Privacy Policy
Aptimal, Inc.
Last updated: 07/23/2026
Effective: 07/23/2026
1. Scope
Aptimal, Inc. ("Aptimal," "we," "us") provides an AI-assisted recruitment workflow platform. This Privacy Policy explains how we handle personal information.
The Services are offered in the United States only, and are intended for use by U.S.-based employers hiring for positions located in the United States. We do not currently offer the Services in the European Economic Area, the United Kingdom, or Switzerland, and we do not target individuals in those regions.
Please read Section 2 first. Our role — and therefore who you should contact about your data — depends on whether you are a customer or a job candidate.
2. Our Two Roles
2.1 When we are a business. We act as a business (controller) for personal information about:
- our customers and their authorized users (account, billing, and support data);
- visitors to our website; and
- prospects and people who contact us.
For this information, we determine the purposes and means of processing, and this Policy governs.
2.2 When we are a service provider. We act as a service provider (processor) for personal information about job candidates who apply through a customer's job posting or complete an assessment. The employer using Aptimal is the business. They decide what data to collect, what questions to ask, how long to keep it, what scoring thresholds to set, and what decisions to make.
If you are a job candidate: the employer you applied to controls your information. To exercise your rights, contact that employer directly — their privacy notice governs. If you contact us and we can identify the relevant customer, we will forward your request to them and support their response.
Our processing on behalf of customers is governed by our Data Processing Addendum.
2.3 A note on employment data under state law. Most U.S. state privacy laws exclude individuals acting in an employment or job-application context from the definition of "consumer." California is the significant exception: since the CPRA amendments took effect, job applicants and employees in California have substantially the same rights as other consumers. Where this Policy describes candidate rights, those rights are principally driven by California law and by the employer's own obligations.
3. Personal Information We Collect
3.1 Customer and user information (we are the business)
| Category (CCPA reference) | Examples | Source |
|---|---|---|
| Identifiers | Name, work email, phone, employer, job title, IP address, account ID | You; your organization |
| Customer records | Billing contact and address, payment method (tokenized), transaction history | You; Stripe |
| Commercial information | Subscription plan, purchase history, usage of paid features | You; our systems |
| Internet activity | Log data, browser and device information, pages viewed, feature usage, error reports | Our systems; Vercel |
| Professional information | Job title, role, department | You |
| Inferences | Product usage patterns used to improve the Services | Our systems |
We do not collect sensitive personal information about customers or users beyond account credentials.
3.2 Candidate information (we are the service provider)
Collected and processed on customer instructions:
| Category | Examples |
|---|---|
| Identifiers | Name, email, phone, location |
| Professional / education information | Resume or CV contents, employment history, education, skills, certifications, uploaded attachments |
| Assessment data | Free-text responses to scenario-based and role-specific questions, timestamps, completion status |
| Generated data | AI-produced summaries, Qualification Score, Assessment Score, suggested interview questions |
| Pipeline data | Application status, stage history, recruiter notes, tags, star/pin status, rejection status, application history across postings |
| Scheduling data | Appointment times, meeting links |
| Background check data | Where a customer orders a check, results returned by the consumer reporting agency and stored on the candidate profile |
We do not solicit sensitive personal information from candidates. Customers are contractually prohibited from configuring the Services to elicit it. If a candidate voluntarily includes such information in a resume or free-text response, it is stored as an inseparable part of that document and receives no additional processing.
4. How We Use Personal Information
4.1 Customer and user information
- Provide, operate, secure, and maintain the Services
- Authenticate users and protect accounts
- Process payments, invoice, and collect
- Provide customer support
- Debug, monitor performance, and improve the Services
- Send transactional and, where permitted, marketing communications
- Comply with legal obligations, prevent fraud, and establish or defend legal claims
4.2 Candidate information
We process candidate information only on the customer's documented instructions, for the purpose of providing the Services: parsing resumes, generating summaries and scores, delivering assessments, moving candidates through the pipeline, sending transactional email, and enabling scheduling and background check ordering.
We do not use candidate information for our own marketing. We do not sell it. We do not share it for cross-context behavioral advertising.
5. Automated Decision-Making and AI
This section is important; please read it.
5.1 What the AI does. The Services use large language models to compare resumes against job descriptions and to analyze free-text assessment responses, producing written summaries and numeric scores (a Qualification Score and an Assessment Score), plus suggested interview questions.
5.2 These are decision support outputs. Scores and summaries are probabilistic. They are not determinations of a candidate's ability, honesty, character, or likely job performance, and they may contain errors.
5.3 Aptimal does not make hiring decisions. All employment decisions are made by the employer. Our Terms of Service require customers to apply meaningful human review before any adverse decision.
