Privacy Policy

Last updated: September 2026

1. Introduction

BOUGLAD HUMAN RESOURCES AI LLC ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered human resources platform and services ("Service").

This policy applies to our website and all related services. By using our Service, you consent to the data practices described in this policy where consent is the applicable legal basis; where another legal basis applies (e.g. performance of a contract, legitimate interests, or a legal obligation), we process your information on that basis as described in Section 13.2.

If you are a candidate or employee whose personal data was submitted by one of our business customers (a consulting firm or HR team using the Service, "Business Customer") — for example because you applied for a job, or your employer uses the Service for organigram/workforce planning — that data is processed by us on the Business Customer's behalf and instructions. The Business Customer, not us, is the party who decides what data is collected and why, and is your primary point of contact for exercising your rights. Our role, and the safeguards that apply to that data, are described in our Data Processing Agreement. We nonetheless extend the security commitments in Section 6 of this policy to that data, and will assist the relevant Business Customer with rights requests we receive directly from you.

2. Information We Collect

2.1 Personal Information You Provide

Account Information: Name, email address, phone number, company name, job title
Profile Information: Professional details, preferences, account settings
Payment Information: Billing address, payment method details (processed securely by Stripe)
Communications: Messages sent through our platform, customer support interactions
Content: Documents, job descriptions, templates, and other content you upload or create

2.2 Information Automatically Collected

Usage Data: Pages visited, features used, time spent, click patterns
Device Information: IP address, browser type, operating system, device identifiers
Cookies and Tracking: See our Cookie Policy below
Log Information: Server logs, error reports, performance data

2.3 Information from Third Parties

Payment Processors: Transaction confirmations and payment status from Stripe

2.4 Candidate and Employee Data Submitted by Business Customers

If you are a job candidate, employee, or other individual whose information is submitted to the Service by a Business Customer (rather than something you gave us directly) — for example a résumé, interview transcript, assessment result, organigram record, or (for the AI interview and BG Assessment features) short camera-clip recordings and a log of fullscreen-exit/tab-switch/window-focus events captured for anti-cheating verification during the session — we process that data solely as directed by the Business Customer, under the terms of our Data Processing Agreement. We do not use it for our own marketing, do not sell it, and do not combine it with other individuals' data except as needed to provide the Service (e.g. aggregate, de-identified analytics on platform usage).

3. How We Use Your Information

3.1 Service Provision

Provide, operate, and maintain our services
Process your requests and transactions
Generate AI-powered content and recommendations
Manage your account and subscription

3.2 Communication

Send service-related notifications and updates
Respond to your inquiries and provide customer support
Send marketing communications (with your consent)
Conduct user research and gather feedback

3.3 Improvement and Analytics

Analyze usage patterns to improve our services
Develop new features and functionalities
Conduct research and development
Ensure platform security and prevent fraud

3.4 Legal and Compliance

Comply with legal obligations and regulatory requirements
Protect our rights and the rights of others
Resolve disputes and enforce our agreements

3.5 Artificial Intelligence and Automated Decision-Making

The Service uses AI (including third-party large language models, see Section 4.2) to help generate job descriptions and to screen, score, or rank résumés and candidates against criteria defined by our Business Customer. These AI outputs are decision-support tools intended for review by a qualified human at the Business Customer — we do not make hiring, promotion, or termination decisions ourselves, and the Service does not automatically reject or advance a candidate without the Business Customer's own review step. If you are a candidate and believe a decision about you was made using this Service, you have the right to request human review and an explanation of the factors involved by contacting the Business Customer that used the Service (as the party responsible for the hiring decision) or us at privacy@bghrai.com, and we will assist in coordinating that request as described in our Data Processing Agreement.

