Privacy Policy

Last updated: October 9, 2026

Hiroo ("Hiroo", "we", "us") operates an AI-assisted recruiting platform that helps companies screen résumés, conduct automated screening calls, and schedule interviews. This Privacy Policy explains what information we collect, how we use it, and the choices you have — including when you connect your Google Calendar.

1. Information we collect

• Account information — name, email address and role, for recruiters and company admins who sign in to Hiroo.
• Candidate information — résumé, contact details, and any information a candidate submits when applying through a Hiroo-generated link, together with the consent choices they select (data processing, call recording, WhatsApp messaging).
• Google Calendar information — if a recruiter chooses to connect their Google Calendar, see Section 2 below.

2. How we use Google user data

Hiroo integrates with Google Calendar so a recruiter can automatically schedule interviews. When a recruiter connects their calendar, Hiroo requests only these two OAuth scopes:

• calendar.events.freebusy — to read which time blocks are already busy on that recruiter's own calendar, so Hiroo can propose open interview slots.
• calendar.events.owned — to create a calendar event (the interview) on that same recruiter's own calendar, with the candidate added as an attendee and a Google Meet link generated automatically.

Hiroo does not request access to any other Google data — no Gmail, no Drive, no Contacts — and does not read, modify or delete any calendar other than the one the recruiter explicitly connected. Google user data obtained through this integration is used solely to provide the scheduling feature described above. It is never used for advertising, never sold, and never shared with third parties, except with the service providers described in Section 4 strictly to operate the Service.

Hiroo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How we store and protect data

Google refresh tokens are encrypted at rest (AES-256-GCM) and are never shown in plain text to any user, including Hiroo staff, through the product interface. Our infrastructure runs on Google Cloud Platform. Access to production data is limited to the personnel who operate the platform.

4. Who else processes this data

We rely on a small number of service providers to operate Hiroo, each acting on our instructions:

• Google Cloud Platform — hosting, database and file storage.
• Firebase Authentication — recruiter and admin sign-in.
• Postmark — transactional email delivery.
• Telnyx — phone calls and WhatsApp messaging with candidates, where enabled.

None of these providers is permitted to use Google user data for their own purposes.

5. Your choices and how to revoke access

A recruiter can disconnect their Google Calendar at any time from Settings → Integrations → "Disconnect". Disconnecting immediately revokes Hiroo's Google token and deletes the stored refresh token from our database. You can also revoke access directly from your Google Account permissions page.

Candidates may request access to, correction of, or deletion of their information by contacting us at the address below.

6. Data retention

We retain account and candidate data for as long as the hiring organization's account is active, or as needed to provide the Service, unless a longer retention period is required by law. Encrypted Google refresh tokens are deleted immediately on disconnection.

7. Children's privacy

Hiroo is intended for use by companies and job applicants of working age. It is not directed at children, and we do not knowingly collect information from children.

8. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

9. Contact us

Questions about this policy, or requests regarding your data, can be sent to admin@usehiroo.co.