Privacy Policy

Welcome to Cohesyve!

Cohesyve is a hiring platform. Employers use it to find candidates, reach out to them, screen résumés and assess candidates with AI job simulations. Job seekers use it to practise for interviews and build a profile of their skills. We are committed to protecting the privacy of everyone whose data passes through the Platform: the hiring teams who use it, the candidates they assess, and the visitors to our website.

This Privacy Policy is meant to help you understand what personal data we collect, why we collect it, and what we do with it.

This Policy is issued by Cohesyve, Inc and its affiliate Cohesyve Intelligence Private Limited (together, "Company"; "We"; "Our"; "Cohesyve").

The Company owns, operates and manages the website www.cohesyve.com ("Website") and the Cohesyve web application at app.cohesyve.com ("App") under the brand 'Cohesyve' (collectively referred to as the 'Platform').

The Cohesyve browser extension has its own Extension Privacy Policy.

This Policy sets out the following:

• What data we collect and what we do with it
• How we access, use, store and share data from your Google Account
• How AI is used in assessments
• Who we share data with and how we protect it
• What data protection rights you have and how you can exercise your rights

1. Definitions

2. Our Role

When a Customer uses Cohesyve to hire, the Customer decides which Candidates to assess, what to ask them and how to use the results. For that Candidate data, Cohesyve processes personal data on behalf of the Customer and under its instructions. If you are applying to a company that uses Cohesyve, that company's own privacy policy also applies, and you can direct requests about your data to them or to us.

For Customer account information, for people who use our candidate product directly, and for visitors to our Website, Cohesyve decides how the data is used and is responsible for it.

3. Information We Collect

From Customers

• Account details: your name, work email address, phone number, company details and password, or your Google Account details if you sign in with Google.
• Hiring information: the roles and job descriptions you create, the candidates you add, and your notes, ratings and hiring decisions.
• Messages: emails, WhatsApp and SMS messages you send to candidates through the App, and the connected mailbox they are sent from (see Section 4).
• Billing details: your plan, invoices and payment information, which is processed by our payment provider (see Section 9).

From Candidates

• Contact and profile details: your name, email address, phone number, location, résumé, work history, and any links you share, such as a LinkedIn profile or portfolio.
• Application and assessment data: your answers to screening questions, your written, spoken and coding answers in assessments, and the scores, recommendations and reports produced from them.
• Proctoring data, when the hiring team turns proctoring on: photos taken during the assessment, a recording of your screen and microphone, and information about your browser and device activity during the session, such as your IP address. Depending on the hiring team's settings, this can also include identity checks, such as a photo of an ID document. You are told what is captured before a proctored assessment starts.
• Communications: emails, WhatsApp and SMS messages exchanged with you, and recordings and transcripts of phone calls with Cohesyve's AI voice agent. Calls with the AI voice agent are recorded.
• Candidate product data, if you sign up to practise with Cohesyve: your account details, the practice assessments you take, your reports, skills profile and learning pathways, and your subscription and payment details.

About Professionals Found Through Sourcing

When a Customer asks Cohesyve to find candidates for a role, we search publicly available sources through our data providers and collect information about professionals who may be a fit: name, current and past roles and employers, skills, location, and professional contact details. We use this information only so that the Customer can consider you for that role and contact you about it. You can opt out of further contact, or ask us to delete your data, at any time by emailing privacy@cohesyve.com.

Integrated Data

If a Customer connects an applicant tracking system or HR system, such as Greenhouse, Lever, Workday or BambooHR, we import the jobs, candidates and hiring records held in that system through an integration provider ("Integrated Data"), with the Customer's authorisation. Integrated Data is used only to provide the Services to that Customer.

Information from Your Google Account

If you sign in with Google or connect a Gmail or Google Workspace mailbox to the App, we receive limited data from your Google Account. Section 4 explains exactly what we access and how we handle it.

From Website Visitors

When you book a demo, subscribe to our newsletter or contact us, we collect the details you give us, such as your name, work email address and company.

Automatically Collected Information

We may collect and store certain information automatically when you use the Platform, including but not limited to, your IP address, device and browser details, the pages you visit and how you interact with them (see Section 10).

4. Google User Data

This section explains how the Cohesyve App accesses, uses, stores and shares data from your Google Account ("Google user data"). It applies when you sign in with Google or connect a Gmail or Google Workspace mailbox to Cohesyve. Where this section differs from anything else in this Policy, this section governs Google user data.

What Google user data we access

We access only the Google user data covered by the permissions you approve on Google's consent screen:

• Your name and primary email address (the openid, userinfo.email and userinfo.profile permissions), along with the account identifier Google provides at sign-in. We use these to sign you in and, when you connect a mailbox, to confirm which email address Cohesyve will send from.
• Permission to send email on your behalf (the gmail.send permission). When you connect your mailbox, Google gives us access and refresh tokens that let the App send email from your address.

