HIRA AI Logo

Privacy and Data Policy

Your privacy matters to us. Learn how we collect, use, store, share, and protect your personal data across our platform.

Last Updated: April 9, 2026

Hira AI Solutions FZC — Registered at Sharjah Publishing City Free Zone, UAE

Last Revised: April 9, 2026

Each user category (agency administrator, recruiter, client, and candidate) is required to provide explicit consent to this Privacy and Data Policy during their onboarding and first sign-up on the platform. By clicking “I Agree” or equivalent consent action during registration, you confirm that you have read, understood, and accepted this Privacy and Data Policy. If you do not agree with any part of this policy, you must not use the platform.

01

Definitions

Personal Data

Any information that identifies or can identify a natural person, directly or indirectly.

Data Controller

The entity that determines the purposes and means of processing personal data.

Data Processor

The entity that processes personal data on behalf of the data controller.

Platform

The Hira AI SaaS application, all dashboards, the WhatsApp AI Agent, and the hiraai.com website.

User

Any person who accesses or uses the Platform in any capacity.

Consent

A clear, informed, and freely given indication of agreement to the processing of personal data, obtained through an affirmative action during onboarding or registration.
02

Our Role in Data Processing

When acting as Data Processor:

When recruitment agencies use Hira AI to manage their hiring workflows, the recruitment agency is the Data Controller and Hira AI is the Data Processor. We process candidate data, job data, and client data on behalf of the agency and only as instructed by the agency through their use of the platform.

When acting as Data Controller:

Hira AI is the Data Controller for: (a) account registration data of all users, (b) website visitor data, (c) data collected directly from candidates through the Candidate Dashboard and WhatsApp AI Agent for platform operations, and (d) usage analytics and technical data.
04

Information We Collect

Agency Admin Data:

When a recruitment agency registers with Hira AI, we collect: agency name, admin name, email address, phone number, company details, branding assets (logo, colors), and billing information.

Recruiter Data:

For recruiters added by the agency admin: name, email address, phone number, calendar availability, interview evaluation entries, and platform activity logs.

Client (Job Owner) Data:

For agency clients who create jobs: name, email address, company name, job requirements, skill mapping criteria, minimum score thresholds, and communication preferences.

Candidate Data:

We collect the following from candidates who apply through the platform:

  • Name, email address, phone number, and WhatsApp number
  • Resumes and CVs
  • Work experience, qualifications, certifications, and language proficiency
  • Self-assessed skill scores and AI-validated skill scores
  • WhatsApp conversation transcripts with the AI Agent (used for screening, skill validation, and profile building)
  • Interview recordings submitted by recruiters (audio/video)
  • Interview transcripts generated from recordings
  • Application source tracking data
  • Candidate status updates and feedback records
  • Talent pool consent and availability updates

Usage and Technical Data:

From all users: IP address, browser type, device information, pages visited, session duration, feature usage patterns, and interaction timestamps.

Cookies and Tracking:

The hiraai.com website uses cookies for: navigation improvement, user behavior analytics, preference storage, and session management.

Essential cookies (required for basic website functionality) are placed automatically. Non-essential cookies (analytics, preferences) are placed only after you provide affirmative consent through our cookie banner. You can change your cookie preferences at any time through the cookie settings link in the website footer. Disabling non-essential cookies will not affect platform functionality.

05

How We Use Personal Data

Service Delivery:

We use collected data to: operate and maintain the platform, generate AI-powered job descriptions, conduct AI-based candidate screening and skill validation, generate interview guides and candidate reports, schedule interviews through calendar integration, manage the live talent pool, deliver WhatsApp notifications and reminders, provide candidate comparison dashboards and prepare the final candidate profile report.

AI Processing:

Hira AI uses artificial intelligence to: analyze resumes against job descriptions, conduct conversational screening through WhatsApp, validate candidate self-assessed skill scores through targeted questions, generate personalized interview guides for recruiters, analyze interview transcripts for candidate-job matching, generate comprehensive candidate reports, and match talent pool profiles to new job openings.

Important: AI provides recommendations and analysis only. All final hiring decisions are made by human recruiters or clients. Every user has the right to request human review of any AI-assisted decision affecting them.

Data sent to AI providers: The following categories of data may be sent to OpenAI for AI processing: resume text, job description content, candidate skill assessment responses, interview transcripts, and candidate profile data required for report generation. We use the OpenAI Business API, which contractually prohibits the use of customer data for model training. We send only the minimum data necessary for each specific AI operation.

