Privacy Policy

Overview#

MeritSlate Recruit ("MeritSlate Recruit", "we", "us") helps recruiting agencies rank candidate resumes against a job description, run structured AI interviews, and share results with their clients. Doing that well means processing candidate documents on behalf of our agency customers, so this policy is written to be specific about what we actually do — not boilerplate.

This policy applies to recruit.meritslate.ai and every feature of the MeritSlate Recruit product. For workspace account data we act as the data controller; for candidate documents and interview content that an agency uploads or collects, the agency is the controller and we process that data on the agency's instructions. You can reach us any time at hi@meritslate.ai.

Information we collect#

Workspace account information

• Your work email address, used to sign in with one-time codes. Authentication is handled by our infrastructure provider (Supabase Auth); sign-in codes are short-lived, stored hashed, and purged automatically.
• Workspace details you provide: agency name, timezone, and plan selection.

Billing information

• Payments are processed by Dodo Payments. We never see or store full card numbers — we keep the subscription state, plan, and billing events needed to run your workspace.

Technical information

• Server logs and error reports (via Sentry) that can include IP address, browser type, and the page or API route involved. Error reports are scrubbed of personal content before they are stored.

Candidate data#

Agencies upload candidate resumes (PDF, DOCX, or TXT) so the product can parse, rank, and summarize them. From those files we extract and store: the resume text, the candidate's name and email address where present, scores and AI-generated summaries, and the original file itself.

The agency that uploads a resume is responsible for having the right to process it (see our Terms). Candidates interact with MeritSlate Recruit only through private links issued for one interview and no other — booking a slot, or joining the interview room — and never need an account. Candidate-facing emails identify the agency, explain why the candidate is being contacted, link to the candidate privacy notice, and carry a List-Unsubscribe header so a candidate's mail client can stop them. Replies are routed back to the agency. We send candidates no marketing email of any kind — every message is about one specific application — so there is no mailing list to be added to or removed from.

Google user data (Drive import)#

A workspace can optionally import candidate resumes from Google Drive instead of uploading files by hand. This import is designed to touch the minimum possible amount of your Google data: your files are read in your browser, not on our servers, and we hold nothing from your Google account beyond the connection itself — the connected account's email address, shown in your settings so you can see which account is linked, and deleted when you disconnect.

What we access, and how

• Google Drive (scope drive.file): we use Google's file picker, which grants access only to the individual files you select — never your whole Drive. Your browser downloads the selected files and submits them to your workspace exactly as if you had uploaded them manually. Google Docs files are exported to PDF first.
• Staying signed in: so that you are not asked to approve access on every import, Google's approval is remembered — either in your browser, or, where your workspace is set up to connect Drive once, as a long-lived token we store encrypted on our servers. That token is used for exactly one thing: obtaining the short-lived access token your browser needs to open the file picker and download the files you select. Neither can reach anything you have not picked.
• Ending it: Settings → Resume sources ends it from our side at any time — forgetting the approval held in your browser, or deleting the stored token and revoking our access at Google. You can also revoke it yourself at myaccount.google.com/permissions.

What we do — and never do — with Google data

• Imported files become candidate resumes in your workspace and follow the same storage, retention, and deletion rules as any other uploaded resume. Nothing else from your Google account is retained beyond the connected account's email address described above, which is deleted when you disconnect.
• We do not sell Google user data, use it for advertising, or use it to train AI or machine-learning models.
• No humans at MeritSlate Recruit read your Google data, except where you explicitly ask us to for support, where required for security investigation or abuse prevention, or where required by law.
• We do not transfer Google user data to third parties except the infrastructure subprocessors listed below, as needed to store the files you chose to import.

AI interviews, recordings & integrity signals#

When an agency invites a candidate to an AI interview, the candidate books a slot and joins a browser-based interview room through the private link issued for it. Before the interview starts, the candidate is shown a summary of what will be collected, with the full candidate notice linked from that screen, and must consent to proceed.

• Recording & transcript. The interview audio/video and transcript are recorded and stored so the agency can review answers with evidence, and both are erased 90 days after the interview (see retention below). The live conversation is powered by a voice-agent provider (Deepgram), which also transcribes the finished recording so the scorecard is graded against audio that was actually captured rather than against whatever the candidate's browser reported. That audio is processed to produce those results; we keep no copy of it beyond the recording itself.
• Integrity signals. Signals such as focus changes, full-screen exits, paste events, and a device fingerprint — an identifier the browser derives from itself, which shows whether a session stayed on one machine — are computed on the candidate's device. Camera and microphone are analysed in the browser and are never streamed to a server for that analysis; what leaves the browser for it is a compact event log and the recording itself. Four signals are not from the device. Our server hashes the network address each batch of events arrives from, so a change of network mid-interview is visible without the address itself being stored; it samples the timing of answers as the live transcript arrives; and it marks the log itself when an interview hits its event ceiling, so a truncated log is never read as a quiet one. The fourth is made after the interview: the transcription provider that already processes the recording (Deepgram) also notes whether more than one voice is present in it — a signal derived from the uploaded recording the candidate consented to, by that third party, not from any live stream. Camera-based checks rely on a face-detection capability that many browsers do not provide; where it is unavailable, no camera analysis runs and the interview record states that rather than implying a clean result. Results are presented as neutral signals for a human reviewer, never as accusations.
• Whiteboards and other workspace tools. Some interview formats give the candidate a surface to work on beside the conversation — a code editor, a spreadsheet, a document, a whiteboard. What they type there is sent to the interviewer as they work and saved with the interview. The whiteboard is the one they draw rather than type on, so the room instead sends periodic snapshots of it to an AI model, which describes back in a sentence or two what is on it — that is how a voice interviewer responds to a sketch. The snapshot itself is not stored; the description is what reaches the interview. All of this is the work product the candidate is producing for the interviewer, visible to them on screen as they make it: it is not camera video, and it plays no part in the integrity analysis above.

