication.

To confirm. State the actual controls rather than the aspiration: is MFA enforced on the Vercel, Resend and mailbox accounts today? See README.

Children

This site is aimed at employers and recruitment teams. It is not directed at children and we do not knowingly collect their data.

Changes

If we change this policy we will update the date below and, where the change matters, say so on the site. Material changes affecting newsletter subscribers will be sent by email.

Last updated: [[PUBLICATION DATE]]