Privacy Policy
Last updated: October 18, 2026
The short version
We collect the minimum data needed to run a hiring platform. We use AI to score candidates. We do not sell your data. We do not use your data to train general-purpose AI models. You can delete your data at any time.
Who we are
notanATS is a Canadian company. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. For users in the EU, we also comply with the General Data Protection Regulation (GDPR). For users in California, we comply with the California Consumer Privacy Act (CCPA).
For privacy questions, contact privacy@notanats.com.
Two parts of our service
notanATS has two parts, and this policy is explicit about which practices apply to each.
- The website: the public pages you're reading now, including pricing, FAQ, and this policy. Analytics and behavioral tracking tools, described below, run only here.
- The platform: the signed-in hiring tool where managers post positions and candidates complete screening conversations. Analytics and behavioral tracking tools are never active here, and never see candidate data.
Every data category and every third-party service below states which part it applies to.
What data we collect
From hiring managers
- Account info: name, email, organization name
- Job postings: position titles, descriptions, screening dimensions and criteria
- Usage data: login times, feature usage, session data
- Payment info: processed by Stripe; we never see or store your full card number
From candidates
- Interview responses: answers to AI-powered screening conversations
- Self-assessments: candidates' own ratings of their fit on each dimension
- Contact info: name and email (provided during application)
- Uploaded materials: résumés or other documents candidates choose to share
- Transparency scores and dimension scores: generated by AI based on interview responses
Automatically collected
- IP address, browser type, device info
- Pages visited, actions taken (anonymized analytics)
- Error logs for debugging
How we use your data
| Data | Purpose |
|---|---|
| Interview responses | Generate candidate evaluations using AI |
| Screening dimensions | Configure AI conversation structure |
| Scores and evaluations | Present hiring insights to managers |
| Calibration data | Improve scoring accuracy for your specific roles |
| Account and contact info | Operate your account, send service emails |
| Usage data | Improve the product, fix bugs |
| Payment info | Process subscription payments via Stripe |
We do not:
- Sell your data to anyone
- Use candidate data to train general-purpose AI models
- Share data with advertisers
- Make automated hiring decisions (all AI outputs are advisory)
Agents and API access
You can connect your own software agent, or an agent from a marketplace such as the Muse Connector Platform, to your notanATS account. A connected agent acts as you: it can see and do only what your account can see and do in notanATS, and only in your organization. Decisions an agent makes through a marketplace connection are held as proposals until a manager in your organization approves them in notanATS; nothing is finalized by the agent alone. You can disconnect an agent or revoke its key at any time in Settings, and its access ends immediately — a revoked key or connection cannot read or change anything further. Data an agent accesses is the same data covered by this policy; connecting an agent does not sell, share, or add your data to any training set.
Legal basis for processing (EU/UK GDPR)
For candidates in the EU and UK, our lawful basis for processing your data is legitimate interests under Article 6(1)(f) of the GDPR. The legitimate interest is conducting candidate screening in the context of the employment relationship between you and the hiring organization that posted the position you applied for. You can object to this processing at any time (see Your rights).
Automated decision-making (GDPR Article 22)
notanATS does not constitute solely automated decision-making within the meaning of GDPR Article 22. Although AI generates scores and evaluations, a human hiring manager reviews those outputs and takes every consequential hiring action. No candidate is advanced, interviewed, or rejected by the AI alone. A human manager makes each consequential decision.
AI processing
AI data processing statement
Interview data is processed by our AI provider and is not used to train AI models.
Candidate interview responses are processed by an AI model provider to generate scores and evaluations. This means:
- Candidate answers are sent to our AI model provider for analysis
- The candidate's name and email are masked before this data leaves our servers
- The provider's terms prohibit using these inputs to train models
- AI outputs (scores, evaluations) are stored in our database
- The AI evaluates against the dimensions the hiring manager defined, nothing else.
EU AI Act disclosure
notanATS is classified as a high-risk AI system under Annex III, Category 4 (employment, workers management and access to self-employment) of the EU AI Act, because it is used to screen candidates during recruitment.
The system is subject to mandatory human oversight. It produces advisory scores and evaluations only; the hiring manager makes all consequential decisions about whether to advance, interview, or reject a candidate. The AI does not make any hiring decision on its own.
For full details on our security and AI data handling, see our Security page.
Third-party services
We use providers in the following categories to operate notanATS:
| Category | What it does | Data it processes |
|---|---|---|
| Cloud hosting and databasePlatform | Stores our data and handles sign-in | All stored data (encrypted at rest) |
| AI model servicesPlatform | AI-powered candidate evaluation | Interview responses and screening criteria, with candidate name and email masked |
| Payment processingPlatform | Processes subscription payments | Payment details |
| Transactional emailPlatform | Sends service emails | Email addresses and email content |
| Website hosting and deliveryWebsite and platform | Hosts and delivers the website and platform | Request logs and IP addresses |
| Website analyticsWebsite only | Website traffic, behavior analytics, and session review on public marketing pages | Pages visited, on-page interactions, device and browser info, and approximate location (only after cookie consent is given) |
Each provider processes data under its own privacy policy and our data processing agreements.
Analytics and session tools run on public marketing pages only and are never loaded on candidate-facing pages, so candidate name, email, résumé content, and conversation content are never captured by them.
Do Not Sell or Share My Personal Information
Under the California Consumer Privacy Act / CPRA, you can opt out of the sale or sharing of personal information. On our public marketing pages, use the footer control labeled exactly Do Not Sell or Share My Personal Information. Choosing it has the same effect as declining cookies: we store cookie-consent: denied and Google Analytics and Microsoft Clarity do not load for you.
This control sits alongside “Cookie settings” in the footer. It is a separate, distinctly labeled link, not merged into cookie settings.
Data retention
- Active accounts: hiring-manager account data is retained while your account is active
- Candidate data: interview responses, self-assessments, and AI-generated scores are retained for 12 months from the position close date, after which they are automatically purged
- Closed accounts: hiring-manager account data is deleted within 30 days of account closure
- Payment records: retained as required by tax and financial regulations
Your rights
Depending on where you are, you may have the right to:
- Access your data: request a full export
- Correct inaccurate data
- Delete your data: we will process within 30 days
- Object to specific processing
- Portability: receive your data in a standard format
To exercise any of these rights, email privacy@notanats.com. We will respond within 30 days.
For candidates specifically
You can request:
- A copy of your interview responses and AI-generated scores
- An explanation of how your scores were generated
Email privacy@notanats.com with your name and the position you applied for.
Data security
- All data encrypted in transit (TLS) and at rest
- Access controls limit who can see what data
- Regular security reviews during beta
- Incident response: we will notify affected users within 72 hours of a confirmed breach
Children
notanATS is not intended for anyone under 18. We do not knowingly collect data from minors.
Changes to this policy
We will notify you by email before material changes take effect. The “last updated” date at the top reflects the most recent revision.
Governing law
This privacy policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, including PIPEDA.
Contact
Privacy questions: privacy@notanats.com
General questions: support@notanats.com