Privacy Policy
Last updated: July 26, 2026
The short version
We collect the minimum data needed to run a hiring platform. We use AI to score candidates. We do not sell your data. We do not use your data to train general-purpose AI models. You can delete your data at any time.
Who we are
notanATS is a Canadian company. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. For users in the EU, we also comply with the General Data Protection Regulation (GDPR). For users in California, we comply with the California Consumer Privacy Act (CCPA).
For privacy questions, contact privacy@notanats.com.
Two parts of our service
notanATS has two parts, and this policy is explicit about which practices apply to each.
- The website: the public pages you're reading now, including pricing, FAQ, and this policy. Analytics and behavioral tracking tools, described below, run only here.
- The platform: the signed-in hiring tool where managers post positions and candidates complete screening conversations. Analytics and behavioral tracking tools are never active here, and never see candidate data.
Every data category and every third-party service below states which part it applies to.
What data we collect
From hiring managers
- Account info: name, email, organization name
- Job postings: position titles, descriptions, screening dimensions and criteria
- Usage data: login times, feature usage, session data
- Payment info: processed by Stripe; we never see or store your full card number
From candidates
- Interview responses: answers to AI-powered screening conversations
- Self-assessments: candidates' own ratings of their fit on each dimension
- Contact info: name and email (provided during application)
- Uploaded materials: résumés or other documents candidates choose to share
- Transparency scores and dimension scores: generated by AI based on interview responses
Automatically collected
- IP address, browser type, device info
- Pages visited, actions taken (anonymized analytics)
- Error logs for debugging
How we use your data
| Data | Purpose |
|---|---|
| Interview responses | Generate candidate evaluations using AI |
| Screening dimensions | Configure AI conversation structure |
| Scores and evaluations | Present hiring insights to managers |
| Calibration data | Improve scoring accuracy for your specific roles |
| Account and contact info | Operate your account, send service emails |
| Usage data | Improve the product, fix bugs |
| Payment info | Process subscription payments via Stripe |
We do not:
- Sell your data to anyone
- Use candidate data to train general-purpose AI models
- Share data with advertisers
- Make automated hiring decisions (all AI outputs are advisory)
Legal basis for processing (EU/UK GDPR)
For candidates in the EU and UK, our lawful basis for processing your data is legitimate interests under Article 6(1)(f) of the GDPR. The legitimate interest is conducting candidate screening in the context of the employment relationship between you and the hiring organization that posted the position you applied for. You can object to this processing at any time (see Your rights).
Automated decision-making (GDPR Article 22)
notanATS does not constitute solely automated decision-making within the meaning of GDPR Article 22. Although AI generates scores and evaluations, a human hiring manager reviews those outputs and takes every consequential hiring action. No candidate is advanced, interviewed, or rejected by the AI alone. A human manager makes each consequential decision.
AI processing
AI data processing statement
Interview data is processed by Anthropic but is not used to train AI models per Anthropic's data usage policy.
Candidate interview responses are processed by AI (powered by Anthropic's Claude API) to generate scores and evaluations. This means:
- Candidate answers are sent to Anthropic's API for analysis
- Anthropic processes this data under their data usage policy, which prohibits using API inputs for model training
- AI outputs (scores, evaluations) are stored in our database
- The AI evaluates against the specific dimensions the hiring manager defined. Nothing else.
EU AI Act disclosure
notanATS is classified as a high-risk AI system under Annex III, Category 4 (employment, workers management and access to self-employment) of the EU AI Act, because it is used to screen candidates during recruitment.
The system is subject to mandatory human oversight. It produces advisory scores and evaluations only; the hiring manager makes all consequential decisions about whether to advance, interview, or reject a candidate. The AI does not make any hiring decision on its own.
For full details on our security and AI data handling, see our Security page.
Third-party services
We use these services to operate notanATS:
| Service | Purpose | Data shared |
|---|---|---|
| SupabasePlatform | Database and authentication | All stored data (encrypted at rest) |
| Anthropic (Claude API)Platform | AI-powered candidate evaluation | Interview responses, screening criteria |
| StripePlatform | Payment processing | Payment details (managed by Stripe) |
| ResendPlatform | Transactional email | Email addresses, email content |
| VercelWebsite and platform | Hosting and delivery | Request logs, IP addresses |
| Google Analytics / Google Tag ManagerWebsite | Website traffic and behavior analytics | Pages visited, device and browser info, approximate location (only after cookie consent is given) |
| Microsoft ClarityWebsite | Session recordings and heatmaps to improve the website | Pages visited, on-page interactions, device and browser info (only after cookie consent is given) |
Each service processes data under its own privacy policy and our data processing agreements.
Microsoft Clarity records behavioral session data on public marketing pages, which may include clicks, scrolling, and navigation. Analytics and behavioral tracking run on public marketing pages only and are never loaded on candidate-facing pages, so candidate name, email, résumé content, and conversation content are never captured by these tools.
Do Not Sell or Share My Personal Information
Under the California Consumer Privacy Act / CPRA, you can opt out of the sale or sharing of personal information. On our public marketing pages, use the footer control labeled exactly Do Not Sell or Share My Personal Information. Choosing it has the same effect as declining cookies: we store cookie-consent: denied and Google Analytics and Microsoft Clarity do not load for you.
This control sits alongside “Cookie settings” in the footer. It is a separate, distinctly labeled link, not merged into cookie settings.
Data retention
- Active accounts: hiring-manager account data is retained while your account is active
- Candidate data: interview responses, self-assessments, and AI-generated scores are retained for 12 months from the position close date, after which they are automatically purged
- Closed accounts: hiring-manager account data is deleted within 30 days of account closure
- Payment records: retained as required by tax and financial regulations
Your rights
Depending on where you are, you may have the right to:
- Access your data: request a full export
- Correct inaccurate data
- Delete your data: we will process within 30 days
- Object to specific processing
- Portability: receive your data in a standard format
To exercise any of these rights, email privacy@notanats.com. We will respond within 30 days.
For candidates specifically
You can request:
- A copy of your interview responses and AI-generated scores
- An explanation of how your scores were generated
Email privacy@notanats.com with your name and the position you applied for.
Data security
- All data encrypted in transit (TLS) and at rest
- Access controls limit who can see what data
- Regular security reviews during beta
- Incident response: we will notify affected users within 72 hours of a confirmed breach
Children
notanATS is not intended for anyone under 18. We do not knowingly collect data from minors.
Changes to this policy
We will notify you by email before material changes take effect. The “last updated” date at the top reflects the most recent revision.
Governing law
This privacy policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, including PIPEDA.
Contact
Privacy questions: privacy@notanats.com
General questions: support@notanats.com