Privacy Policy
Last updated: June 12, 2026
The short version
We collect the minimum data needed to run a hiring platform. We use AI to score candidates. We do not sell your data. We do not use your data to train general-purpose AI models. You can delete your data at any time.
Who we are
notanATS is a Canadian company. We comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy legislation. For users in the EU, we also comply with the General Data Protection Regulation (GDPR). For users in California, we comply with the California Consumer Privacy Act (CCPA).
For privacy questions, contact privacy@notanats.com.
What data we collect
From hiring managers
- Account info: name, email, organization name
- Job postings: position titles, descriptions, screening dimensions and criteria
- Usage data: login times, feature usage, session data
- Payment info: processed by Stripe; we never see or store your full card number
From candidates
- Interview responses: answers to AI-powered screening conversations
- Self-assessments: candidates' own ratings of their fit on each dimension
- Contact info: name and email (provided during application)
- Uploaded materials: résumés or other documents candidates choose to share
- Transparency scores and dimension scores: generated by AI based on interview responses
Automatically collected
- IP address, browser type, device info
- Pages visited, actions taken (anonymized analytics)
- Error logs for debugging
How we use your data
| Data | Purpose |
|---|---|
| Interview responses | Generate candidate evaluations using AI |
| Screening dimensions | Configure AI conversation structure |
| Scores and evaluations | Present hiring insights to managers |
| Calibration data | Improve scoring accuracy for your specific roles |
| Account and contact info | Operate your account, send service emails |
| Usage data | Improve the product, fix bugs |
| Payment info | Process subscription payments via Stripe |
We do not:
- Sell your data to anyone
- Use candidate data to train general-purpose AI models
- Share data with advertisers
- Make automated hiring decisions (all AI outputs are advisory)
Legal basis for processing (EU/UK GDPR)
For candidates in the EU and UK, our lawful basis for processing your data is legitimate interests under Article 6(1)(f) of the GDPR. The legitimate interest is conducting candidate screening in the context of the employment relationship between you and the hiring organization that posted the position you applied for. You can object to this processing at any time (see Your rights).
Automated decision-making (GDPR Article 22)
notanATS does not constitute solely automated decision-making within the meaning of GDPR Article 22. Although AI generates scores and evaluations, a human hiring manager reviews those outputs and takes every consequential hiring action. No candidate is advanced, interviewed, or rejected by the AI alone — a human manager makes each consequential decision.
AI processing
AI data processing statement
Interview data is processed by Anthropic but is not used to train AI models per Anthropic's data usage policy.
Candidate interview responses are processed by AI (powered by Anthropic's Claude API) to generate scores and evaluations. This means:
- Candidate answers are sent to Anthropic's API for analysis
- Anthropic processes this data under their data usage policy, which prohibits using API inputs for model training
- AI outputs (scores, evaluations) are stored in our database
- The AI evaluates against the specific dimensions the hiring manager defined. Nothing else.
EU AI Act disclosure
notanATS is classified as a high-risk AI system under Annex III, Category 4 (employment, workers management and access to self-employment) of the EU AI Act, because it is used to screen candidates during recruitment.
The system is subject to mandatory human oversight. It produces advisory scores and evaluations only; the hiring manager makes all consequential decisions about whether to advance, interview, or reject a candidate. The AI does not make any hiring decision on its own.
For full details on our security and AI data handling, see our Security page.
Third-party services
We use these services to operate notanATS:
| Service | Purpose | Data shared |
|---|---|---|
| Supabase | Database and authentication | All stored data (encrypted at rest) |
| Anthropic (Claude API) | AI-powered candidate evaluation | Interview responses, screening criteria |
| Stripe | Payment processing | Payment details (managed by Stripe) |
| Resend | Transactional email | Email addresses, email content |
| Vercel | Hosting and delivery | Request logs, IP addresses |
Each service processes data under their own privacy policy and our data processing agreements.
Data retention
- Active accounts: hiring-manager account data is retained while your account is active
- Candidate data: interview responses, self-assessments, and AI-generated scores are retained for 12 months from the position close date, after which they are automatically purged
- Closed accounts: hiring-manager account data is deleted within 30 days of account closure
- Payment records: retained as required by tax and financial regulations
Your rights
Depending on where you are, you may have the right to:
- Access your data: request a full export
- Correct inaccurate data
- Delete your data: we will process within 30 days
- Object to specific processing
- Portability: receive your data in a standard format
To exercise any of these rights, email privacy@notanats.com. We will respond within 30 days.
For candidates specifically
You can request:
- A copy of your interview responses and AI-generated scores
- An explanation of how your scores were generated
Email privacy@notanats.com with your name and the position you applied for.
Data security
- All data encrypted in transit (TLS) and at rest
- Access controls limit who can see what data
- Regular security reviews during beta
- Incident response: we will notify affected users within 72 hours of a confirmed breach
Children
notanATS is not intended for anyone under 18. We do not knowingly collect data from minors.
Changes to this policy
We will notify you by email before material changes take effect. The “last updated” date at the top reflects the most recent revision.
Governing law
This privacy policy is governed by the laws of the Province of Ontario and the federal laws of Canada applicable therein, including PIPEDA.
Contact
Privacy questions: privacy@notanats.com
General questions: support@notanats.com