AI processing#

Ranking, summaries, and interview scorecards are produced by large language models accessed through OpenRouter; live interviews run on Deepgram's voice agent. In both cases content is sent to the provider only to produce your result. Our agreements with the providers we send content to do not permit training on it, and every request we make carries that instruction. The reasoning model inside a live interview is the one exception we cannot pin ourselves: Deepgram reaches it on its own account, so there the restriction is carried by Deepgram's agreement with its model supplier. We never use customer or candidate content to train models ourselves.

Service providers#

We use a small set of infrastructure providers to run the product. Each processes data only to provide their service to us:

Storage, security & retention#

• All traffic is encrypted in transit (TLS) and stored encrypted at rest by our infrastructure providers.
• Every workspace's data is isolated with database row-level security. A candidate-facing link carries a random token minted for one interview and no other; the database stores its SHA-256, and that hash is what an incoming request is checked against. The token itself is also kept, encrypted (AES-256-GCM), for one reason: reminder and re-invite emails have to rebuild the same link days after the invite went out, and a hash cannot be turned back into a URL. The key that decrypts it lives in our server environment and never in the database — so a copy of the database, a stolen backup included, yields no working link.
• Candidate data expires on a fixed schedule, not whenever the workspace decides it is finished with it. A resume and the text extracted from it are erased 90 days after upload; an interview's recording, its transcript, the verbatim quotes stored on its scorecard, and the work the candidate typed in its on-screen tools are erased 90 days after the interview completes. A scheduled sweep does both — nobody has to remember to run it — and a candidate can trigger the interview side of it immediately, from the page they booked on, instead of waiting out the window.
• What survives that erasure is the derived judgement, never the source material: fit scores, matched skills, flags, the hire signal, and the rationales written about the candidate — the agency's record of a screening decision it may have to account for. The document, the video, and the candidate's own words are gone.
• Deleting a job deletes its candidates, resumes, interviews, and recordings; deleting a workspace deletes everything it contains. A separate daily pass removes stored files whose database record has already gone, after a holding period of about a week that protects files whose record is still being written.
• Backups are the one carve-out on all of that. Our database provider's plan takes no automated backups, so we run our own: every night the database rows — candidate records among them — are dumped to a private Cloudflare bucket, and each dump is deleted 30 days later. Resume files and interview recordings are not in it; rows are. So a deletion is immediate in the live database and in file storage, but rows deleted today can still sit inside a backup taken before it until that backup ages out, which is within 30 days. (We always keep the seven most recent dumps whatever their age, so a run of failed backups cannot leave us with none.) Server logs age out on our providers' standard schedules.

Your rights & controls#

Depending on where you live, you may have rights to access, correct, export, restrict, or delete personal data.

• Agencies: you can export ranked results in-app (CSV/PDF) and request a full export or deletion of your workspace at hi@meritslate.ai. Deletions cascade through candidates, resumes, interviews, and recordings in the live system; the nightly backups described above age out on their own 30-day schedule.
• Candidates: if an agency has processed your data through MeritSlate Recruit, contact the agency that engaged with you — they control the data — or write to us and we will assist, including deleting data where the law requires us to.

Cookies#

• Essential session cookies. Signing in sets authentication cookies that keep your session alive, and we set cookies that protect the service. The product cannot work without them.
• Analytics on the public pages — only if you allow it. Google Analytics 4 loads on our public marketing pages (this one included), and it would set a first-party cookie that recognizes your browser across visits. That does not happen until you choose "Allow analytics" on the panel we show you. Before that — and permanently, if you decline — it runs with storage consent denied: no cookie, no identifier, only an anonymous count of the page view. We remember your answer in your browser's local storage so we don't ask again, and you can change it any time from Cookie choices in the footer. It never loads inside a workspace, on an interview page, or on any page a candidate uses.
• No advertising cookies. We set no advertising cookies, run no ad networks, and share nothing for cross-site tracking or behavioral advertising.

Every cookie this service sets is listed below. Nothing outside this table is placed on your device by us.

Your answer to the cookie panel is kept in your browser's local storage, not in a cookie — declining should not itself require putting something on your device. We store the choice, the date you made it, and which version of this policy you were answering; if we ever change what we ask for, that record expires and we ask again rather than relying on an old answer.

Children#

MeritSlate Recruit is a professional tool for businesses and is not directed at children. We do not knowingly process data of anyone under 16; if you believe we hold such data, contact us and we will delete it.

International users#

Our infrastructure is hosted in the United States. If you use the service from elsewhere, your data is transferred to and processed in the United States under our providers' standard safeguards. Where regional laws such as the GDPR apply, we support our agency customers in meeting their obligations as controllers.

Changes to this policy#

When we change this policy we update the date at the top; for material changes we notify workspace owners by email before the change takes effect. Continued use after the effective date means the updated policy applies.

Contact#

Questions, export requests, or deletion requests: hi@meritslate.ai. We respond to privacy requests within 30 days.