Privacy Policy

This Privacy Policy applies to all users of the Caderre platform, including the website at caderre.com and all associated services, features, and applications (collectively, the "Platform"). It covers three types of users: Super Admins and Recruiters who use Caderre to manage hiring (collectively, "Company Users"), and job candidates who use Caderre to track their applications and interview progress ("Candidates"). Within a company account, a Super Admin has full access including billing and team management, while a Recruiter has access to hiring workflows only.

Caderre Inc. is a Delaware corporation and acts as the data controller for personal information collected through the Platform. Where Caderre processes personal data on behalf of a Company User (for example, candidate data that a company uploads or syncs via their ATS), Caderre acts as a data processor for that company.

For records of activity within a company's workspace, including audit logs of actions taken in a company account and the company's team roster, the company is the controller of those records, and Caderre maintains them on the company's behalf. When an individual member of a company deletes their personal account, we remove their personal information, but records of actions that person took as part of the company's workspace remain part of that company's account, under the company's control and subject to the retention periods in Section 5. This lets a company keep an accurate and complete record of activity in its own account.

This policy does not apply to third-party websites or services that may be linked to from our Platform. We encourage you to review the privacy policies of any third parties you interact with.

We collect information in the following ways:

Information You Provide Directly

• Account Registration: When you create an account using email and password, we collect your name, email address, and your account type (company or candidate). Passwords are hashed and never stored in plain text. If you register using Google OAuth, no password is stored by Caderre; authentication is delegated entirely to Google.
• Company Profile: Company Users may provide their company name, logo, website, industry, and billing information. Logos and branding images you upload are served from a public web address so they can appear on candidate-facing pages and in emails.
• Candidate Profile: Candidates may provide their name, contact details, resume, LinkedIn profile URL, and other professional information.
• Job and Application Data: Companies provide job descriptions, interview stages, and hiring criteria. Candidates submit applications and may upload supporting documents.
• Communications: If you contact us for support or send feedback, we collect the content of those messages.
• Payment Information: For paid subscriptions, billing details are collected and processed by our payment processor, Stripe. Caderre does not store full credit card numbers.
• ATS Integration Interest: If you express interest in connecting an ATS integration, we collect your email address and the name of your ATS provider, used to help set up your integration and to contact you about availability.
• ATS Connection Credentials: When a Company User connects certain applicant tracking systems directly, we collect and store the API keys, access tokens, or webhook secrets needed to connect. These credentials are encrypted at rest and used only to synchronize your hiring data.

Information Collected Automatically

• Log and Technical Data: When you use the Platform, our infrastructure providers automatically record standard technical information such as your IP address, access times, error logs, and referring URLs. Some audit-log entries for actions taken in a company account also record the IP address from which the action was taken. We do not use analytics, tracking, or device-fingerprinting tools.
• Session Activity: For session security, we monitor browser activity events (such as mouse movement, keyboard input, and scrolling) solely to detect periods of inactivity. After 60 minutes of inactivity, your session is automatically ended to protect your account. This activity data is not stored or transmitted; it is processed entirely within your browser.

Candidate Status Links and View Activity

• Candidate Status Links: A Company User may share a status page with a candidate through a private link that does not require an account. Anyone who has the link can view the status it shows, so the link works as an access credential and should be kept confidential. These links stay active until the company revokes them. When a status link is opened, we briefly record the request's IP address to protect the page against abuse.
• Status View Activity: When a candidate views their application status, including through a status link, we record that a view occurred and the time of the most recent view. This activity is shown to the Company User as an indicator of candidate engagement.

Information from Third Parties

• Google OAuth: If you choose to sign in with Google, we receive your name, email address, and profile photo from Google to create or authenticate your account. We do not receive access to your Google Drive, Gmail, or other Google services.
• ATS Integrations: If a Company User connects an applicant tracking system, we receive candidate and job data from that system on behalf of the company. Depending on the provider, we connect either directly to the ATS or through our integration partner Unified.to (see Section 4).
• Company Logos: We may retrieve your company's publicly available logo using a logo lookup service (Brandfetch) based on your email domain, solely for display within the Platform.