4.1 We DO NOT Sell Your Personal Information

4.2 Service Providers

We share information with the following categories of trusted third-party service providers, and no others, in order to operate the Service:

Hosting and Email Delivery: Hostinger, for web application hosting, database hosting, and transactional email (account verification, password resets, notifications)
AI Processing: OpenAI, to generate job descriptions, screen and rank résumés, and analyze interview content that you or a Business Customer submit for that purpose. Content sent to OpenAI's API is used only to generate the output you requested; as of this policy's last update, OpenAI does not use API-submitted content to train its models by default. See our Data Processing Agreement for the full sub-processor list applicable to Business Customer data.
Payment Processing: Stripe, for secure payment transactions and subscription billing (Stripe does not receive candidate/employee data)

We do not currently use third-party marketing/behavioral-analytics services (e.g. Google Analytics, Meta Pixel) or third-party customer-support platforms on the Service; if that changes, we will update this section and, where the change is material, notify you as described in Section 15.

4.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

4.4 Legal Requirements

We may disclose information when required by law or to:

Comply with legal process or government requests
Protect our rights, property, or safety
Prevent fraud or illegal activities
Respond to emergencies

4.5 With Your Consent

We may share information for other purposes with your explicit consent.

4.6 Candidate Pool Sharing (optional, Business-Customer-controlled)

[DRAFT — pending attorney review] The Service offers Business Customers an optional feature that lets them share their candidate data (assessment results, AI interview results, résumé screening results, and job-board applicants) with other Business Customers who have also turned this feature on, and see those other Business Customers' shared candidate data in return. This feature is off by default for every Business Customer and is only ever turned on by that Business Customer's own deliberate action — we do not enable it on anyone's behalf. If you applied to, or took an assessment/interview for, a Business Customer that has this feature enabled, your candidate data may become visible to other participating Business Customers on our platform, in addition to the Business Customer you originally engaged with. See our Data Processing Agreement Section 2.1 for how this affects the Business Customer's own legal responsibilities for that data.

5. International Data Transfers

5.1 Cross-Border Transfers

As a US-based company serving international customers, we may transfer your personal information to and from the United States and other countries where we or our service providers operate.

5.2 Safeguards

We implement appropriate safeguards for international transfers, including:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions where applicable
Other lawful transfer mechanisms as required

5.3 EU-US Data Privacy Framework

We comply with applicable international data protection frameworks and regulations.

6. Data Security

6.1 Security Measures

We implement industry-standard security measures including:

Encryption: Data encrypted in transit via HTTPS (SSL/TLS)
Access Controls: Access to administrative tools is limited to authorized personnel
Monitoring: Systems and logs monitored for unusual activity
Reviews: Periodic reviews of our security posture

6.2 Data Breach Response

In case of a security incident, we will:

Investigate and contain the breach promptly
Notify affected users within 72 hours when required
Cooperate with regulatory authorities as necessary
Implement additional safeguards to prevent future incidents

7. Your Rights and Choices

7.1 Access and Portability

Request access to your personal information
Receive a copy of your data in a portable format
Export your content and documents

7.2 Correction and Updates

Update your account information and preferences
Correct inaccurate or incomplete data
Modify your communication preferences

7.3 Deletion and Erasure

Delete your account and personal information
Request erasure of specific data (subject to legal retention requirements)
Withdraw consent for optional data processing

7.4 Restriction and Objection

Restrict processing of your personal information
Object to direct marketing communications
Opt-out of optional data collection

7.5 Exercising Your Rights

To exercise these rights, contact us at privacy@bghrai.com with a clear description of your request.

8. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children. If we discover we have collected information from a child, we will delete it promptly.

9.1 We Only Use Essential, First-Party Cookies

We do not use any third-party cookies, advertising cookies, cross-site tracking, or third-party analytics (e.g. Google Analytics) — nothing on this Service sets a cookie belonging to another company. The complete list of cookies we use, all first-party and all strictly necessary for the site to function:

Session/authentication (essential): keeps you logged in and protects against cross-site request issues. Set automatically; cannot be disabled without losing the ability to log in.
preferred_locale (essential/functional): remembers your chosen language. Set only when you change language.
googtrans (functional): set only if you use the on-page Google Translate widget, to remember your translation choice.

