THEIA JOBS — PRIVACY POLICY (PUBLIC)

Last updated: September 16, 2026
Controller/Business: For THEIA’s own site operations, support, security, analytics, and de-identified product improvement, THEIA is controller/business. For hiring workflows configured by a Client, the Client is controller/business and THEIA is processor/service provider.
Contact: privacy@theiajobs.ai | Mailing: 21 SE 1st Ave # 3, Miami, FL 33131 | Subprocessors: [theiajobs.ai/subprocessors]

1) Scope

This Policy explains how we collect, use, disclose, and protect personal information from website visitors, Clients, and Candidates who use our Services, including recorded interviews and transcripts.

2) Notice at Collection (Candidates)

Before an interview starts, we present a clear recording and AI-use notice and obtain consent. We collect: identifiers, contact and employment information, interview audio/video and transcripts, device/usage data, and role-based scores/summaries. Purpose: to run interviews, generate scorecards, improve service quality, and provide hiring insights to the Client. Retention: recordings/transcripts retained for the lesser of 24 months or Client-configured period, unless longer retention is required by law, security, or claims.

3) Categories of Data We Collect

Identifiers & contact (name, email, phone, account IDs)
Employment/professional info (resume, experience, skills, job history)
Interview data (audio/video, transcripts, summaries, scores)
Internet/technical (IP, device, cookies, analytics, logs)
Approx. geolocation (derived from IP)
Inferences (e.g., role fit indicators)
Sensitive data (only if you provide it and only if allowed/required by Client configuration and law; we do not create biometric templates unless explicitly agreed)

4) Sources

Directly from you; from Clients/ATS integrations you connect; from Google Workspace or Google accounts that a Client user chooses to connect to THEIA (see Section 16); automatically via cookies/SDKs; and from service providers.

5) Purposes of Processing

Provide and secure the Services; run interviews; generate/host transcripts and scorecards; route and sync data to Client ATS; detect/prevent fraud; comply with law; de-identify/aggregate data to improve models and features. Data obtained from Google APIs is used only for the user-facing features described in Section 16 and is never used to de-identify, aggregate, develop, improve, or train generalized artificial-intelligence or machine-learning models.

6) Sharing and Disclosures

We do not sell or share personal information for cross-context behavioral advertising. We disclose data to:

Clients (your prospective employer) per their configuration;
Service providers/subprocessors bound by contract;
Legal authorities when required by law;
Successors in corporate transactions (with notice where required).

7) Retention

We retain personal information only as long as necessary for the purposes above. Typical periods:

Account data: life of account + 24 months.
Interview recordings/transcripts: lesser of 24 months or Client-configured period.
Google account connection credentials (OAuth tokens): until you disconnect the account in THEIA or revoke access in your Google Account, at which point they are deleted immediately.
Interview scheduling records derived from Google Calendar (see Section 16): treated as interview data and retained for the lesser of 24 months or the Client-configured period.
Audit/security logs: 12–24 months.
Legal holds: until release.

8) Your Privacy Rights (U.S. State Laws)

Depending on your state (e.g., CA/CO/CT/VA), you may have rights to access, correct, delete, port, and limit sensitive data processing, and to appeal a denied request. Submit requests at privacy@theiajobs.ai or [theiajobs.ai/privacy-request]. If we process data for a Client, we will route your request to that Client. Appeals: email privacy@theiajobs.ai with subject “Privacy Appeal.”

Do Not Sell/Share. We do not sell/share PI; if we ever change this, we will provide opt-out links.
Children. Our Services are not for under 18; we do not knowingly collect their data.

9) Cookies & Tracking

We use first-party cookies for session management, preferences, and analytics. Manage preferences at [theiajobs.ai/cookies]. Turning off certain cookies may impact functionality.

10) Security

We apply administrative, technical, and physical safeguards, including encryption in transit/at rest, least-privilege access, and vulnerability management. No method is 100% secure.

11) International Transfers

Where data is transferred internationally, we use appropriate safeguards (e.g., SCCs/UK IDTA) and assess local laws where required.

12) Subprocessors

We maintain a list of subprocessors at [theiajobs.ai/subprocessors] and provide advance notice of material changes.

13) Automated Tools & Human Review

We use AI to generate summaries/scores to assist hiring decisions. Clients must apply human review and comply with applicable automated-tool laws (e.g., NYC LL-144).

14) Changes to this Policy

We may update this Policy; we’ll post a new “Last updated” date and provide additional notice for material changes.

