Your privacy.
Our responsibilities.

• Information you give us: account details you provide at signup, such as your name, email address, password, and company name; demo and contact form details (name, work email, company name, job title, team size, and any message); and the contents of communications you send us.
• Candidate and applicant information: when a customer uploads a resume or candidate record, the Service stores the personal data it contains, such as a candidate’s name, contact details, work history, education, skills, and certifications.
• Applications and resume updates: when you submit an application or use a Resume Refresh link, we process the contact information, answers, resume and other details you submit on behalf of the receiving customer. Public job postings and customer branding are visible to visitors to the careers portal. Applicant information is provided to the receiving customer, not published as part of the posting.
• Contractor portals and client billing: for customers using Billing & Timesheets, we process contractor and client contact details, assignments, time entries, approvals, invoice records and related documents. Contractors may submit time through a customer-provided portal link. The customer controls these records and is responsible for its notices and lawful use.

  Billing information: Stripe collects card details during checkout. CandiLite receives billing and subscription information needed to manage your account, such as payment status, subscription dates and payment-method details. CandiLite does not store full card numbers.

• Information collected automatically: basic technical and usage data (such as IP address, browser type, pages viewed, and timestamps) through standard server logs. We use only the essential cookies and browser storage needed to run the Service, and we do not use advertising cookies.
• Documents sent from the CandiLite Outlook add-in: when you select an attachment in the add-in and send it, we receive that attachment only — its contents, its filename, its file type and its size. We do not receive the rest of the email: not its subject, body, sender, recipients or any other message or mailbox detail. The add-in signs in with your CandiLite account; it does not ask for, receive or store your Outlook or Microsoft password.

We use information to provide, operate, and maintain the Service; parse and structure resumes and job descriptions, and support candidate matching (see AI Processing); respond to demo, contact, and support requests; send service-related communications; improve and secure the Service; and meet legal obligations. Where applicable data protection law requires a legal basis, we process customer and prospect information to perform our contract with you or take steps at your request before a contract; for our legitimate interests in responding to enquiries, operating and securing the Service, and preventing misuse, subject to your rights; and to comply with legal obligations, including billing and recordkeeping. If we rely on consent for a particular activity, you may withdraw it. Customers determine the legal basis for candidate, applicant and contractor data processed on their behalf.

We do not sell your personal information, and we do not use candidate data for advertising.

To turn an uploaded resume into a structured candidate profile, the Service sends the resume’s text to our AI provider, Anthropic, which extracts fields such as contact details, experience, and skills and returns them to us. Anthropic acts as our sub-processor under its commercial terms. Job parsing and candidate matching may also send job descriptions, selected resume text and matching criteria to Anthropic to return structured information or suggested matches. Resume Refresh can process an updated resume before the recruiter reviews proposed changes. AI output can be inaccurate and is not a substitute for human review or a hiring decision.

We use Anthropic’s commercial API. Anthropic’s commercial data policy states that inputs and outputs are not used to train its models by default; voluntarily shared feedback or an explicit opt-in can be treated differently. Processing a document to deliver a feature is distinct from model training. Contact us about your organization’s AI data-processing requirements before uploading data that needs additional contractual restrictions.

We share relevant information with providers that help us run the Service under their applicable service and data-protection terms:

• Supabase: database and backend hosting (account and candidate data).
• Netlify: website and application hosting.
• Resend: transactional and notification email.
• Microsoft 365: receiving and responding to demo, contact and support emails.
• Anthropic: AI resume and job parsing, matching criteria and candidate matching.
• Amazon Web Services (AWS): document storage and delivery.
• Stripe: payment processing, card collection, trials, subscriptions and billing.

We may also disclose information if required by law, to protect rights or user safety, or in connection with a business transfer such as a merger or acquisition. We do not sell personal information.

We keep account information while your account is active and as needed to provide the Service. We retain candidate data on our customer’s behalf until the customer deletes it or closes their account, after which we arrange deletion or de-identification, subject to legal requirements. Canceling a subscription is different from closing an account or requesting deletion: it does not immediately erase recruiting records. Retention depends on the customer’s instructions, service needs, security and legal recordkeeping obligations; this policy does not promise a fixed post-cancellation storage period.

Your Primary Admin can export retained organization records and stored attachments under Organization → Export your data, including after commercial subscription access ends. Administrative suspensions may require support review. Contact hello@candilite.com about closure or deletion and the records affected. We may retain billing, transaction or security records where needed to meet legal obligations or resolve disputes.

A document sent from the CandiLite Outlook add-in is held as a pending upload until you choose where it belongs. If you do not choose a destination, that pending upload expires seven days after it was sent; reopening it does not extend that period. Once you file the document to a candidate or a job it becomes ordinary candidate data and is retained as described above.

We use reasonable technical and organizational measures to protect personal data, including encryption in transit (TLS), row-level access controls in our database, and restricted internal access. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Depending on where you live, you may have rights to access, correct, delete, or port your information, or to object to or restrict certain processing. For account data, contact us at hello@candilite.com. For candidate or applicant data handled for a customer, please contact that customer (the controller); we will support them in responding. If we rely on legitimate interests, you may object to that processing where applicable law provides that right. You may also complain to the data protection authority where you live or work. We will not discriminate against you for exercising your rights.

The Service is operated from the United States, and our providers may store and process data in the United States. If you access the Service from outside the United States, your information may be processed in the United States. Privacy protections may differ from those in your country. Contact hello@candilite.com before uploading personal data if your organization requires a data processing agreement, a particular hosting location or information about applicable international-transfer safeguards. We will review those requirements with you; this policy does not promise regional hosting or certify compliance with a particular regulatory regime.

The Service is not directed to children and is intended for people who are at least 18 years old (or the age of majority where they live). We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will post the updated version here and change the “Last updated” date. Where appropriate, we will communicate material changes.

Questions about this policy or your information: hello@candilite.com.