Privacy Policy

Last updated: 28 July 2026

This Privacy Policy explains how HiREO, operated by Royal Bengal AI, collects, uses, and protects information when you use the Service.

1. Information We Collect

  • Account data: name, email, company, and login credentials.
  • Candidate data you upload: CVs, contact details, application answers, interview notes and transcripts.
  • Integration data: with your permission, emails/calendar via Gmail (Nylas) and social accounts via Zernio.
  • Usage data: logs and analytics needed to operate and improve the Service.

2. How We Use It

  • To provide recruitment features — CV analysis, scoring, scheduling, messaging, and letters.
  • To process payments and manage your subscription.
  • To secure, maintain, and improve the Service.

3. Intelligence Processing

CV text and interview transcripts are sent to third-party analysis providers (e.g. Google Gemini, OpenAI) solely to generate analysis, scores, and drafts for your workspace. We do not sell your data or use candidate data to train third-party models.

4. Data Sharing

We share data only with the sub-processors needed to run the Service — including Supabase (database & storage), Stripe (payments), Nylas (email/calendar), and third-party analysis providers — and only as necessary to deliver the features you use. We do not sell personal data.

5. Google API Services — Limited Use

HiREO’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

When you connect a Google account, HiREO accesses Google user data only as follows:

  • Gmail (read): read messages and attachments only to import candidate CVs into the project you choose. We do not read unrelated mail.
  • Gmail (send): send hiring emails (shortlist, question forms, interview and appointment letters) that you or your workspace initiate, from your connected mailbox.
  • Google Calendar: create and update interview events and Google Meet links for scheduling.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized AI/ML models. Google user data is used only to provide or improve these user-facing features, is transferred only to sub-processors needed to run them (see §4), and is accessed by humans only with your consent, for security/abuse, or where required by law. Gmail and Calendar access is provided through Nylas acting as our email/calendar processor.

6. Data Isolation & Security

Each customer’s data is isolated per tenant. Access is restricted, traffic is encrypted in transit, and secrets are stored securely. See our Terms for your responsibilities as data controller.

7. Retention

We retain data for as long as your account is active or as needed to provide the Service. You can delete candidates, projects, and other records from within the app; deleting your account removes associated data subject to legal retention requirements.

8. Your Rights

Depending on your jurisdiction, you (and candidates whose data you process) may have rights to access, correct, or delete personal data. Submit requests to team@royalbengal.ai.

9. Contact

For privacy questions, email team@royalbengal.ai or visit our contact page.