1. Introduction

SortList ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered recruiting platform.

2. Information We Collect

We may collect the following types of information:

Account Information: Name, email address, company name, and job title when you create an account or join the waitlist.
Job & Candidate Data: Job descriptions, candidate resumes, interview notes, and feedback that you upload or generate through the platform.
Usage Data: Information about how you interact with our platform, including pages visited, features used, and time spent.
Device Information: Browser type, operating system, IP address, and device identifiers.
Calendar Data: Calendar availability information when you connect your calendar for interview scheduling.

3. How We Use Your Information

We use the information we collect to:

Provide, operate, and improve our recruiting platform and AI features.
Screen and shortlist candidates based on your job requirements.
Schedule interviews and manage calendar coordination.
Send automated communications to candidates on your behalf.
Provide analytics and insights on your hiring process.
Communicate with you about your account, updates, and support.
Ensure security and prevent fraud.

4. AI & Data Processing

Our AI processes candidate resumes and job descriptions to provide shortlisting, scheduling, and communication features. AI-generated assessments are designed to be bias-free and based solely on skills and experience. Your data is used only within your account and is never shared with other customers or used to train models for other organizations.

5. Data Sharing & Sub-processors

We do not sell your personal information. We share data only with the third-party services required to operate the platform (such as our cloud provider, AI model providers, and email delivery service). Each sub-processor is bound by a Data Processing Agreement requiring them to handle data with the same standards we do.

See our full Sub-processors list for the specific vendors we use, what data each receives, and where it's processed.

We may also disclose data when:

Legally required: in response to valid legal process or to comply with applicable law.
Business transfer: in connection with a merger, acquisition, or sale of assets, subject to the same privacy obligations.

6. Data Security

We implement industry-standard security measures including encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, multi-tenant isolation, audit logging, and regular security reviews. See our Security page for a detailed description of our controls. No method of transmission over the internet is 100% secure, but we work continuously to protect your data.

7. Data Retention

We retain personal data only as long as needed to provide the platform or as required by law:

Account data: retained while your account is active. Deleted within 30 days of account closure, except where retention is required by law.
Candidate data: retained while the customer's account is active or until the customer deletes the candidate record. Candidates may also request deletion directly by contacting us.
Audit logs: retained for up to 12 months for security and abuse-investigation purposes.
Backups: automated backups are retained for 7 days, then purged on rolling basis.

8. Your Rights (GDPR / DPDP / CCPA)

Depending on your location, you may have the following rights regarding your personal data:

Access: request a copy of the personal data we hold about you.
Correction: ask us to correct inaccurate or incomplete data.
Deletion ("right to be forgotten"): ask us to delete your personal data, subject to legal retention requirements.
Portability: request your data in a machine-readable format.
Restriction / objection: object to or restrict certain types of processing.
Consent withdrawal: withdraw any consent you've given, at any time.
Complaint: lodge a complaint with your local data-protection authority.

To exercise any of these rights, email us at privacy@sortlistnow.com. We will respond within 30 days.

9. International Data Transfers

SortList is hosted in the United States. If you access the platform from outside the U.S., your data will be transferred to and processed in the U.S. by us and our sub-processors. Where data is transferred from the EU, UK, or India, we rely on Standard Contractual Clauses (SCCs) and other appropriate safeguards required under GDPR and DPDP.

10. Children's Data

SortList is intended for use by recruiters and adult job candidates only. We do not knowingly collect personal data from children under 18. If you believe a child has provided data to us, please contact us and we will delete it.

11. Breach Notification

In the event of a personal data breach affecting your data, we will notify you and the relevant supervisory authority without undue delay and within 72 hours where required by applicable law.

12. Cookies

We use essential cookies to operate the platform and analytics cookies to understand usage patterns. You can manage cookie preferences through your browser settings.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page with a revised date.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us at privacy@sortlistnow.com.