Effective date: September 27, 2026
This page explains how HireKey processes and stores information. Read it together with our Privacy Policy and AI Usage Policy.
HireKey uses service providers to host the website and application, support sign-in and store your information.
HireKey uses encrypted connections, Google sign-in and access controls to help protect your account and information.
Request validation, rate limits and abuse controls help protect the service. AI instructions tell models to treat supplied material as data and avoid inventing qualifications. These measures cannot guarantee that every error or misuse is prevented.
HireKey saves document content so you can return to your work. PDF and Word downloads are generated when requested. Downloading an existing result does not create another saved version.
After a new version saves successfully, excess versions are removed from Documents. Removed documents have a seven-day recovery period before permanent deletion. Older versions also become eligible for removal after six calendar months, with the same recovery period. These older-version rules preserve the latest tailored resume and cover letter for each job.
Some older documents lack reliable job information. We preserve those copies rather than guess which versions to remove. You can remove unwanted documents through Documents.
For free accounts and accounts without an active paid subscription, saved documents and uploaded files become eligible for deletion after 12 months without an authenticated visit or meaningful use. Active paid subscriptions and organization-sponsored access are excluded from this cleanup.
We email a notice 30 days before deletion and a final reminder seven days before deletion. Signing back in cancels the scheduled deletion. Download your documents before the deletion date if you want to keep them.
This rule concerns documents and uploaded files. It does not mean that coaching, interview prep, billing, analytics, security logs or the account itself are all deleted after 12 months.
When you speak, your browser converts speech to text, potentially using its speech-recognition provider. You can type instead. HireKey does not save raw microphone audio or generated playback audio as files in its storage.
HireKey does not save the complete coaching conversation as a server-side transcript. Once you complete an interview, the completed conversation is temporarily kept in that browser tab. You can refresh and return to it in the same tab before the debrief saves. Download the transcript before generating the debrief or closing the tab if you want a copy. Sign-out or a successfully saved debrief clears the temporary copy. A failed debrief save leaves it available for retry or download while the copy remains in the tab.
The latest successfully saved debrief, its feedback, scores and related session metadata remain available in your account. A newly saved debrief replaces the prior one. A failed or abandoned attempt does not replace it. Incomplete or abandoned sessions are not offered as recoverable history. The document seven-day recovery rule does not apply to coaching.
Interview preparation is separate: one recruiter-screen set and one hiring-manager set are saved per job. Regenerating replaces the corresponding set rather than creating a version archive. Deleting the linked job or the account removes its prep. User-created coaching questions have their own edit/delete controls; shared questions are not editable by users.
HireKey uses error reporting to diagnose technical problems and filters sensitive information from those reports.
PostHog measures website and app usage. App activity is associated with a stable account identifier. Enabled session replay can include visible page content and inputs outside live voice interview coaching, with password inputs masked. Content in live voice interview coaching is excluded from replay and automatic interaction capture; navigation and specific feature events can still be counted. See the Cookie Policy for tracking choices.
| Provider | Role |
|---|---|
| Hostinger / WordPress | Public website hosting and operation |
| Vercel | Application frontend hosting and delivery |
| Railway | Backend processing |
| Supabase | Authentication, account records and document storage |
| Google sign-in | |
| OpenAI | App AI generation and coaching using relevant inputs |
| Microsoft speech service | Coach response text for spoken playback |
| Browser speech-recognition provider | Speech-to-text processing, depending on the browser |
| Stripe | Payments, subscriptions and related transaction records |
| Resend | Transactional email delivery and delivery metadata |
| Sentry | Filtered backend error reporting |
| PostHog | Website/app events and enabled session replay |
| Google Analytics | Public website analytics |
| MailerLite | Website email forms and subscribed communications |
| Vimeo | Embedded website video playback |
Separately hosted website tools require their own processing details. The signed-in application's retention rules should not be assumed to describe those tools.
Account deletion removes the account and associated application records and initiates stored-file removal. A cleanup failure may require follow-up. Deleting a document does not itself erase coaching feedback, billing records, support correspondence or earlier analytics captures.
When you request deletion of personal data, we delete the requested data from systems and records HireKey controls within seven days of receiving your request. This includes our application and database records, uploaded files, logs, backups and release archives, and analytics or session replays that HireKey controls. A request to delete your account and all personal data covers all such records. This deadline does not govern data retained independently by third-party providers under their own policies.
If applicable law requires retention of a particular record, we keep only the information required for that purpose and explain the exception when responding to your request. The seven-day deadline is a deletion deadline, not an account-recovery window. Contact privacy@hirekey.io to make a request.
HireKey does not currently hold a SOC 2 report or offer a formal bug bounty program. Send suspected security issues to privacy@hirekey.io. Avoid including unnecessary personal information or credentials.
Protect your Google account, use its multi-factor authentication where available, upload only information you may use, and review generated material before sharing it.