How we use Google user data

• To sign you in to Cohesyve and keep your account secure.
• To send the emails you write or set up in Cohesyve from your own mailbox, such as messages to candidates in your hiring funnel, follow-ups in a sequence you have scheduled, and replies in a conversation with a candidate.
• To send one test email when you connect a mailbox, so you can confirm the connection works.
• To show you which mailbox is connected and tell you when it needs to be reconnected.

Emails sent this way may carry a reply-to address operated by Cohesyve, so that candidate replies appear in your Cohesyve account. We do this so that we never need access to read your inbox.

We use Google user data only to provide and improve these user-facing features. We do not use it:

• for advertising of any kind, including targeted, personalised, retargeted or interest-based advertising;
• to sell to data brokers or provide to information resellers;
• to determine credit-worthiness or for lending purposes;
• to create databases unrelated to your use of Cohesyve; or
• to develop, improve or train generalised or non-personalised artificial intelligence (AI) or machine learning (ML) models.

Google Workspace APIs, including the Gmail API, are not used to develop, improve or train non-personalised AI and/or ML models.

How we share Google user data

We do not sell Google user data, and we do not transfer or disclose it to third parties for purposes other than those described in this section. We share it only:

• With Google, when the App uses the Gmail API to send an email you have asked Cohesyve to send. That email is delivered to the recipients you chose.
• With Google Cloud, which hosts our servers and database in the United States, solely to store and process the data on our behalf.
• With members of your organisation's Cohesyve account, who may see the connected email address and the emails sent from it as part of your shared hiring workflow.
• When required to comply with applicable law, or as part of a merger, acquisition or sale of assets, and in that case only with your explicit prior consent.

How we protect Google user data

• Google access and refresh tokens are encrypted at rest, using a dedicated encryption key kept separate from our other application secrets.
• Data travels between your browser, our servers and Google only over encrypted HTTPS (TLS) connections.
• The sending address is always confirmed with Google rather than typed in, so a mailbox can only be connected by the person who owns it.
• Our servers and database run on Google Cloud in the United States, and access to production systems is limited to the people who need it to operate the Platform.

How long we keep Google user data, and how to delete it

• We keep your Google access and refresh tokens only while your mailbox is connected. When you disconnect the mailbox in Cohesyve, the stored tokens are deleted immediately.
• We keep your name and email address for as long as your Cohesyve account is active.
• We keep a record of each email sent through your mailbox (such as the recipient, subject, message and time sent) as part of your hiring workflow, for as long as your account is active.
• You can revoke Cohesyve's access at any time from your Google Account at myaccount.google.com/permissions. Once access is revoked, Cohesyve can no longer send email from your mailbox.
• You can ask us to delete your Google user data, including the records of emails sent, by emailing privacy@cohesyve.com. We will delete it, unless the law requires us to keep it, and confirm to you when it is done.

Limited Use

Cohesyve's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

No person at Cohesyve reads your Google user data unless you ask us to (for example, for support), it is necessary for security purposes such as investigating abuse, or the law requires it.

Changes to how we use Google user data

If we change how the App uses Google user data, we will update this section and notify you before the change takes effect, and ask for your consent again where required.

5. How We Use Information

• To provide the Services: creating and managing accounts, publishing roles, finding and contacting candidates, screening résumés, running and scoring assessments, running proctoring, placing AI pre-screen calls, and producing reports for the hiring team.
• To run our candidate product: practice assessments, reports, skills profiles and learning pathways.
• To send invitations, reminders and notifications about applications and accounts by email, WhatsApp or SMS, and to respond to your questions.
• If you agree when you start an assessment, to contact you about other roles in your field.
• To send newsletters and product updates you have signed up for. You can unsubscribe at any time.
• To bill for the Services.
• To keep the Platform and assessments secure, including detecting fraud, cheating and abuse.
• To understand how the Platform is used, fix problems and improve our features.
• To comply with our legal obligations.

We do not sell, trade or rent personal data to any third party.

6. Use of AI in Assessments

Cohesyve uses AI to help hiring teams assess candidates. AI evaluates answers against criteria set for the role and produces scores and recommendations that the hiring team can review. The hiring team makes every hiring decision.

Some steps can be automatic, such as screening rules and pass-or-fail questions that the hiring team sets. If you are a Candidate and want a person to review an outcome, contact the company you applied to, or email us and we will pass your request on.

7. Sensitive Data

We do not ask for personal data revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or for genetic data, data concerning health, or data concerning your sex life or sexual orientation.

The one exception is identity checks. When a hiring team turns on proctoring, Cohesyve may compare a Candidate's photos, and an ID photo if the hiring team requires one, to confirm that the same person is taking the assessment. The face templates computed for these checks are not stored.

8. Sharing of Data with Third Parties

We will share personal data with third parties only in the ways described in this Policy.