Chrome Extension

• If you use the Caderre Chrome Extension, we collect job titles, company names, job posting URLs, application status, and any notes you choose to add when you track a job. The extension reads content from the web page you are viewing to auto-detect job details, but only when you actively click the extension to track a job. The extension does not passively monitor your browsing activity, collect browsing history, or read page content without your action.
• The extension uses these browser permissions: storage, to keep you signed in; identity, to sign you into your Caderre account; and access to page content on the sites where you track jobs, so it can read job details from the page you are viewing. It reads and extracts page details only when you actively click to track a job.

We use the information we collect for the following purposes:

• Providing the Platform: To create and manage your account, deliver the core features of the Platform, and process transactions.
• Connecting Companies and Candidates: To enable companies to manage their hiring pipeline and to give candidates visibility into their application status and interview progress. If a Company User invites you as a candidate, we will send you an email invitation on behalf of that company. This email is sent based on the company's authorization and their representation that they have a legitimate basis to share your contact information with us in connection with their hiring process.
• Communications: To send you account-related emails (such as welcome emails, trial notifications, purchase confirmations, team invitations, candidate invitations, password resets, and interview-related notifications), and, where you have opted in, product updates and promotional content.
• Customer Support: To respond to your questions, troubleshoot issues, and improve your experience.
• Security and Fraud Prevention: To detect and prevent fraudulent activity, unauthorized access, and other misuse of the Platform.
• Product Improvement: To maintain and improve the Platform. We do not use behavioral analytics or tracking tools (see Section 9).
• Legal Compliance: To comply with applicable laws, regulations, legal processes, and governmental requests.
• Billing and Subscriptions: To manage your subscription, process payments, send invoices, and handle billing inquiries.
• Application Status Timing: Company Users may configure a rejection delay setting that controls when candidates are notified of a disqualification decision. When enabled, there may be a delay of up to 5 days between a company's decision and the candidate's visibility of that decision in the Platform. This feature is designed to give companies time to communicate personally with candidates before the status update appears.
• Audit Logging: We keep audit logs of significant actions taken in a company account (such as publishing a job, sending team or candidate invitations, changing settings, ATS sync events, and password-reset requests) for security, compliance, and troubleshooting. An entry may include the acting user's identifier and email address, the action performed, a timestamp, and, for actions recorded on our servers, the IP address. Audit logs are retained for 12 months and then deleted, as described in Section 5.

We will only use your personal information for the purposes described above or for purposes that are compatible with those described. If we intend to use your data for a materially different purpose, we will notify you and, where required, obtain your consent.

We do not sell your personal information. We share your information only in the following limited circumstances:

• Between Companies and Candidates: When a company invites a candidate to the Platform or when a candidate applies to a job, relevant profile and application information is shared between that company and that candidate as necessary to facilitate the hiring process.
• Team Members: Within a Company User account, information may be visible to other authorized team members (recruiters and administrators) at that company.
• Service Providers: We engage trusted third parties that process data on our behalf to operate the Platform: cloud infrastructure and database (Supabase), payment processing (Stripe), transactional email (Resend), ATS integration middleware (Unified.to), frontend hosting and content delivery (Vercel), company logo lookup (Brandfetch), and authentication (Google, for Google sign-in). We also use Slack to receive internal operational notifications, which can include limited account details such as a company name, a job title, and plan or billing amounts, but not candidate or user email addresses or names. Our core sub-processors are bound by data processing agreements and may not use your data for their own purposes. A full list is on our Sub-Processor List page, and we give at least 14 days' advance notice before adding a new sub-processor.
• Third-Party Services That Receive Limited Technical Data: When a candidate uses the interview-scheduling feature to organize their interviews, the location text they enter and their IP address are sent to OpenStreetMap's Nominatim service to find matching places. This service receives only the limited technical data needed for that function.
• ATS Providers: If a Company User enables an ATS integration, hiring data flows between the Platform and the connected ATS as the company configures. For several providers (currently Greenhouse, Ashby, Lever, Workable, SmartRecruiters, and JazzHR), we connect directly to the ATS using credentials the company provides, and data passes directly between the Platform and that ATS. For other providers (currently BambooHR, Fountain, Pinpoint, Recruitee, Teamtailor, and Workstream), the connection is handled by our integration partner Unified.to, which acts as a sub-processor. In both cases, the connected ATS is the company's own system.
• Legal Requirements: We may disclose your information if required by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect the rights, safety, or property of Caderre, our users, or the public.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will notify you of any such change and any choices you may have.
• With Your Consent: We may share your information with third parties when you have given us your explicit consent to do so.