15) Contact

Questions or rights requests: privacy@theiajobs.ai
Mailing: 21 SE 1st Ave # 3, Miami, FL 33131

16) Google User Data — Connected Google Accounts

Client users (recruiters and hiring managers) may optionally connect their Google account to THEIA. This section explains exactly what Google user data we access, why, how it is stored, and how it is deleted. It applies in addition to the rest of this Policy.

Limited Use disclosure. THEIA's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. THEIA's use of information received from Google Workspace APIs will also adhere to the Google Workspace API User Data and Developer Policy.

Connecting is optional and reversible. No Google data is accessed unless you click "Connect Google Account" in your THEIA profile and approve the requested permissions on Google's consent screen. You may disconnect at any time from My Profile → Connected accounts, or by removing THEIA under Third-party apps & services in your Google Account.

Permissions we request and what each one is used for.

Permission (Google scope)	What we access	Why
Basic profile: openid, userinfo.email	The email address and unique ID of the Google account you connected.	To show you which account is connected and to prevent account mix-ups.
Calendar events: calendar.events	We create interview events on your primary calendar, and we read the title, start/end time, status, attendee email addresses and Google Meet link of events on your primary calendar.	(a) When a candidate confirms an interview slot offered through THEIA, we place the interview on your calendar with the candidate and THEIA's recruiting mailbox as guests. (b) To detect interviews you scheduled directly with a candidate outside THEIA, so the candidate's application stage is kept up to date.
Meet conference records and transcripts: meetings.space.readonly	For meetings that THEIA has already identified as an interview, we read the conference record, the transcript entries, and participant display names.	To attach the interview transcript to that candidate's record in the Client's hiring workflow and generate the interview summary and scorecard the Client has configured.
Google Docs (read-only): documents.readonly	The title and text content of a single Google Doc, only when you paste that document's link into THEIA's Job Description Builder.	To use your notes, meeting transcripts or prior job descriptions as source material when helping you draft a job description. We do not list, browse or search your documents.

How we use Google user data. Google user data is used solely to provide and improve the specific features above for the user who connected the account and for the Client on whose behalf that user acts. We do not use it for advertising, we do not sell it, and we do not use it to build user profiles unrelated to the hiring workflow.

Calendar events. Only events that THEIA created, or that THEIA matched to a candidate in one of your open roles, are recorded. For those events we store the event identifier, title, start/end time, status, the candidate's email address and the Meet link, together with the link to the corresponding candidate record. Other events on your calendar are evaluated only in memory to determine whether they are an interview and are not stored. We also store a Google-issued sync token so that we only read changes since the last check.

Meet transcripts. Transcripts are retrieved only for meetings THEIA already recognizes as interviews, and only after the meeting has ended. The transcript text is written to the candidate's record in the Client's hiring system (Salesforce) and then processed by THEIA's AI features to produce the interview summary and role-fit indicators described in Section 13. Transcripts are treated as Interview data under Section 7 and retained accordingly. Transcripts are not used to train generalized AI or machine-learning models.

Google Docs content. The text of a document you paste is sent to THEIA's AI assistant as part of your Job Description Builder conversation and retained with that conversation history for the job draft. It is not copied into any other system, and no other document is accessed.

Human access. THEIA personnel do not read Google user data except (i) with your explicit permission for a support request, (ii) where necessary for security purposes such as investigating abuse, (iii) to comply with applicable law, or (iv) after the data has been aggregated and de-identified for internal operations. Access is logged and limited to authorized staff.

Sharing. Google user data is disclosed only to the Client whose hiring workflow you are using (through the candidate records described above), to the service providers listed in our subprocessor list that host or process THEIA (including Google Cloud, Salesforce and Render), and to legal authorities where required by law. We do not transfer Google user data to any other application or to third parties for their own purposes.

Storage and security. The OAuth credentials Google issues to THEIA are encrypted at rest with a dedicated key that is separate from database credentials, are never written to logs, and are never returned through our application interfaces. All data is encrypted in transit (TLS 1.2+). Every connection, disconnection and credential failure is recorded in an audit log.

Deletion. When you disconnect your Google account in THEIA, we immediately revoke the credentials with Google and delete them, together with the calendar sync token, from our systems. If you revoke access from your Google Account instead, our next scheduled check detects the revocation, stops all access and marks the connection as removed; you may also email privacy@theiajobs.ai to have the stored credentials deleted right away. Interview scheduling records and transcripts that have already become part of a candidate's hiring record remain subject to the Client's retention configuration and Section 7, because they document the hiring process; you or the Client may request their deletion under Section 8.

Google's own policies. Your use of Google services is also governed by Google's Privacy Policy and Terms of Service.