Skip to content
Hirify

Privacy policy

Last updated: September 23, 2026.

This is a translation provided for convenience. The French version prevails.

This policy describes how Hirify SAS processes the personal data of visitors to the hirify.fr website, people who contact us or request a demo, and users of the Hirify application.

Data controller and contact

Hirify SAS, 12 rue de la Part-Dieu, 69003 Lyon, France, SIREN 991 477 951, represented by its President Robin Marquet. For any question about your data, write to our dedicated data protection contact: rgpd@hirify.fr.

Our two roles depending on the data

Hirify is the controller for the data of website visitors, prospects and application users (account management, billing, support, usage measurement). This policy applies to that processing.

For candidate data and interview content processed in the application on behalf of our recruiting customers, Hirify acts as a processor within the meaning of Article 28 of the GDPR. The recruiting customer is the controller: it determines the purposes, the legal basis and how candidates are informed. This processing is governed by our terms and the data processing agreement concluded with each customer.

Are you a candidate? Send your access, rectification or erasure requests to the company that interviewed you. If you write to us, we forward your request to the customer concerned without delay and help them respond.

Processing for which Hirify is controller

  • Website audience measurement. Data: pages viewed, source of the visit (referrer, campaign parameters), interaction events (button clicks, scrolling, sections viewed, use of the simulator), device type. Purpose: measure audience and improve the site. Legal basis: legitimate interest (Article 6(1)(f) GDPR), within the consent exemption for audience measurement set out by the CNIL (see the Cookies section).
  • Demo and contact requests. Data: name, professional email address, company, chosen time slot, content of your messages. Purpose: respond to your request and handle commercial follow-up. Legal basis: pre-contractual steps taken at your request (Article 6(1)(b)) and legitimate interest in prospecting professionals (Article 6(1)(f)).
  • Account management and contract performance. Data: name, email address, role, organization, login metadata, authentication secrets. Purpose: provide the application, manage access, send service emails, provide support. Legal basis: performance of the contract (Article 6(1)(b)).
  • Billing. Data: billing identity and contact details, payment history (card data is processed directly by our payment provider). Purpose: invoice and collect subscriptions. Legal basis: performance of the contract and legal accounting and tax obligations (Article 6(1)(b) and 6(1)(c)).
  • Application usage measurement and security. Data: usage events, technical identifiers, access logs. Purpose: improve the product, prevent abuse and secure the service. Legal basis: legitimate interest (Article 6(1)(f)).

Retention periods

  • Prospects (demo and contact requests): 3 years from your last contact.
  • Audience measurement trackers: maximum lifetime of 13 months.
  • User accounts: for the term of the contract, then deleted under the end-of-contract terms set out in our terms, subject to records needed as evidence during the statutory limitation period.
  • Accounting records and invoices: 10 years, in accordance with Article L123-22 of the French Commercial Code.
  • Support exchanges and technical logs: as long as needed to handle the request and secure the service, and at most the term of the contract.

Cookies and trackers

Audience measurement (PostHog). On the hirify.fr website, a first-party cookie and the browser's local storage are used for audience measurement. This measurement is configured to meet the conditions of the CNIL consent exemption: purpose limited to audience measurement, no tracking across other sites and no identifier shared with the application, no session recording, IP address not stored, tracker lifetime limited to 13 months. Requests go through a relay on our own domain (/h-link); PostHog (hosted in the European Union) receives the data as a processor.

Meeting booking (Google Calendar). The demo booking calendar, a Google Calendar booking page, is loaded only when you open the demo window. Google may then set its own cookies, governed by its privacy policy.

Objecting. Since audience measurement is exempt from consent, no banner is displayed. You can object at any time with the button below, or by blocking the site's cookies and local storage in your browser, without affecting your access to the site.

This section concerns only the hirify.fr website, not the Hirify application.

Recipients and sub-processors

Your data is intended for authorized Hirify staff and for the following sub-processors, acting on our instructions:

  • Scalingo: hosting of the website and application (France).
  • Scaleway: storage of application files (France).
  • PostHog: audience and usage measurement (European Union).
  • Scaleway: hosting of our commercial follow-up tool (Twenty CRM, self-hosted, France).
  • Google (Google Calendar): demo meeting booking (group established in the United States: see Transfers).
  • Stripe: payment and billing (Ireland and United States).
  • Brevo: service emails (France).
  • Crisp: customer support (France).

The sub-processors that process candidate data on behalf of our customers (capture, transcription, analysis, search, telephony, calendar, observability) are presented on our Trust & security page; their named list is included in the data processing agreement. Your data is not sold.

Transfers outside the European Union

The application and its data are hosted in France. Some processing nevertheless involves transferring data outside the European Union, or the involvement of an entity established outside the Union:

  • payment and billing (Stripe, United States);
  • meeting booking (Google Calendar: group established in the United States, certified under the EU-U.S. Data Privacy Framework, Commission adequacy decision (EU) 2023/1795);
  • for data processed for our customers: semantic search (Voyage, United States, and Cohere, Canada), calendar synchronization (United States), meeting capture and telephony (data localized in the Union, entities established outside the Union), observability (Switzerland, a country covered by an adequacy decision).

These transfers fall under Chapter V of the GDPR: they rely on an adequacy decision where one exists, or on another mechanism provided for in that chapter, such as the European Commission's standard contractual clauses. You can obtain information about the applicable safeguards by writing to rgpd@hirify.fr.

Security

Hirify implements technical and organizational measures appropriate to the risk: hosting in France, encryption of data in transit and at rest, access partitioned by organization and graded by role, second authentication factor available, access logging and daily backups. Details are on our Trust & security page.

Profiling and automated decision-making

No decision producing legal effects or significantly affecting you is made by automated means regarding website visitors, prospects or users.

For candidates, whose data is processed on behalf of our customers, the application produces interview analyses (structured profile, overall assessment, points of attention, no overall numeric score) and, in profile search, a score from 0 to 100 per criterion, aggregated into a weighted score that ranks candidates against the criteria defined by the recruiter. This processing constitutes profiling within the meaning of Article 4 of the GDPR. Hirify takes no decision about any candidate: the decision rests with the recruiter. Informing candidates under Articles 13, 14 and 22 of the GDPR is the responsibility of the customer acting as controller.

Your rights

You have the rights of access, rectification, erasure, restriction of processing, objection (including, at any time, to direct marketing) and portability, the right to withdraw your consent for processing that relies on it (without affecting the lawfulness of processing already carried out), and the right to set instructions regarding your data after your death.

To exercise these rights, write to rgpd@hirify.fr. We respond within one month, extendable by two months if necessary. Exercising your rights is free of charge; proof of identity may be requested in case of reasonable doubt.

If you believe your rights are not respected, you may lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr).

Changes to this policy

We may update this policy to reflect changes to the service or to the regulations. The date of the last update is shown at the top of the page; application users are informed of significant changes.