Because every cookie we set is strictly necessary and first-party, no cookie consent banner is required or shown.

9.2 Cookie Management

You can control cookies through your browser settings at any time; note that blocking the session cookie will prevent you from staying logged in.

10. Data Retention

10.1 Retention Periods

Account Data: Retained while your account is active plus 90 days after deletion
Usage Data: Retained for up to 2 years for analytics purposes
Financial Records: Retained for 7 years for tax and accounting purposes
Support Communications: Retained for 3 years for quality assurance

10.2 Legal Holds

We may retain information longer when required by law or for legal proceedings.

11. Third-Party Links and Services

Our Service may contain links to third-party websites or integrate with external services. This Privacy Policy does not apply to these third parties. We encourage you to review their privacy policies.

12. California Privacy Rights (CCPA/CPRA)

12.1 California Residents

If you are a California resident, you have rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

Right to know/access the categories and specific pieces of personal information we collect, use, and disclose
Right to delete personal information, subject to certain exceptions
Right to correct inaccurate personal information
Right to opt out of the sale or sharing of personal information — we do not sell personal information and do not share it for cross-context behavioral advertising, so there is nothing to opt out of today; if that ever changes we will provide a "Do Not Sell or Share My Personal Information" link here
Right to limit use of sensitive personal information — we only collect sensitive personal information (e.g. precise data you or a Business Customer choose to include in résumés/assessments) as needed to provide the Service, and do not use it for purposes beyond that
Right to non-discriminatory treatment for exercising any of these rights

12.2 Exercising CCPA/CPRA Rights

Contact us at privacy@bghrai.com to exercise these rights, or have an authorized agent submit a request on your behalf. We will verify your identity before fulfilling a request and will respond within the timeframes required by law.

13.1 EU/UK Residents

If you are in the European Union or United Kingdom, you have rights under the General Data Protection Regulation (GDPR):

Right to access, rectify, and erase personal data
Right to restrict or object to processing
Right to data portability
Right to lodge a complaint with supervisory authorities

13.2 Legal Basis for Processing

We process personal information based on:

Contract Performance: To provide our services
Legitimate Interests: For business operations and improvements, security and fraud prevention, and — where a Business Customer instructs us to process candidate data — to provide the Service on the Business Customer's behalf under Article 6(1)(f) or, where the Business Customer relies on its own separate legal basis (e.g. consent it has obtained from the candidate), on that basis
Consent: For marketing, optional features, and the non-essential cookie described in Section 9
Legal Obligations: To comply with applicable laws

13.3 EU/UK Representative

Where required by Article 27 GDPR or the equivalent UK GDPR provision, we will appoint an EU and/or UK representative for data protection matters. Contact dpo@bghrai.com to confirm current representative details.

14. Contact Information and Data Protection Officer

14.1 Privacy Questions

For privacy-related questions or to exercise your rights:

Email: privacy@bghrai.com
Support: support@bghrai.com
Website: https://bghrai.com

14.2 Data Protection Officer

For EU/UK data protection matters:

Email: dpo@bghrai.com

14.3 Supervisory Authorities

EU residents may contact their local data protection authority. UK residents may contact the Information Commissioner's Office (ICO).

15. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. We will:

Post the updated policy on our website
Update the "Last updated" date
Notify you of material changes via email or platform notification
Obtain your consent for material changes that expand data collection

Your continued use of our Service after changes become effective constitutes acceptance of the updated policy.

16. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

BOUGLAD HUMAN RESOURCES AI LLC

Email: privacy@bghrai.com
Support: support@bghrai.com
Legal: legal@bghrai.com
Website: https://bghrai.com

This Privacy Policy is effective as of September 2026 and governs the collection and use of information by BOUGLAD HUMAN RESOURCES AI LLC.