Privacy Policy

1. Overview

NutraHire operates a recruiting platform for executive search in nutraceutical, beauty, functional food & beverage, and CPG. This policy explains what we collect through the NutraHire dashboard and related services, why, and the choices you have. It applies to client contacts, candidates, staff users, and visitors.

2. Information we collect

• Account data — name, work email, password (stored only as a bcrypt hash), job title, optional two-factor authentication secret.
• Sign-in data from Google or LinkedIn — if you choose "Sign in with Google/LinkedIn", we receive your basic profile (name, email address, and provider account ID) solely to authenticate you. We do not access your contacts, calendar, messages, or any other Google/LinkedIn data.
• Client company data — company details, role intakes, interview scheduling, feedback, and billing details (payment cards are handled by Stripe; we never see full card numbers).
• Candidate data — resumes, contact details, work history, education, skills, and professional profile URLs, provided by candidates directly, by client companies, or collected from public professional sources and enrichment providers.
• Communications & activity — interview participation (video runs on Jitsi Meet), survey responses, outreach interactions, and in-platform activity logs.
• Technical data — IP address, browser/user-agent, and security logs used for abuse prevention and audit trails.

3. How we use information

We use personal data to operate the recruiting service: authenticating users, matching and presenting candidates to client companies, coordinating interviews, drafting and executing agreements, processing payments, sending transactional emails (invites, proposals, reminders), improving search quality (including AI-assisted fit assessments), and securing the platform. We do not sell personal data and we do not use it for advertising.

4. Google & LinkedIn sign-in (limited use)

Our use of information received from Google APIs and LinkedIn adheres to the Google API Services User Data Policy (including the Limited Use requirements) and LinkedIn's API Terms of Use. Data received via OAuth sign-in is used only to provide and secure user authentication, is never sold, is never used for advertising, and is not shared with third parties except as required to operate the service or by law.

5. How we share information

• With client companies — candidate profiles are presented to the specific client company whose search the candidate was sourced for. Early-stage candidate identities stay protected until a candidate engages.
• Service providers — Stripe (payments), Resend (transactional email), Apify (public profile data collection), OpenRouter (AI processing of profile/role text for matching and drafting), Jitsi Meet (video interviews), and our hosting provider. Each processes data only to provide its service to us.
• Legal — where required by law, regulation, or valid legal process, or to protect rights, safety, and the integrity of the platform.

6. Retention

We keep account and engagement data while the account is active and as needed afterward for legitimate business records, legal obligations, and dispute resolution. Candidate pipeline data is retained while a search is active and for a reasonable period afterward; signed agreements and invoices are retained as required for tax and legal purposes. You may request deletion at any time (\u00a77).

7. Your rights (GDPR, CCPA & others)

Depending on your location, you may have the right to access, correct, export, or delete your personal data, to object to or restrict processing, and to opt out of any "sale" or "sharing" of personal information (we do not sell or share personal information for cross-context advertising). To exercise any right, email privacy@nutrahire.com — we respond within 30 days. California residents may designate an authorized agent. EEA/UK residents may also lodge a complaint with their supervisory authority.

8. Security

We use TLS in transit, bcrypt password hashing, optional TOTP two-factor authentication, per-company data isolation, signed expiring links, rate limiting, and a strict Content-Security-Policy. No method of transmission or storage is 100% secure; if we learn of a breach affecting your data we will notify you consistent with applicable law.

9. Cookies

We use only strictly necessary cookies: session authentication and CSRF protection. We do not use advertising or cross-site tracking cookies.

10. Children & changes

The service is for businesses and professionals and is not directed at children under 16. If we change this policy materially we will post the new version here with an updated effective date and, for material changes, notify active account holders by email.

11. Contact

NutraHire Inc \u00b7 privacy@nutrahire.com \u00b7 www.nutrahire.com