100Hires Privacy Policy
Last updated: 27 August 2026
Quick (Layered) Notice
Who we are – 100Hires Inc., 2093 Philadelphia Pike #1391, Claymont DE 19703, USA.
What we collect – contact data, account credentials, usage data, cookies, applicant information uploaded by clients.
Why – to deliver and improve our recruitment platform, comply with law, and communicate with you.
Your choices – access, correct, delete, opt‑out of sales/sharing and targeted ads, manage cookies, limit use of sensitive data.
Transfers – EU customers are hosted in Germany, all other customers in the United States; transfers outside the EEA and the UK are protected by Standard Contractual Clauses (2021).
Contact – privacy@100hires.com.
Full details follow.
1 Definitions
- “Client” – a customer of 100Hires.
- “User” – an employee or agent of a Client with login credentials.
- “Visitor” – anyone accessing public areas of our Site without logging in.
- “Personal Data” – any information relating to an identified or identifiable natural person.
- “Client Data” – Personal Data and other information that a Client or User uploads to the Service.
- “Sensitive Personal Information” (as defined by the California Privacy Rights Act, “CPRA”) – e.g. precise geolocation, biometric identifiers, government IDs.
2 Scope of this Policy
This Policy applies to https://100hires.com, https://app.100hires.com, the 100Hires API and any site, app or communication where it is linked (collectively, the “Service”). By using the Service, you agree to the practices described here.
3 Information We Collect
3.1 Data You Provide
Category |
Examples |
Legal basis (GDPR) |
Account data |
Name, company, email, password |
Art. 6 (1)(b) contract |
Billing |
Address, VAT/Tax ID, payment method |
Contract, Legitimate interest |
Communications |
Support tickets, survey responses |
Legitimate interest, Consent |
3.2 Client Data Uploaded by Clients
100Hires acts solely as a Processor for Client Data. Clients are responsible for providing any required privacy notices to data subjects.
A GDPR-compliant Data Processing Agreement under Art. 28, including Standard Contractual Clauses for international transfers, is available at privacy@100hires.com. We notify customers before adding or replacing a sub-processor.
3.3 Automatically Collected Data
IP address, device type, pages visited, interaction events, error logs. Collected via cookies, SDKs and server logs.
3.4 Integrated Services
If you sign in with Google or LinkedIn, we receive basic profile info (name, email, avatar URL).
3.5 Data from Third Parties
We may receive lead data from marketing partners and combine it with your account data.
3.6 SMS Communications
When you opt-in (via our website checkbox, email confirmation, or texting START to our dedicated number), 100Hires may send you account notifications, interview reminders, and other recruiting-related messages at the phone number you provide. Message frequency varies. Msg & Data rates may apply. You can cancel at any time by replying STOP or turning SMS off in your account settings. For help, reply HELP or email support@100hires.com. We store opt-in/out records (phone, time, IP) for at least four (4) years to comply with TCPA/CTIA.
4 How We Use Personal Data
- To provide, secure and maintain the Service.
- To improve and develop new features (aggregate/anonymous analytics only).
- To send administrative and promotional communications (you may opt out of the latter).
- To detect, prevent and mitigate fraud, abuse and security risks.
- To comply with legal obligations.
5 Cookies & Tracking Technologies
We use first‑ and third‑party cookies for: (i) strictly necessary operations; (ii) preferences; (iii) statistics (Google Analytics 4 with IP anonymization and 14‑month retention); (iv) marketing.
You can manage non‑essential cookies via our banner or through your browser. We honour Global Privacy Control (GPC) signals.
6 Sharing & Disclosure
Recipient |
Purpose |
Safeguard |
Hetzner Online GmbH (Germany, EU customers) |
Infrastructure |
ISO 27001, DPA |
Amazon Web Services (US, Canada, rest of world) |
Infrastructure |
SOC 2 Type II, ISO 27001, SCC 2021 |
Paddle |
Billing (merchant of record) |
PCI-DSS SAQ A |
Postmark |
Transactional email delivery |
SOC 2 Type II, DPA |
Twilio |
SMS and voice |
SOC 2 Type II, DPA |
Zoom |
Interview scheduling |
SOC 2 Type II, DPA |
Gusto |
HR and payroll integration (client-enabled) |
SOC 2 Type II, DPA |
OpenAI, Anthropic, Google (Gemini API) |
AI scoring, AI Copilot, AI Email Composer |
SOC 2 Type II; paid API tiers, no training on customer content |
Google Analytics 4, Mixpanel, Microsoft Clarity, PostHog |
Product and site analytics |
Contractual terms |
LinkedIn Ads, Google Ads |
Marketing (opt-in/opt-out) |
Contractual terms |
Law enforcement or regulators |
Legal compliance |
As required by law |
We do not sell Personal Data for money. Under CPRA we may “share” data for cross‑context behavioural advertising; you may opt out at any time.
7 International Transfers
- Data residency: EU customers are hosted in Germany; customers in the US, Canada and the rest of the world are hosted in the United States.
- Standard Contractual Clauses (2021): Where a sub-processor processes personal data outside the EEA or the UK, the transfer is governed by the European Commission’s Standard Contractual Clauses, and each sub-processor with access to customer data has executed a Data Processing Agreement with 100Hires.
- Transfer Impact Assessments are reviewed annually.
8 Your Rights
Jurisdiction |
Rights |
GDPR / UK GDPR |
Access, rectify, erase, restrict, portability, object, lodge complaint with DPA |
California (CPRA) |
Know, delete, correct, opt‑out of sale/share, limit SPI, non‑discrimination |
Colorado, Connecticut, Virginia, Utah |
Access, delete, portability, opt‑out of targeted ads & sales |
Brazil (LGPD) |
Confirm processing, access, correct, anonymise, portability, delete, revoke consent |
Submit requests via privacy@100hires.com. For GDPR and UK GDPR requests we respond within one month, extendable by up to two further months for complex requests. For CPRA and other US state-law requests we respond within 45 days, extendable once by 45 days.
9 Security Measures
We implement TLS 1.2+ encryption in transit, AES-256 at rest, role-based access control, and MFA for staff access to production systems. 100Hires is in the process of obtaining SOC 2 Type II attestation and does not hold it yet; our controls map to the SOC 2 Trust Services Criteria for security, availability and confidentiality. We do not hold ISO 27001 for the application; our infrastructure providers hold ISO 27001. If a personal data breach affecting your data is confirmed, we notify the registered account contact within 72 hours, followed by a detailed report within 7 days.
10 Data Retention
Data Category |
Retention period |
Rationale |
Active account data |
Life of account + 6 months |
Service provision, dispute resolution |
Candidate data (client-configured) |
1 to 60 months, set by the client, with optional automatic deletion |
Client retention policy |
Back‑ups |
90 days rolling |
Disaster recovery |
Billing records |
7 years |
Tax & accounting laws (US & EU) |
Logs |
90 days |
Security & analytics |
11 Children’s Privacy
The Service is not directed to anyone under 18. We do not knowingly collect data from minors.
12 Automated Decision‑Making & AI
100Hires may provide ranking or matching suggestions. No decision affecting legal or similarly significant matters is made without human involvement. Clients remain the controllers of candidate decisions.
AI features (AI Score, AI Copilot, AI Email Composer) send data to third-party providers listed in section 6. 100Hires does not train its own models on customer data, and uses paid API tiers where the provider is contractually committed not to train on customer content.
13 Changes to this Policy
We will post any changes on this page and notify registered Users by email 30 days before they take effect.
14 Contact Us
Email: privacy@100hires.com
Address: 2093 Philadelphia Pike #1391, Claymont DE 19703, USA