Interview Recordings:

When a recruiter uploads an interview recording through the candidate profile: the recording is stored on AWS S3 for the duration that the candidate's status remains “active” in the recruitment process. AI analyzes the recording and generates a transcript. The transcript and analysis are saved in the candidate profile. The original recording is deleted from the server when the candidate's status changes to hired, rejected, or closed, or when the associated job is closed, whichever comes first. Interview recordings are never used for AI model training.

WhatsApp Conversations:

Conversations between candidates and the AI Agent are stored and used for candidate screening, skill validation, and profile enrichment during the active recruitment process. Once the recruitment process for a specific job is complete, the full conversation content is deleted. Only metadata (timestamps, message counts, status updates) is retained.

Communication:

We use contact information to: send platform notifications and reminders via WhatsApp, deliver interview confirmations and scheduling updates, provide candidate feedback and status updates, send monthly talent pool engagement messages (with consent), and communicate service updates and support responses.

Platform Improvement:

We use aggregated, anonymized data to: analyze platform performance and usability, improve AI accuracy, identify and fix technical issues, and develop new features. Before using any data for improvement purposes, we remove or minimize personal identifiers so that individuals cannot be identified from the aggregated data.
We never sell personal data. We never use personal data for advertising. We never share personal data with third parties for their own marketing purposes.
07

Data Sharing

We share personal data only in the following circumstances:

Within the Platform:

Candidate data is shared with the assigned recruiter, the agency admin, and the relevant client (job owner) through their respective dashboards. Each stakeholder sees only data relevant to their role.

Sub-Processors:

We use the following third-party service providers who process personal data on our behalf:

  • Amazon Web Services (AWS): Cloud infrastructure and data storage (EU-region servers). Processes and stores all platform data.
  • OpenAI (Business API): AI language model processing for candidate screening, skill validation, interview transcript analysis, job description generation, and report generation. Data sent to OpenAI may be processed on servers outside the UAE and EU. OpenAI's Business API terms contractually prohibit the use of customer data for model training. We send only the minimum data required for each operation.
  • YCloud: WhatsApp Business API for candidate communication. Processes candidate phone numbers and message content.
  • Composio: Third-party integrations for calendar and job board connectivity.

All sub-processors are bound by data processing agreements that require them to protect personal data to standards equivalent to or exceeding UAE PDPL requirements.

Legal Requirements:

We may disclose personal data if required by UAE law, court order, or regulatory authority.

Business Transfers:

In the event of a merger, acquisition, or asset sale, personal data may be transferred to the acquiring entity. We will notify affected users at least 30 days before any such transfer.
We do not sell, rent, or trade personal data to any third party.
08

International Data Transfers

Hira AI Solutions FZC is registered in Sharjah Publishing City Free Zone, UAE. Our platform infrastructure is hosted on Amazon Web Services (AWS) servers located in the European Union. This means personal data collected from users in the UAE is transferred to and processed on servers located in the EU.

Legal Basis for Transfer:

Under Articles 22 and 23 of UAE Federal Decree-Law No. 45 of 2021 (PDPL), cross-border transfer of personal data is permitted where: (a) the receiving jurisdiction has data protection standards equivalent to or exceeding those of the UAE — the EU, through GDPR, maintains one of the strongest data protection frameworks in the world; (b) appropriate contractual safeguards are in place — we maintain a Data Processing Addendum with AWS that includes protections equivalent to Standard Contractual Clauses; and (c) the data subject has provided explicit consent — during onboarding, each user is informed that their data will be processed on EU-based servers and provides consent before proceeding.

Safeguards We Maintain:

  • Data Processing Addendum with AWS covering EU server operations
  • AES-256 encryption for data at rest
  • TLS encryption for data in transit
  • Access controls limiting data access to authorized personnel only
  • Regular security assessments of infrastructure and sub-processors

Why EU Servers:

Due to technical limitations of AWS services in the UAE region (limited availability of Lambda, microservices, and supporting infrastructure), we use EU-based AWS servers to ensure reliable, scalable, and uninterrupted service delivery. The EU's GDPR framework provides a level of data protection that meets or exceeds UAE PDPL standards.

