Privacy Policy
Last updated: 26 September 2026
Who we are
DuetHire is operated by DuetHire ("we", "us"). We are the controller of the personal data described here. Where an employer uses DuetHire to hire, the employer decides how it uses your application and we process it on the employer's behalf.
Questions: founder@duethire.com.
What we collect and why
We only collect what the features need. Each group below lists the purpose and our lawful basis.
Account
Name, email address, password (stored only as a hash) if you sign up with email, or your Google or LinkedIn account ID, name, email and profile photo if you sign in with them; your role (job seeker or employer) and notification preferences.
Why: Create and secure your account, sign you in, send service emails. Lawful basis: Contract.
Profile and resume
Resume files you upload, the text we extract from them, tailored resumes you generate, skills, and verification documents you choose to upload (identity, education, employment, skills).
Why: Build your profile, tailor resumes, match you to jobs, show verified badges. Lawful basis: Contract.
Job activity and applications
Job searches, saved jobs, match scores, applications and their status, outreach drafts (including recruiter names and companies you enter), and your Google Calendar events if you connect Calendar.
Why: Run the job search, application tracking, outreach and interview scheduling features. Lawful basis: Contract.
Employer data
Company details, team members and roles, job posts, applicant pipeline stages, notes and rejection reasons, and a log of actions taken on applicants.
Why: Let employers post jobs and manage hiring; keep an audit trail of hiring actions. Lawful basis: Contract; legitimate interest (audit trail).
Assessment answers and proctoring signals
Your answers, code and SQL submissions, scores, AI interview transcripts, and during assessments the number of times you switch tabs or copy/paste. We do not record your camera, screen or microphone. AI interviews can use your browser's built-in speech recognition to turn speech into text; we receive only the text. If the face check is on for an AI interview, your browser checks locally that a face is in view; the video never leaves your device and we store only flags with timestamps (no face, more than one face, camera off, tab switch, paste).
Why: Grade assessments and give the employer an honest picture of how the assessment was taken. Lawful basis: Contract; legitimate interest of the employer in test integrity.
Usage analytics
Pages viewed, clicks and product events, device and browser type (via PostHog).
Why: Understand which features are used and improve them. Lawful basis: Consent.
Error logs and session replays
Error reports and performance traces, and for a sample of sessions a replay of the page with all text masked (via Sentry).
Why: Find and fix bugs. Lawful basis: Legitimate interest (error logs); consent (session replay).
Cookies and local storage
See the cookies section below.
Why: Keep you signed in, remember your preferences and consent choice. Lawful basis: Strictly necessary; consent for analytics.
We do not sell your personal data and we do not use it for advertising.
How we use AI
These features send text to AI models from OpenAI or Google (Gemini):
- Resume parsing: the text of the resume you upload.
- Resume tailoring and gap analysis: your resume or profile and the job description.
- Outreach drafts: your profile, the job, and the recruiter name and company you enter.
- Job listing analysis: public job listings only, no personal data.
- Employer tools: job descriptions and assessment or interview questions: the job details the employer enters.
- Employer tools: applicant screening: the applicant's resume and application, and the job post.
- AI interviews: the questions and your transcribed answers, to ask follow-ups and write an evaluation for the employer.
Your match score is calculated by a model that runs on our own AI service plus fixed rules; that text is not sent to OpenAI or Google. Assessment answers are graded by fixed rules and by running your code on Judge0, not by an AI model.
OpenAI requests are sent with storage turned off; per OpenAI's API terms, API data is not used to train their models.
AI output can be wrong, incomplete or biased. Review every tailored resume, message and score before you rely on it or send it.
No hiring decision is made automatically; employers make every accept/reject decision. Screening summaries, match scores and interview evaluations are there to help employers, not to replace them.
