Privacy Policy

HireLucid (“we”, “us”) provides AI-assisted interview screening and practice. This policy explains what personal data we process, why, and the rights you have under the UK GDPR and EU GDPR. For candidate data processed on behalf of an employer, the employer is the data controller and we act as a processor under our Data Processing Agreement.

Data we process

• Account data — name, work email, and password hash for users who register an organisation.
• Candidate data — names, emails, CV text, and interview answers submitted for screening. Identifying fields are encrypted at rest with a unique key per organisation.
• Generated assessment data — rubric scores and explanations derived from the above.
• Usage and security logs — an append-only audit log of significant actions, plus standard request metadata.

How we use it

To provide the service: parsing CVs and job descriptions, generating role-specific rubrics, scoring answers, and producing explainable, auditable assessments. We do not sell personal data, and we do not use candidate data to train third-party models.

AI processing

Scoring uses a remote large-language model to evaluate answers against a structured rubric; the final score aggregation is deterministic and reproducible. Recruitment AI is classified as high-risk under the EU AI Act, so every score is explainable, subject to human oversight, and logged for audit. Automated scores are decision support, not an automated final decision.

Sub-processors

We use a small set of infrastructure and AI sub-processors (hosting, the configured LLM provider, and email delivery) under appropriate data-protection terms. A current list is available on request.

Retention & security

Personal data is retained for as long as your organisation’s account is active or as required by law. Candidate PII is encrypted per organisation; deleting or rotating an organisation’s key renders its data permanently unreadable (cryptographic erasure). Access is restricted and audited.

Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, or portability of your personal data, and may object to certain processing. Candidates should contact the employer they applied to (the controller); we will assist that employer in fulfilling the request. To exercise rights for an account you hold with us directly, email us.