Privacy Policy

AutoMindz Solutions LLC ("AutoMindz", "hyreflow", "we", "us") operates hyreflow.ai and the hyreflow recruitment-automation platform. AutoMindz Solutions LLC is registered in Dubai, United Arab Emirates. This policy explains what we collect, why, and the choices you have.

1. How we handle your recruiting data

hyreflow is infrastructure your agent calls, not a data warehouse. Candidate, company, and contact records you source or enrich through the platform are scoped to your workspace, processed to complete the call you made, and are not read, inspected, or repurposed by us. We do not sell recruiting data, candidate data, or customer records to third parties, ever.

2. Information we collect from the website and product

When you sign up, book a demo, or contact us, we collect what you give us directly: name, email, company, and any message content. When you use the CLI, SDK, or dashboard, we collect account and workspace metadata needed to operate the service: API key usage, credit balance and spend, session identifiers, and tool-call records (which tool ran, which provider served it, cost, timestamp) for billing, support, and abuse prevention.

3. Cookies and analytics

The dashboard uses essential cookies (session auth), plus the product analytics cookie described below only if you choose “Accept All”. The public marketing pages additionally load the Meta Pixel, but only if you choose “Accept All” in the cookie banner. It sets a cookie and reports the pages you view, and which call-to-action buttons you click (the button’s label, the section it sits in, and where it links to), to Meta Platforms so we can measure and improve our advertising; Meta’s use of that data is governed by its own privacy policy. Dismissing the banner keeps it off, and it is never loaded in the signed-in product.

If you accepted the Meta Pixel and then create an account, our servers report that one sign-up to Meta so the ad that brought you here can be credited. That report carries a one-way hash of your email address together with the pixel’s own cookie values, your IP address and browser type; it never includes your name in clear text, your password, or anything you do inside the product. Without the pixel cookie in your browser, no sign-up is reported.

The same “Accept All” choice also switches on Google Analytics on the public marketing and documentation pages. It sets cookies and reports the pages you view, the site that referred you, and your approximate location and device type to Google, so we can see how visitors find and use the site; Google’s use of that data is governed by its own privacy policy. Dismissing the banner keeps it off, and it is never loaded in the signed-in product.

When you arrive through a link tagged with a campaign source (a utm_sourceparameter, e.g. from a LinkedIn post), or open a shortlist page we sent you, we store that source name — and, if the link names them, the team member who shared it and the campaign (for a shortlist page, that page’s link name) — in first-party cookies for 30 days. If you then create an account, we read them once so our team can see which channel (and whose post or page) the sign-up came from. If you have accepted cookies, those values (source, team member and campaign) are also recorded with your sign-up in PostHog, as described below; otherwise it is never sent to a third party.

The docs assistant — the chat button on our documentation and marketing pages — keeps your conversation in your browser’s session storage so it survives a page reload, and clears it when you close the tab or after 24 hours, whichever comes first. That is storage on your own device, not a cookie and not a tracker: it is never sent to a third party and never used to recognise you elsewhere. The questions themselves are answered by software we run on our own infrastructure, using only our public documentation as source material; they are not used to train anything.

Whatever you choose in the banner, we also count visits to our public marketing pages using analytics software we host ourselves, on our own infrastructure. It sets no cookies and does not follow you across other websites. It records only aggregate page-level data — the page viewed, the referring site, and a country and device type derived from your connection — and it never stores your IP address or builds a profile of you.