Who we share data with
These service providers process personal data for us, only to run DuetHire. Employers you apply to also receive your application, and the resume and answers you submit to them.
| Provider | What it receives | Where |
|---|---|---|
| Supabase | Database and file storage: all account, profile, resume, application, employer and assessment data. | See provider |
| Vercel | Hosts the web app: every request, including your IP address and the data you send. | See provider |
| AI service host | Runs our AI service: the text sent to AI features (see How we use AI). | See provider |
| OpenAI | Text sent to AI features: resume text, job descriptions, outreach inputs, interview transcripts and applicant details for screening. | United States |
| Google (Gemini API) | The same kinds of text as OpenAI, for the features routed to Gemini. | See provider |
| PostHog | Usage events, device and browser details and IP address, tied to a random ID rather than your name or email. | United States |
| Sentry | Error reports, performance traces and masked session replays. | See provider |
| Resend | Your email address and the content of emails we send you. | See provider |
| Stripe | Your name, email and subscription details; card details go directly to Stripe, not to us. | See provider |
| Upstash | Your IP address or a session identifier, briefly, to rate-limit requests. | See provider |
| Google (Sign-in and Calendar) | Only if you use them: your sign-in request, and for Calendar the events we read and create. | See provider |
| Only if you sign in with LinkedIn: your sign-in request. | See provider | |
| Judge0 (via RapidAPI) | Code you submit in coding assessments, without your name or email. | See provider |
Our recruiter email finder checks whether a company domain accepts email through Cloudflare's public DNS service. Only the domain is sent, never a name or email address.
International transfers
Several providers process data outside India and the EEA: PostHog and OpenAI in the United States, and Vercel, Stripe, Sentry and Resend may also do so. They process it under their standard contractual terms, including standard contractual clauses where EU law requires them.
Your rights
- Access and export: see and download your data from your settings, or ask us for a copy.
- Correction: edit your profile and resumes in the app, or ask us to fix anything you can't edit.
- Deletion: email founder@duethire.com to delete your account. We confirm your password (if you use one) and, if you are the only admin of a company that still has other members, ask you to hand over admin first. Deletion immediately disables your account and wipes your identifiers: name, email, profile photo, password, sign-in link, connected Google Calendar and billing customer IDs. Other records (resumes, applications, outreach drafts, assessment answers) are kept until permanent erasure, which you can request at the same address and which we complete within 30 days.
- Withdraw consent: turn analytics and session replay off at any time in cookie settings.
- Object or restrict: ask us to stop processing based on legitimate interest.
- Complain: to your local data protection authority (in the EU or UK), or to the Data Protection Board of India once you have used our grievance process.
How long we keep data
- Account, profile, resumes, job activity, applications, employer data and assessment answers: until you delete your account, then as described under Deletion above.
- Sign-in session: up to 30 days, or until you sign out.
- Proctoring counts in your browser: until you close the tab.
- Usage analytics, error logs and session replays: for the retention period set in PostHog and Sentry.
- Payment records held by Stripe: under Stripe's own retention and legal obligations.
Cookies and local storage
On your first visit a banner asks about optional tracking. You can Accept all, Reject all, or Customize with two switches: Analytics (PostHog) and Session replay (Sentry replay). Both are off until you turn them on. Error reporting (Sentry error logs, without replay) stays on without consent, because we need it to keepDuetHire working (legitimate interest).
Change your cookie settings at any time; the footer's "Cookie settings" link does the same.
- Sign-in session (authjs.session-token, authjs.csrf-token, authjs.callback-url): strictly necessary.
- Your cookie choice (local storage "fv-consent": your choices, when you made them and the policy version): strictly necessary, so we remember it and ask again if this policy changes.
- Theme preference (local storage "theme"): strictly necessary, remembers light or dark mode.
- Assessment proctoring counts (session storage): strictly necessary during an assessment.
- PostHog analytics (cookie and local storage starting "ph_"): only with your consent.
- Sentry session replay (session storage): only with your consent.
Children
DuetHire is for people aged 18 and over. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.
Contact us
For any privacy question or to use your rights, email founder@duethire.com. We reply within 2 business days.
If you are in the EU, EEA or UK, you can reach us at the same address for any GDPR request; DuetHire is the controller.
Grievance Officer (India)
Under India's Digital Personal Data Protection Act, 2023, you can raise a grievance about how we handle your personal data with our Grievance Officer:
Grievance Officer, DuetHire
grievance@duethire.com
We respond within 2 business days. If you are not satisfied, you can complain to the Data Protection Board of India.
Changes to this policy
If we change this policy in a way that matters, we will update the date above and tell you by email or in the app before the change takes effect.