Privacy Policy

1. Who we are and what this policy covers

NextVerseTech is an applicant tracking system operated by [Company legal name] ([Company address]) ("we", "us"). This Privacy Policy explains how we handle personal data when you visit https://nextversetech.com, create or use an account, subscribe, contact us, or apply to a job through a careers page or application form powered by NextVerseTech.

Questions or requests: [Privacy email].

2. Our two roles: controller and processor

Controller for account data. We decide how and why we process personal data about our customers' users and contacts — for example, the name and email of someone who signs up, invites teammates or pays for a subscription — and about visitors to our website. This policy describes that processing.

Processor for candidate data. When an employer (our customer) uses NextVerseTech to post jobs and receive applications, the employer decides what information to collect from candidates and how to use it. The employer is the controller (or "business") for candidate data, and we process it on the employer's behalf and on its instructions under our Data Processing Addendum, as a processor (or "service provider").

If you applied for a job, the employer's own privacy notice governs how your application is used. Please contact the employer to access, correct or delete your data or to ask about a decision. If you contact us, we will forward your request to the employer and help them respond.

3. Personal data we collect as a controller

• Account and profile data — name, email address, password (stored only as a secure hash by our authentication provider), profile photo if you sign in with Google, workspace role, and the date and version of the Terms you accepted.
• Workspace data — company name, website, industry, size, time zone, logo and careers-page content you add.
• Billing data — billing name and email, billing address, tax ID if provided, subscription plan and status, and invoice history. Payment card details are collected and stored by our payment processor, Stripe; we receive only limited information such as card brand, last four digits and expiry.
• Communications — messages you send to support and related correspondence.
• Usage and device data — IP address, browser and device type, pages and features used, timestamps, error logs and security events, collected through server logs and essential cookies.
• Audit data — records of actions in a workspace (for example, who changed a candidate's stage), kept for security and accountability.
• Careers page visit statistics — when someone opens an employer's careers page or job page we count the visit, the referring site or share-link tag, the device type (phone, tablet, desktop) and an approximate location (country, region, city). The location is derived from a truncated network address (last part removed) that is looked up through our geolocation provider and not stored; we keep aggregate daily counts only, plus a short-lived, daily-rotating hash used to count unique visitors within a day, which is deleted the following day. No cookies are set and we do not identify individual visitors.

4. Candidate data we process for employers

On behalf of our customers, we store and process the information candidates submit and that the hiring team adds, which may include:

• name, email, phone number, location and links (such as LinkedIn or a portfolio);
• resume/CV, cover letter, other uploaded files, and the text extracted from them;
• answers to application questions, work-authorization and availability information, desired salary;
• notes, ratings, tags, interview stages, rejection reasons and other hiring-team activity;
• AI screening outputs (scores, summaries, strengths and concerns) if the employer uses AI features — see the AI Notice;
• voluntary equal-employment self-identification (such as gender, race/ethnicity, veteran or disability status) where the employer enables it. These answers are optional, stored separately from the application, are not visible to the hiring team on individual applications, are never sent to AI features, and are used only for aggregate reporting.

We use candidate data only to provide the service to the employer, to secure and maintain it, and as required by law.

5. How we use personal data and our legal bases

For data we control, we rely on the following purposes and, where the GDPR or UK GDPR applies, the following lawful bases:

We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

6. AI features

If an employer uses our AI features, the relevant application content (for example, resume text and answers, together with the job's requirements) is sent to our AI model provider to generate a suggestion for the hiring team. Outputs are advisory and a human makes every decision. Our provider does not use this data to train its models. Details, including candidate options, are in the AI Notice.

7. How we share personal data

• Subprocessors and service providers that host and operate the Services — listed on our Subprocessors page — under contracts that require them to protect the data and use it only to provide their services to us.
• Employers and their teams — candidate data is available to the employer's authorized users according to the roles the employer assigns.
• Payment processor — Stripe processes subscription payments and may use data as an independent controller for fraud prevention and legal compliance, under its own privacy policy.
• Professional advisers — lawyers, accountants and auditors under confidentiality duties.
• Legal and safety — when required by law, court order or a lawful request by public authorities, or to protect the rights, property or safety of users, candidates, the public or us.
• Business transfers — in a merger, acquisition, financing or sale of assets, subject to this policy.

