Privacy Policy

• Candidates are called by our AI assistant, Maya, only after they agree on the apply form. Every call says it is an AI and that it is recorded.
• A candidate’s application, recording, transcript and score go only to the company whose job they applied to.
• Scores are produced by AI. Depending on the company’s settings, a candidate below the bar may get an automatic “not moving forward” email. Any candidate can ask for a person to review their result (section 5).
• We do not sell personal data, we do not use it for advertising, and we do not use it to train AI models.
• There are no tracking cookies on job, apply or call pages.

For candidate data, the hiring company that posted the job decides why and how it is used. Under the GDPR and UK GDPR it is the “controller”, under India’s Digital Personal Data Protection Act 2023 (DPDP Act) the “data fiduciary”, and under US state privacy laws the “business”. AgentLink processes candidate data on the company’s behalf as its “processor” or “service provider”. We may pass your request to that company, or ask you to contact it directly.

For manager accounts, Book a demo requests and website visits, AgentLink is the controller (data fiduciary) of that data.

Managers and their teams. Name, email, company name, time zone, password (stored only as a one-way hash), team members’ names and emails, scheduling settings, and ratings of meetings held. If you connect Google Calendar, we read free and busy times and create, change or cancel the meetings AgentLink books (see section 8). We do not collect payment card details.

Jobs. Job posts, PDFs or notes you give us, and each job’s questions, pass bar and settings.

Candidates. Answers to the job’s must-have questions; name, mobile number and email; resume or short written answers; who referred you, if you say; your consent choices; and basic details of the device used to apply.

Screening calls. The audio recording and transcript of the AI call (in the browser or by phone), call attempts and times, and a score and notes for each answer. We do not use recordings to identify you by your voice, and we do not create voiceprints or any other biometric identifiers.

Meetings. The time booked, reschedules, cancellations, whether the meeting happened, and the manager’s rating of it.

Book a demo. The name, work email, company, phone number, team size and message you send us.

Technical data. IP address, browser and device details, pages visited and server logs, used to run and secure the service, and cookies as described in section 10.

We do not ask for sensitive information such as health, race, religion, sexual orientation, immigration status or government ID numbers. Please do not include it in resumes or answers.

• Running each job: showing the apply form, holding and scoring the screening call, offering times and booking meetings, and sending emails about the process (call links, confirmations, reminders and results). Basis: providing the service to the hiring company, and the candidate’s consent to the AI call.
• Running manager accounts, including sign-in, support and usage-based billing. Basis: our contract with you.
• Security and abuse prevention: rate limits, fraud checks and logs. Basis: our legitimate interest in a safe service, and legal obligations.
• Improving the product using totals and patterns with no personal details (for example, how many candidates finish the call). Basis: legitimate interest.
• Replying to Book a demo requests. Basis: your request and our legitimate interest.
• Website analytics on our marketing pages. Basis: your consent where the law requires it (section 10).

Where we rely on consent, under the DPDP Act and the GDPR, you can withdraw it at any time by emailing [email protected]. Withdrawing consent does not affect what happened before, but we cannot screen an application without the AI call.

Consent first. No AI call happens until the candidate agrees on the apply form. On browser jobs the candidate starts the call. On phone jobs Maya calls only the number the candidate entered, between 9am and 8pm Monday to Saturday in their time zone, retries a missed call once, and then sends the browser link by email. Saying you want to stop, or emailing us, stops further calls.

Disclosure and recording. Every call opens by saying the caller is an AI assistant and that the call is recorded. If you do not want to be recorded, do not start or continue the call; ask the hiring company for another way to be considered.

How scoring works. An AI model scores each answer from 0 to 10 against what the hiring company said a good answer sounds like. The overall score is compared with the job’s pass bar. Scores use only your answers on the call and your application, never your voice, accent or any protected characteristic. Must-have questions (for example, whether you are comfortable with commission-only pay) are set by the hiring company.

Automated decisions. Candidates at or above the bar are offered a meeting or passed to the manager for review. Depending on the company’s settings, candidates below the bar, or who answer “no” to a must-have question, may receive an automatic “not moving forward” email without a person reviewing it first. The hiring company makes all hiring decisions.

Your rights here. You can ask (1) for the main reasons for your result, (2) for a person at the hiring company to review it, (3) to correct information you gave, and (4) for an accommodation or another way to be considered, for example if a disability makes a voice call hard. Email [email protected] with the job and the email you applied with; we pass it to the hiring company and help it respond. These choices reflect the GDPR and UK GDPR (Article 22), US state rules on automated decision tools in hiring (such as Colorado, Illinois, California and New York City), and disability law. The hiring company is responsible for any notices and bias audits those laws require of employers.

