OpenSeat Privacy Policy

2.1 Information you provide directly

When you use the Service, you may provide:

• Account information – name, email address, password or federated login identifier, company name, job title, and workspace settings.
• Organization information – hiring team structure, job postings, interview stages, templates, internal notes, and configuration.
• Support and communication – messages you send to us by email or through support channels, and any other information you choose to provide.

2.2 Information from single sign-on (e.g. Google Login via Auth0)

If you sign in using Google or another identity provider, we receive from that provider:

• Name
• Email address
• Profile picture (if available)
• Other basic profile information the provider shares for authentication

We use this information to create and authenticate your OpenSeat account and personalize your experience.
We do not get access to your email contents, drive files, or other unrelated data.

2.3 Candidate and applicant data ("Customer Data")

Organizations using OpenSeat may upload, sync, or enter information about job candidates and applicants, including via integrations such as Lever ATS. This may include:

• Candidate names and contact details
• CVs / resumes, portfolios, and links
• Interview notes, feedback, ratings, and status
• Hiring decisions and offer information
• Tags, comments, and other structured or unstructured metadata

We process this information solely on behalf of the organization that controls the workspace ("Customer").
For this data, Streamline acts as a processor (or similar role under relevant laws); the Customer is the controller responsible for ensuring a lawful basis for collecting and using Candidate Data.

2.4 Automatically collected technical data

When you access or use the Service, we automatically collect certain technical information, such as:

• IP address and approximate location
• Browser type and version, device type, operating system
• Referring URLs and pages visited
• Timestamps and duration of sessions
• Log data about requests, errors, and performance

We use this information to operate, secure, and improve the Service.

2.5 Cookies and similar technologies

We use cookies and similar technologies to:

• Keep you signed in
• Remember your preferences
• Measure usage patterns
• Protect the Service against abuse

You can control cookies through your browser settings. Some cookies are essential; disabling them may impair the Service.

4.1 Service providers and subprocessors

We use third-party providers ("Subprocessors") to host, operate, and support the Service. These providers may process personal information on our behalf and are contractually limited to using it only to provide their services to us.

As of the date above, our key Subprocessors include:

1. Auth0 – authentication and identity services (OIDC/OAuth, social login).
   Processes user identifiers, login events, and basic profile information.
2. Cloudflare, Inc. – CDN, DNS, and security services (including Cloudflare Tunnel and WAF).
   Processes network traffic, IP addresses, and security logs.
3. Hostinger International Ltd. – cloud hosting and infrastructure (VPS hosting for core application and database).
   Stores application data at rest and processes it as part of infrastructure operations.
4. OpenAI, L.L.C. – AI services used for candidate analysis and related features.
   We use the OpenAI API configured so that submitted data is not used to train or improve OpenAI's models, in line with OpenAI's current API data-usage policies.
   We minimize personal data sent to OpenAI and primarily send structured, job-related text.
5. GitHub / GitHub Container Registry (ghcr.io) – container image hosting and CI/CD infrastructure.
   Processes build artifacts and deployment metadata; production customer data is not intentionally stored here.
6. Lever, Inc. – Applicant Tracking System integration.
   When enabled by a Customer, candidate data may flow between Lever and OpenSeat according to the Customer's configuration and Lever's own policies.
7. Email service provider – for sending verification, notification, and support emails.
   This may include your email address, message contents, and basic delivery metadata. Details of the current provider can be obtained by contacting us.

We may update this list from time to time. For Customers with data protection agreements in place, we will follow the change-notification procedures specified in those agreements.

4.2 Within your organization

If you use the Service as part of a team or organization, information in your workspace (including Candidate Data) may be visible to other authorized users according to your workspace settings and permissions.

4.3 Legal, safety, and rights protection

We may disclose information if we believe in good faith that it is reasonably necessary to:

• Comply with any applicable law, regulation, legal process, or governmental request.
• Protect the rights, property, or safety of Streamline, our users, candidates, or the public.
• Detect, prevent, or address fraud, abuse, or security issues.
• Enforce our agreements, including our Terms of Service.

4.4 Business transfers

If we are involved in a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, your information may be transferred as part of that transaction, subject to appropriate confidentiality protections.