5.4 Automated filtering. Customers may configure filters that automatically move candidates below a threshold, or who do not meet stated minimum requirements, out of the active pipeline. Where such use would constitute automated decision-making technology used to make a significant decision under applicable law, the employer is responsible for the required notices, opt-out or human appeal mechanisms, risk assessments, and recordkeeping. See our AI & Hiring Compliance page.
5.5 Model training. We do not use customer or candidate information to train foundation models, and our AI subprocessors are contractually prohibited from training on data we send them. We may use aggregated, de-identified information that cannot reasonably be re-identified to operate, secure, evaluate, and improve the Services.
6. How We Disclose Personal Information
We disclose personal information to:
6.1 Service providers. Vendors who process data on our behalf under written contract restricting their use. Our current list is at /legal/subprocessors.
6.2 Customers. Candidate information is made available to the employer whose posting the candidate applied to, and to that employer's authorized users.
6.3 Integrations you enable. If you connect a calendar, video conferencing, or HRIS integration, data is shared with that provider under their terms.
6.4 Professional advisors. Lawyers, accountants, auditors, and insurers under confidentiality obligations.
6.5 Legal and safety. Where required by law, subpoena, or governmental request; to enforce our agreements; or to protect rights, property, or safety. Where a request concerns candidate data, we will notify the affected customer unless legally prohibited.
6.6 Corporate transactions. In connection with a merger, acquisition, financing, or asset sale, subject to confidentiality and continued protection.
Statutory disclosures
In the preceding 12 months, we disclosed the categories of personal information listed in Section 3 to the categories of recipients listed above, for the business purposes described in Section 4.
We have not sold personal information, and we have not shared personal information for cross-context behavioral advertising, in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16.
7. Retention
7.1 Customer and user information. Retained for the duration of the customer relationship, then as needed for legitimate business purposes, legal obligations, and legal claims. Billing records: typically seven years.
7.2 Candidate information. Retained according to the customer's configured settings and instructions. Customers are responsible for setting retention periods that meet their own obligations, which include:
- EEOC recordkeeping under Title VII, the ADA, and the ADEA — generally one year from the making of the record or the personnel action, whichever is later;
- California Civil Rights Department regulations — employers using automated decision systems are subject to extended recordkeeping requirements covering ADS data; and
- Colorado SB 26-189 (effective January 1, 2027) — three years of records relating to automated decision-making technology used in consequential decisions.
We surface configurable retention settings but do not set them for you.
7.3 On termination. Data is available for export for 30 days after termination, then deleted or de-identified except where retention is legally required. Backups purge on our standard cycle, not exceeding 90 days.
8. Security
We maintain technical and organizational measures appropriate to the risk, including encryption in transit and at rest, role-based access control, multi-factor authentication for administrative access, logical tenant isolation, audit logging, vendor security review, secure development practices, and a documented incident response plan. Full detail is in Annex II of the DPA.
No system is perfectly secure. We will notify affected parties of security incidents as required by law and by our DPA.
9. Your Rights
9.1 If you are a job candidate: contact the employer you applied to. See Section 2.2.
9.2 If you are a customer or user: depending on your state of residence, you may have the right to:
- know what personal information we collect, use, and disclose
- access a copy of your personal information
- correct inaccurate information
- delete your personal information
- port your information in a portable format
- limit use of sensitive personal information
- opt out of sale, sharing, targeted advertising, or profiling (note: we do none of these)
- appeal a denied request, where your state provides this right
- not be retaliated against for exercising your rights
How to exercise. Email support@aptimal.ai. We will verify your identity before acting and respond within 45 days, extendable by an additional 45 days with notice. There is no fee unless a request is manifestly unfounded or excessive.
Authorized agents may submit requests with proof of authorization and verification of the consumer's identity.
Appeals. If we deny your request, you may appeal by replying to our decision. We will respond within the period your state requires. In California, you may also contact the California Privacy Protection Agency; in other states, your Attorney General.
10. Cookies and Tracking
See our Cookies Policy. We do not use advertising or cross-site tracking cookies. We honor the Global Privacy Control signal where required.
11. Children
The Services are business tools not directed at children. We do not knowingly collect personal information from anyone under 16. Customers must not use the Services to recruit individuals below the applicable minimum working age without appropriate safeguards. Contact support@aptimal.ai if you believe a child's information has been provided to us.
12. Geographic Scope
The Services are intended for use in the United States only. If you are located outside the United States, do not use the Services. Customers agree in our Terms not to use the Services to process personal information of candidates located in the European Economic Area, the United Kingdom, or Switzerland.
13. Changes
We may update this Policy. We will post the revised version with an updated date, and for material changes we will provide notice by email or in-product notification at least 30 days before they take effect.
14. Contact
Aptimal Inc.
Email us: support@aptimal.ai
Registered Agent: Legalinc Corporate Services Inc.
131 Continental Dr Suite 305 Newark, DE, 19713 US