The hiring company whose job you applied to: its managers and team members see your application, recording, transcript, scores and meetings. We never show your details to another company.

Service providers that process data for us under contracts requiring confidentiality and security:

• Retell AI: voice calls, recordings and transcripts.
• OpenAI: reading job posts and resumes, and scoring calls.
• Resend: email delivery.
• Dodo Payments: card payments for hiring companies, as our merchant of record. We never see or store full card numbers.
• Google: Calendar and Meet for booked meetings, and Google Analytics on marketing pages (with consent where required).
• Supabase: database and file storage.
• Render and Vercel: hosting. Vercel Analytics counts page views without cookies.
• Apollo.io: identifies which companies visit our marketing pages (with consent where required, never on candidate pages).

Legal and safety reasons: when the law requires it, or to protect rights, safety or the service. Business changes: if AgentLink is merged or sold, data may move to the new owner under this policy.

We do not sell personal data. The only possible “sharing” for analytics under US state law is the Google Analytics and Apollo tags on our marketing pages, which you can turn off with “Cookie settings” in the footer or by sending a Global Privacy Control signal.

We and our providers store and process data in the United States and other countries, which may not have the same data protection laws as yours. For personal data from the EU, UK or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (with the UK addendum) or another lawful transfer mechanism. Transfers out of India follow the DPDP Act and any restrictions the Indian government sets.

When a manager or team member connects Google Calendar, AgentLink uses Google data only to show available times and to create, update or cancel the meetings it books, with a Google Meet link. We do not use Google data for advertising, do not sell it, do not let people read it except with your permission, for security or where the law requires it, and do not use it to train AI models. AgentLink’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. You can disconnect at any time in Settings or in your Google account.

• Candidate applications, recordings, transcripts, scores and meetings: while the job is open and for 12 months after it closes. A hiring company can ask us to delete them sooner.
• Manager accounts: while the account is open, and deleted within 30 days of closing it, apart from billing records we must keep by law.
• Book a demo requests: up to 2 years after our last contact.
• Security logs: up to 12 months.

We may keep data longer when the law requires it, for example employment record-keeping rules that apply to the hiring company, or to resolve a dispute. Totals with no personal details may be kept longer.

Job, apply and call pages use no tracking cookies; they keep only what the page needs to work, such as your progress through the form in your browser. Signed-in managers’ sessions are kept in the browser’s local storage.

On our marketing pages we use Google Analytics and the Apollo.io tracker to understand visits, and Vercel Analytics, which uses no cookies. Visitors in the EU and UK see a banner, and Google Analytics and Apollo load only if they accept. Everyone can change their choice with “Cookie settings” in the site footer, and we treat a Global Privacy Control signal as a refusal.

Everyone can ask to access, correct or delete their personal data, or to stop calls and emails. Email [email protected] with the subject “Privacy request” and the email you used. We may need to confirm it is you. We reply within 30 days, and sooner where the law requires it. We will not treat you differently for using your rights.

US residents (including California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws) can also ask what categories and specific pieces of personal data we hold and why, ask us to delete or correct it, opt out of the sale or sharing of personal data, targeted advertising and profiling with significant effects, and limit the use of sensitive data. An authorized agent may make a request for you. If we turn down a request you can appeal by replying to our answer, and if your appeal is refused you can contact your state attorney general. In the last 12 months we collected the categories in section 3 from the sources described there (you, the hiring company, and your device), for the purposes in section 4, and disclosed them only as described in section 6.

India. Under the DPDP Act you can ask for a summary of your data and how it is processed, have it corrected, completed, updated or erased, withdraw consent, nominate someone to act for you if you die or become unable to, and raise a grievance with our Grievance Officer at [email protected]. We will respond within the time the DPDP Act and its rules set. If you are not satisfied, you may complain to the Data Protection Board of India.

EU and UK. You can also ask us to restrict processing, receive your data in a portable format, and object to processing based on legitimate interests. You have the right not to be subject to a decision based solely on automated processing that significantly affects you (see section 5). You can complain to your local data protection authority or, in the UK, the Information Commissioner’s Office.

Data is encrypted in transit (HTTPS) and at rest. Each company can see only its own jobs and candidates, private call links are long and random, and passwords and keys are never stored in plain text. No system is perfectly secure; if a breach affects your personal data, we will tell the hiring company, you and the regulators where the law requires it. See our Security page.

AgentLink is for people 18 and older. We do not knowingly collect data from anyone under 18. If you believe a minor has applied, email [email protected] and we will delete it.

We may update this policy as the product or the law changes. We will email account holders about important changes, and the date at the top always shows the latest version.

Privacy questions, requests and grievances: Grievance Officer, AgentLink, [email protected].