Who is responsible for your data
For your NoraHire account, and for the data we need to run the service, Infinora Tech is the controller.
When you apply to a job, the company you apply to is the controller of your application data. They decide how they use it in their hiring, and we process it for them under contract.
What we collect
- Account data: your name, email, account type and a protected (hashed) form of your password. We never store your password itself.
- Sign-in with Google, Microsoft or LinkedIn: your name, email and the provider's ID for your account. We do not get your password at those providers.
- Profile and application data you add: CV, work history, education, skills and answers to job questions.
- Company data: company name, size, industry, workspace address, logo, plan and team members.
- Security data: the time, IP address and browser of each sign-in attempt, and password reset requests.
- Messages you send us through the Contact page.
Why we use it
- To create and run your account and sign you in safely (to provide the service).
- To show your profile to the companies you apply to, and to show companies their applicants (to provide the service, and with your consent when you apply).
- To find and stop fraud, abuse and attacks on accounts (our legitimate interest in keeping NoraHire safe).
- To answer your questions and send messages about your account, such as password reset links (to provide the service).
- To meet legal duties, such as keeping records the law requires.
Who can see your data
- Companies you apply to see your profile and that application. Companies you did not apply to cannot.
- Each company's workspace is kept separate. One company cannot see another company's jobs, candidates or notes.
- Service providers who host and run NoraHire for us (for example, cloud hosting and email delivery), under contracts that limit their use of the data.
- Authorities, if the law requires it.
- We do not sell your personal data, and we do not use it for advertising.
How long we keep it
- Account data: for as long as your account is open, then deleted within 30 days of closing it, unless the law requires longer.
- Applications: for as long as the company keeps them under its own retention rules. Companies should not keep unsuccessful applications longer than they need.
- Sign-in and security records: up to 12 months.
- Password reset links expire after 30 minutes. The request record is deleted after 30 days.
How we protect it
Passwords are stored only as strong one-way hashes. Sessions are signed and expire after 8 hours. Every request for company data is limited to that company's workspace. The Security page has more detail.
Your rights
- See the data we hold about you, and get a copy.
- Correct data that is wrong.
- Ask us to delete your data, or to limit how we use it.
- Withdraw consent you gave, such as sharing your profile with a company, at any time.
- Object to processing based on our legitimate interests.
- Complain to your local data protection authority.
How to use your rights
To use any of these rights, write to us from the Contact page using the email on your account. For data held by a company you applied to, you can also contact that company directly. We answer within one month.
Changes
If we change this policy in a way that matters, we will tell you before it applies. The date at the top shows the latest version.