With the company you apply to

If you are a Candidate, your application, résumé, assessment answers, scores, reports, proctoring results and call recordings are shared with the Customer you applied to or were sourced for, and with the members of its hiring team.

With our service providers

We use service providers in the following categories to run the Platform. Each processes personal data only to provide its service to us:

• Cloud hosting and storage providers
• AI model providers, which help generate assessment content, evaluate answers, read résumés and power voice conversations
• Data providers that help find candidates for sourcing
• Email, messaging and calling providers, which deliver emails, WhatsApp messages, SMS and phone calls
• Integration providers that connect the applicant tracking and HR systems Customers choose to link
• Payment processors
• Analytics providers that measure how the Website and App are used
• Scheduling tools for demos booked on the Website

A list of our current service providers is available on request at privacy@cohesyve.com.

Outreach emails are sent from the Customer's own mailbox, through Google or Microsoft, so the email provider of that mailbox also handles them.

For legal reasons and business transfers

We may disclose personal data when required by law or to protect the rights, property or safety of Cohesyve, our Users or others. If Cohesyve is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, and Google user data only as described in Section 4.

9. Third Party Payment Services

Payments for the Services, including subscriptions to our candidate product, are processed by a third-party payment processor. Your card details are handled by the payment processor under its own privacy policy, and the Company is not liable for any data stored, used or accessed by it.

10. Cookies and Analytics

We use cookies to keep you signed in, remember your preferences and understand how the Platform is used. We and our analytics providers use cookies and similar technologies on the Website and the App to measure visits and see how pages are used, such as where people click and how far they scroll. You can disable cookies and reset the browser whenever you want through your browser settings, although you may need cookies to sign in to the App.

11. International Data Transfers

Cohesyve operates from the United States and India. Our servers and database are hosted in the United States, and some processing by our service providers, including AI providers, can take place in other countries. Wherever your data is processed, we protect it as described in this Policy and as required by applicable law.

12. Data Security

• Data travels between your browser and our servers over encrypted HTTPS (TLS) connections.
• Data we store is encrypted at rest.
• Credentials for connected mailboxes are encrypted again, with a dedicated key kept separate from our other application secrets.
• Access to production systems is limited to the people who need it to operate the Platform.

No method of transmission or storage is completely secure, but we work to protect personal data using measures appropriate to its sensitivity.

13. Data Retention and Deletion

We keep personal data for as long as needed to fulfil the purposes outlined in this Policy, unless a longer retention period is required or permitted by law. In particular:

• Customer account data is kept while the account is active.
• Candidate data collected for a Customer is kept for as long as that Customer needs it for hiring. Customers can delete a candidate's résumé and assessment results from their account.
• Candidate product data is kept while your account is active.
• Face templates computed for identity checks are never stored.
• Google user data is kept as described in Section 4.

When data is no longer needed, we delete it. You can ask us to delete your personal data at any time by emailing privacy@cohesyve.com.

14. User Rights

You may contact us at any time to exercise any of the following rights:

• Right to withdraw consent: You shall have the right to withdraw your consent at any time.
• Right to access: You have the right to obtain confirmation as to whether personal data concerning you is being processed.
• Right to rectification: You shall have the right to rectify any inaccurate data.
• Right to erasure: You can contact us to delete or erase any personal data concerning you.
• Right to restrict processing: You can contact us to restrict the processing of certain data.
• Right to data portability: You can contact us to receive your data in a commonly used and machine-readable format.
• Right to object: If you do not agree with the processing of your personal data, you can contact us to discontinue the same.
• Right to lodge a complaint: You may lodge a complaint with the Company if you feel that the processing of the data infringes your rights.

If your data was collected by a company you applied to, we may refer your request to that company, since it decides how your application data is used, and we will help it respond.

15. Data Breach

In case of any data breach of personal data, we will inform relevant authorities within 72 hours about the same. Further, we shall inform you about the same without any undue delay, as may be required.

16. Policy for Children

We do not collect personal information of children under 16 years of age. If knowingly or unknowingly, some child under the age of 16 has given us personal data, we will get in touch with parent for consent or delete the said personal data. Please email us at privacy@cohesyve.com.

17. External Links

The Platform may include advertisements or external links to third party websites, applications, content or resources which are not owned/controlled by the Company. We have no control over such external links and suggest that you review the privacy policy prior to accessing such third party external links.

18. Revision of Policy

We reserve the right to revise this Policy as and when needed. When we make material changes, we will update the "Last Updated" date above and, where appropriate, notify you by email or in the App. If you have any queries, you may contact us at privacy@cohesyve.com.

19. Data Protection Officer

If you have any questions or comments regarding this Policy, or if you wish to exercise your individual rights, please contact us:

Email: privacy@cohesyve.com

To report a security issue, email founders@cohesyve.com.