We also use PostHog, an analytics service hosted in the EU, on our marketing pages and in the signed-in product, to see which pages and features are used. Unlike the counter above, PostHog receives your IP address, which it uses to derive your approximate location. It records the pages you view, the links and buttons you click (inside the product, without their text), how far you scroll, page load performance, the referring site, and your browser and device type. Until you choose “Accept All” it sets no cookie and stores nothing in your browser, so it cannot recognise you from one visit to the next. If you accept, it keeps an identifier in a cookie and local storage so your visits can be linked; choosing “Reject” later deletes it. Accepting also turns on session recording: a replay of the pages you see and what you do on them (mouse movement, clicks, scrolling, page changes and page load timing), which we watch to find what is confusing or broken. Anything you type into a form is hidden from the recording, and the addresses of the pages you visit are recorded without their search or sign-in details. Inside the product all text on the page, link addresses and images are hidden too, so the candidate and contact details you work with are not recorded. Recordings are kept for 30 days. Choosing “Reject” stops new recording; recordings already made are kept until those 30 days run out. While you are signed in, what you do in the product is linked to your account, and PostHog holds your account ID, email address and name. Our servers also send it a record of certain actions you take (signing in, connecting a provider key, submitting feedback, starting a checkout or changing a subscription) and of errors you run into. When you book a call with us, we also record that a call was booked and which kind, without your name or email address. PostHog processes this data on our behalf. Analytics data is never sold or used for advertising.

Your cookie choice applies across hyreflow.ai and recruit.hyreflow.ai, so you are only asked once. We keep it in a small cookie that shares your choice between the two sites. Before you choose, the page you came from and any campaign tags in the link are recorded with that anonymous page view, but nothing is kept in your browser and it is not linked to you. If you accept, the campaign and site that brought you to us are kept and linked to your account. Once you sign in, having accepted, your visits to hyreflow.ai in the same browser are linked to your account until you sign out. If you are signed in and have accepted, you may see a short, optional survey inside the signed-in dashboard. You can ignore it.

4. Product telemetry is on by default

Session-level telemetry used for support and debugging is enabled by default for CLI and agent runs, and the CLI tells you so at install time. It records run traces, including tool inputs and outputs, the provider, timing and outcome, and the request your agent supplies with a run: the ask you typed, sent when a session starts or alongside a tool call. We do not capture your surrounding agent conversation. Traces include workspace and user identifiers, account email, and client version when available so we can investigate your runs. Traces are stored with our observability providers, Langfuse and PostHog. We filter recognized contact fields and recognizable email addresses, profile links, and phone numbers from trace payloads. This filtering does not anonymize all free-form text.

Recording is decided in two places. Your workspace can be set to always record, never record, or to follow each installation's own preference; where it is set, it takes precedence. hyreflow telemetry on|off (or HYREFLOW_TELEMETRY=0) sets that per-installation preference, and hyreflow telemetry status reports only it, so it can print "off" while your workspace is still recording. Ask us what your workspace is set to, or to turn recording off for it.

5. How we use personal information

To provide and bill the service, respond to support requests, send product and security notices, and meet legal obligations. We do not sell your personal information to third parties.

6. Sub-processors and hosting

We use reputable cloud infrastructure and payment providers to run hyreflow and process payments. PostHog, an EU-hosted product analytics service, processes the analytics data described in section 3 on our behalf. Any vendor adapter you configure (BYOK or managed) is invoked directly to fulfil your request. Vendor credentials you provide are used only to call that vendor on your behalf and are never shared with other customers or used for purposes outside your own workflows.

7. Data retention

Account and billing records are retained for as long as your account is active and for a reasonable period after (typically up to 7 years) to meet accounting and legal obligations. Website contact-form submissions are retained up to 2 years. You can request deletion of your account data at any time, subject to what we're legally required to keep.

8. Security

Data in transit is encrypted. Access to production systems is limited to staff who need it, behind multi-factor authentication. API keys are hashed at rest; we never store vendor credentials in plaintext.

9. Your rights

Depending on where you're located, you may have rights to access, correct, export, or delete your personal information, including under the UAE's Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, for EU/UK residents, the GDPR/UK GDPR. To exercise any of these, contact us below.

10. Changes to this policy

We'll update the date at the top of this page when this policy changes, and notify active accounts by email of material changes.

11. Contact us

Questions about this policy or your data: [email protected].