We retain your personal information for as long as your account is active or as needed to provide the Platform's services. Specifically:

• Active Accounts: Your account data is retained for the duration of your account's existence.
• After You Delete a Personal Account: You may delete your account at any time from your settings. When you do, we remove your personal information, including your profile and personal-account data, and cancel any active subscription. Where you took actions as part of a company's workspace, records of those actions (such as audit-log entries and your entry in the company's team roster) remain part of that company's account as the company's records, subject to the periods below. Uploaded files tied to your personal account are deleted.
• When a Company Account Is Closed: When a company account itself is closed, the company's data, including its jobs, applications, candidate invitations, connected-ATS credentials, and uploaded files, is deleted, and the company's audit-log entries are anonymized. Candidate data the company uploaded or synced is deleted on the same schedule.
• Team Roster Records: A company's record that a person was a member of its account, including that person's name and work email, is retained as part of the company's account until the company account is closed.
• Candidate Data Uploaded by Companies: Candidate data that a Company User uploads or syncs is governed by that company's retention decisions. When a company account is closed, associated candidate data is deleted according to our standard deletion schedule.
• Billing Records: Transaction and billing records are retained for a minimum of seven (7) years to satisfy tax and accounting obligations.
• Audit Logs: Audit-log records are retained for 12 months from the date of the logged event and are then deleted on a recurring schedule. When a personal account is deleted, personal identifiers are removed from that person's personal-context entries; entries recording actions taken as part of a company's workspace keep their attribution as the company's record until the 12-month period elapses. When a company account is closed, its audit-log entries are anonymized.
• Backup Copies: Residual copies of deleted data may remain in our database provider's encrypted backups for a limited period, currently up to approximately seven days, before being overwritten.
• ATS Disconnection: When a Company User disconnects their ATS integration, active data synchronization ceases immediately. Previously synchronized data remains in the Platform and is subject to the retention periods described above.

Regardless of where you are located, you have the following choices regarding your personal information:

• Account Information: You can review and update your account profile information at any time from your account settings page.
• Email Communications: You can opt out of non-essential marketing emails by clicking the "unsubscribe" link in any such email. You cannot opt out of essential transactional emails (such as password resets or interview notifications) while your account is active.
• Account Deletion: You can delete your account directly from your Platform settings. You may also contact us at hello@caderre.com for assistance. Account deletion is processed promptly, subject to any legal retention obligations.
• Cookies: You can control the use of non-essential cookies through your browser settings. Please note that disabling certain cookies may affect Platform functionality.

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access: You have the right to request a copy of the personal information we hold about you.
• Right to Rectification: You have the right to request correction of any inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): You have the right to request deletion of your personal information in certain circumstances.
• Right to Restriction of Processing: You have the right to request that we limit how we use your personal information in certain circumstances.
• Right to Data Portability: You have the right to receive your personal information in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object: You have the right to object to the processing of your personal information where we rely on legitimate interests as the legal basis for processing.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local data protection supervisory authority.

Our lawful bases for processing personal data include: performance of a contract (providing the Platform's services), legitimate interests (security, fraud prevention, product improvement), legal obligation, and consent (for optional features and marketing communications).

To exercise any of these rights, please contact us at hello@caderre.com. We will respond to your request within 30 days.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), grants you the following rights:

• Right to Know: You have the right to request information about the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, the purposes for collection, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information we hold about you.
• Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. If this practice changes, we will update this policy and provide a "Do Not Sell or Share My Personal Information" mechanism.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights. We will not deny you services, charge you different prices, or provide a different quality of service as a result of exercising these rights.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes other than those permitted under the CPRA.