We do not sell personal data, and we do not "share" it for cross-context behavioral advertising, as those terms are defined in the CCPA/CPRA. We do not use advertising cookies.

8. International data transfers

The Services are hosted in the United States (Google Cloud / Firebase), and our subprocessors may process data in the United States and other countries. When we transfer personal data from the European Economic Area, the United Kingdom or Switzerland to countries that are not recognized as providing adequate protection, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and equivalent safeguards (and, where available, our providers' certifications under the EU-U.S. Data Privacy Framework), together with supplementary measures such as encryption in transit and at rest. You can request a copy of the relevant safeguards at [Privacy email].

9. How long we keep data

• Account and workspace data — for as long as your account or workspace is active, then deleted within 90 days after closure or the end of the subscription (after the 30-day export window described in the Terms), unless we must keep it longer by law.
• Billing records — for the period required by tax and accounting laws (typically up to 7 years).
• Server and security logs — for a limited period appropriate to their purpose, generally no longer than 12 months, unless needed to investigate an incident.
• Workspace audit logs — for the life of the workspace, as part of the customer's workspace data.
• Candidate data — as instructed by the employer, including the retention period the employer configures in its privacy settings, and deleted as described in the DPA when the employer's subscription ends.
• Backups — residual copies are deleted in the ordinary course of backup rotation and protected until then.

10. Security

We use administrative, technical and organizational measures designed to protect personal data, including encryption in transit (TLS) and at rest, role-based access controls enforced on the server, least-privilege access for our personnel, secret management, rate limiting, input validation and sanitization, and audit logging. Uploaded files are served only to authorized users. No system is perfectly secure; if we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by law. More detail is in the DPA security measures.

11. Your rights (EEA, UK and Switzerland)

If the GDPR, UK GDPR or Swiss data-protection law applies, you have the right to:

• access the personal data we hold about you and receive a copy;
• correct inaccurate or incomplete data;
• have your data erased, or restrict its processing, in certain circumstances;
• receive your data in a portable format and have it transmitted to another controller;
• object to processing based on legitimate interests, and to direct marketing at any time;
• withdraw consent at any time where we rely on consent (without affecting earlier processing); and
• lodge a complaint with your local data-protection authority.

For candidate data, please contact the employer you applied to; we will support them in responding.

12. Your rights (California and other US states)

Residents of California and other US states with comprehensive privacy laws (such as Colorado, Connecticut, Virginia, Utah, Texas and Oregon) may have the right to: know what personal information we collect, use and disclose and obtain a copy; correct inaccurate information; delete personal information; opt out of the sale or sharing of personal information and of targeted advertising (we do neither); limit the use of sensitive personal information (we use it only as permitted by law); and not receive discriminatory treatment for exercising these rights. Where available, you may appeal our decision on a request by replying to our response.

CCPA notice at collection. In the past 12 months we collected the following categories of personal information as a business: identifiers (name, email, IP address); customer records and commercial information (billing details and subscription history); internet or network activity (usage and log data); professional information (company, role); and sensitive personal information limited to account log-in credentials. Sources: you, your organization, and our service providers. We use this information for the business purposes described in Section 5 and disclose it to the service providers listed on our Subprocessors page. Retention is described in Section 9. Information about candidates is collected and used by employers, for whom we act as a service provider.

To exercise your rights, email [Privacy email]. We will verify your request by matching information you provide with information we hold (for example, by confirming control of your account email). You may use an authorized agent, who must provide proof of authorization. We respond within the time required by law (generally 30 to 45 days).

13. Children

The Services are intended for businesses and are not directed to children under 16. We do not knowingly collect personal data from children through our own website or accounts.

14. Cookies

We use only essential cookies and browser storage needed to keep you signed in and the Services secure. We do not use advertising or cross-site tracking cookies. See the Cookie Policy.

15. Changes to this policy

We may update this policy. If changes are material, we will notify account owners by email or in the Services before they take effect. The "Last updated" date shows the current version.

16. Contact

[Company legal name], [Company address], [Country]. Email: [Privacy email]. If we are required to appoint a representative in the EU or UK, their details will be listed here.