OpenAI Data Processing:

Data sent to OpenAI through the Business API may be processed on servers outside the UAE and EU. OpenAI's Business API terms contractually prohibit the use of customer data for model training. We send only the minimum data necessary for each AI operation, specifically: resume text, job description content, candidate skill assessment responses, interview transcripts, and profile data required for report generation.
09

Data Security

We implement the following security measures:

  • AES-256 encryption for all stored data
  • TLS encryption for all data transmitted between users and the platform
  • Role-based access controls across all four dashboards
  • Authentication layers for every user account
  • Regular security audits and vulnerability assessments
  • Secure API connections with all sub-processors
  • Event-driven serverless architecture minimizing attack surface

Only authorized team members have access to personal data, and access is granted on a need-to-know basis.

10

Data Retention

Active Job Data:

Candidate data associated with an active job is retained for the duration of the recruitment process. When a job is closed, candidate data is retained for 180 days (default) unless the agency configures a different retention period (options: 90, 180, or 365 days).

Talent Pool Data:

Candidate profiles saved to the live talent pool are retained with the candidate's explicit consent. Validity is configurable by the agency: 90, 180, or 365 days. Candidates receive a notification 30 days before their profile is due for deletion and can renew consent.

WhatsApp Conversation Data:

Full conversation content is deleted after the recruitment process for the relevant job is complete. Only metadata (timestamps, message counts, status updates) is retained.

Interview Recordings:

Original recordings are retained on the server only while the candidate's status is “active” in the recruitment process. Recordings are deleted when the candidate's status changes to hired, rejected, or closed, or when the associated job is closed. Only transcripts and analysis are retained in the candidate profile after deletion of the original recording.

Account Data:

Agency, recruiter, client, and admin account data is retained for the duration of the business relationship plus 6 years for legal and financial compliance as required by UAE law.

Website Visitor Data:

Analytics and cookie data is retained for 12 months.

Post-Termination:

After termination of a subscription, account data and all associated data is retained for 60 days to allow data export. After 60 days, all data is permanently deleted unless a longer retention period is required by law.
11

Your Rights

Under UAE PDPL, all users have the right to:

Access:

Request a copy of the personal data we hold about you.

Correction:

Request correction of inaccurate or incomplete personal data.

Deletion:

Request deletion of your personal data, subject to legal retention requirements.

Restriction:

Request that we limit how we process your personal data.

Objection:

Object to processing of your personal data based on legitimate interest.

Data Portability:

Request your personal data in a structured, commonly used format.

Withdraw Consent:

Withdraw consent for processing at any time, without affecting the lawfulness of processing before withdrawal.

Human Review:

Request human review of any decision made solely by automated processing, including AI-based screening and scoring.
For Candidates: You can reply STOP to any WhatsApp message from the Hira AI Agent to opt out of further communication. You can request deletion of your profile by contacting us at privacy@hiraai.com.

For Agency Users: You can export your data at any time through the platform. Contact your agency admin or email us at privacy@hiraai.com for access or deletion requests.

We will respond to all rights requests within 30 days. To exercise any of these rights, contact us at privacy@hiraai.com.

12

Children and Minors

Hira AI is designed for professional recruitment purposes. The platform is not intended for individuals below the minimum legal working age applicable in their jurisdiction. In the UAE, the minimum legal working age is 15 years. For users in other jurisdictions, the applicable minimum working age of that jurisdiction applies. We do not knowingly collect personal data from anyone below the applicable minimum working age. If we become aware that we have collected data from such a person, we will delete it immediately and notify the relevant agency.

13

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of affected individuals, Hira AI will:

  • Notify the UAE Data Office (or relevant supervisory authority) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, as required under UAE PDPL.
  • Notify affected users without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Notification will be provided via email or WhatsApp to the contact information on file.
  • Document the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.
  • Maintain a record of all personal data breaches, including those that do not meet the notification threshold, for compliance and audit purposes.
For recruitment agencies: If a breach involves data for which the agency is the Data Controller, Hira AI will notify the agency without undue delay so the agency can fulfil its own notification obligations.
14

Data Protection Contact

Data Protection Officer: Sujith Mohan, COO

Privacy inquiries: privacy@hiraai.com

General contact: hello@hiraai.com

Phone: +971 506 598879

Address: Sharjah Publishing City Free Zone, Sharjah, UAE

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the UAE Data Office once it is fully operational, or with the relevant supervisory authority in your jurisdiction.

15

Changes to This Policy

We may update this policy from time to time. Material changes will be communicated to registered users via email or WhatsApp notification at least 30 days before they take effect. The updated policy will be posted on this page with a new revision date. Continued use of the platform after the effective date of changes constitutes acceptance of the updated policy.

By using Hira AI, you agree to this Privacy and Data Policy and our Terms and Conditions.