To submit a verifiable consumer request or designate an authorized agent to exercise these rights on your behalf, please contact us at hello@caderre.com.

We use cookies and similar tracking technologies to operate and improve the Platform. A "cookie" is a small text file placed on your device when you visit a website.

Types of Technologies We Use

• Strictly Necessary: These are essential for the Platform to function. Login state is maintained using secure session tokens stored in your browser by our authentication provider (Supabase). These are required for the Platform to operate, and you cannot opt out of them while using the Platform.

We do not currently use analytics, advertising, or third-party tracking cookies. If we introduce analytics or tracking technologies in the future, we will update this policy and, where required, obtain your consent before deploying them.

You can control cookies through your browser settings. Most browsers allow you to block or delete cookies. However, blocking certain cookies may prevent you from using key features of the Platform, including logging in.

We take the security of your personal information seriously and implement industry-standard technical and organizational measures to protect it. These measures include:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS (Transport Layer Security).
• Encryption at Rest: Sensitive data stored in our databases is encrypted at rest.
• Access Controls: Access to personal data is restricted to authorized personnel on a need-to-know basis. We enforce role-based access controls and Row-Level Security policies at the database level.
• Password Security: User passwords are hashed using industry-standard cryptographic functions and are never stored in plain text.
• Regular Security Reviews: We regularly review our security practices and infrastructure to address new and evolving threats.
• Incident Response: We have procedures in place to detect, respond to, and notify affected users of data breaches in accordance with applicable law.

While we take these precautions, no system is completely secure. We cannot guarantee the absolute security of your information. You are responsible for maintaining the confidentiality of your account credentials and for any activity that occurs under your account.

Caderre is headquartered in the United States. If you access the Platform from outside the United States, please be aware that your personal information will be transferred to, stored, and processed in the United States and potentially other countries where our sub-processors operate.

For users in the European Union or European Economic Area, we ensure that all transfers of personal data outside the EEA are conducted using appropriate safeguards. The specific transfer mechanisms used by each of our sub-processors are as follows:

• Supabase (cloud infrastructure): Standard Contractual Clauses (SCCs) approved by the European Commission.
• Stripe (payment processing): Standard Contractual Clauses (SCCs) approved by the European Commission.
• Resend (transactional email): Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF).
• Unified.to (ATS integration middleware): Standard Contractual Clauses (SCCs) approved by the European Commission.
• Vercel (frontend hosting and CDN): EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs).
• Brandfetch (company logo retrieval): Standard Contractual Clauses (SCCs) approved by the European Commission.
• Google (OAuth authentication): EU-US Data Privacy Framework (DPF) and Standard Contractual Clauses (SCCs).
• Slack (internal operational notifications): Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF).

When a candidate uses the interview-scheduling feature, limited technical data (an IP address and the location text entered) is sent to OpenStreetMap's Nominatim service, operated by the OpenStreetMap Foundation in the United Kingdom and European Union.

A complete list of sub-processors and their applicable transfer mechanisms is available on our Sub-Processor List page.

By using the Platform, you consent to your personal information being transferred to and processed in the United States in accordance with this Privacy Policy.

The Platform is intended for use by adults and is not directed to children under the age of 16 (or under the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal information from children.

If we become aware that we have collected personal information from a child without appropriate consent, we will take steps to delete that information. If you believe we may have inadvertently collected information from a child, please contact us immediately at hello@caderre.com.

The Platform may contain links to third-party websites, services, or applications, including ATS providers, LinkedIn, and other tools you may choose to connect. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices.

When you connect third-party services to your Caderre account, those services' own terms of service and privacy policies govern how they handle your data. We encourage you to review their policies before enabling any integration.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending an email notification to the address associated with your account
• Displaying a prominent notice on the Platform

Your continued use of the Platform after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree to the revised policy, you must discontinue use of the Platform and may request account deletion.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your personal information, please contact us:

We will respond to all privacy-related inquiries within 30 days. For urgent data security matters, please indicate "URGENT" in your subject line.

If you are an EU/EEA resident and are not satisfied with our response, you have the right to lodge a complaint with your national data protection supervisory authority. A list of EU supervisory authorities can be found on the European Data Protection Board website.