AI Hiring Audit

Privacy Policy

Last updated: 2 September 2026

This policy explains what personal data AI Hiring Audit collects when you use the free audit, why we collect it, who we share it with and the rights you have over it.

1. Who we are

AI Hiring Audit (“we”, “us”, “our”) is operated by CortxAI Ltd, a company registered in the United Kingdom and the company behind the Smart Sifty assessment engine. CortxAI Ltd is the data controller for the personal data described in this policy, except for the documents you upload — see section 2.1.

Questions about this policy or about your data go to privacy@smartsifty.com.

2. Information we collect

2.1 Job descriptions and CVs you upload

The free audit works on one job description and the candidate CVs you add. Those documents may contain personal data about candidates — names, contact details, work history and education. By uploading them you confirm that you are authorised to share that data with us. You remain the controller of the candidate data in those documents; we process it on your instructions for the sole purpose of producing the assessment you asked for.

2.2 Usage data

We collect information about how the site is used: pages viewed, interactions with the audit form, timestamps, device and browser type, and IP address. This helps us keep the service available, secure and useful.

2.3 Fair-use identifiers

The free audit is limited per visitor, so we need to recognise repeat runs. We set a signed session cookie, and we derive a pseudonymous device identifier from your browser and take note of your IP address. The device identifier and the IP address are stored only as one-way hashes, and only for 48 hours, after which they are deleted automatically. We never store the raw values.

These identifiers are strictly necessary to operate the free audit and to prevent abuse. They are not used for advertising, they are not combined with the documents you upload, and refusing analytics does not switch them off.

2.4 Cookies and similar technologies

NamePurposeRetention
aihiringaudit_trial_sessionEssential. Signed session identifier that applies the free-audit fair-use limits and authorises your own audit requests.30 days
aha_consentEssential. Records your cookie choice so we do not ask again on every visit.180 days
_ga, _ga_*Analytics (Google Analytics 4). Set only with your consent where consent is required — the United Kingdom, the European Economic Area and Switzerland — and always with IP anonymisation on, Google Signals off and ad personalisation off.Up to 2 years
aha_campaign, aha_landingBrowser session storage, not cookies. Remembers the campaign parameters and the page you arrived on, subject to the same analytics consent.Cleared when the tab closes
Vercel Web AnalyticsCookieless audience statistics. No cookie is set and no persistent identifier is stored.No identifier stored

Analytics cookies are currently set by default in every region; you can reject them at any time, and rejecting removes them. You can change your choice at any time through “Cookie settings” in the footer. If your browser sends a Global Privacy Control signal and you have not made a choice on this site, we treat it as a refusal, whatever your region. A choice you make here through “Cookie settings” takes precedence over the signal.

3. How we use your information

  • To run the free audit and return the assessment to you.
  • To apply the fair-use limits and prevent abuse of the free audit.
  • To keep the service secure, available and working correctly.
  • To measure how the site is used and improve it, where you have consented or where consent is not required.
  • To respond to enquiries you send us.
  • To meet our legal obligations.

3.1 Lawful bases

Under the UK GDPR and the GDPR we need a lawful basis for each of those purposes. Ours are:

  • Running the free audit and returning the assessment — performance of a contract with you, or the steps you ask us to take before entering into one.
  • Fair-use limits, security and abuse prevention — our legitimate interests in keeping a free service available, secure and usable by everyone.
  • Analytics — your consent, where consent is required; otherwise our legitimate interest in understanding how the site is used.
  • Answering your enquiries — our legitimate interest in replying to you.
  • Legal obligations — compliance with a legal obligation we are subject to.

Where we rely on a legitimate interest you can object to that processing — see section 8.

4. AI processing

The assessment is produced by the Smart Sifty engine. We generate an independent score with the supporting evidence behind it; the comparison with your own tooling is yours to make. The output is informational: it does not by itself make a hiring decision, and you remain responsible for every decision you take about a candidate.

5. Who we share it with

We do not sell personal data. We share it with:

  • Smart Sifty — the assessment platform operated by CortxAI Ltd, which processes the job description and the CVs to produce the score. Its own policy is published at smartsifty.com/privacy-policy.
  • Google — Google Analytics 4, only where analytics is active under section 2.4.
  • Vercel — hosting of this site and the cookieless audience statistics.
  • Amazon Web Services — storage of the hashed fair-use identifiers described in section 2.3.
  • Professional advisers and authorities — where we are required to by law, a court order or a regulator.
  • A buyer or successor — if the business or its assets are transferred, with notice to you.

6. How long we keep it

  • Uploaded job descriptions, CVs and assessment results: up to 90 days after processing, then deleted.
  • Hashed fair-use identifiers: 48 hours.
  • Trial session cookie: 30 days.
  • Consent cookie: 180 days.
  • Analytics data: for the retention period configured on the Google Analytics property.

You can ask us to delete your documents earlier at any time — write to privacy@smartsifty.com.

7. Security

Smart Sifty is certified to ISO 27001 and ISO/IEC 42001 (AI Management Systems). Data is encrypted in transit, access to it is restricted to the people and systems that need it, and the fair-use identifiers are hashed before they are written anywhere. No method of transmission or storage is completely secure, so we cannot promise absolute security — we can promise the controls above.

8. Your rights under the UK GDPR and the GDPR

If you are in the United Kingdom or the European Economic Area, you have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate or incomplete data corrected.
  • Have your data erased.
  • Restrict or object to how we process it.
  • Receive your data in a portable format.
  • Withdraw a consent you gave us, at any time.

To exercise a right, email privacy@smartsifty.com. You can also complain to the Information Commissioner’s Office (ICO) in the United Kingdom, or to the supervisory authority of the country you live in.

9. US state privacy rights

We do not sell personal information and we do not share it for cross-context behavioural advertising. Where a state privacy law such as the California Consumer Privacy Act applies to you, you may have the right to know what personal information we hold, to have it deleted and to have it corrected. We honour a Global Privacy Control signal as a refusal of analytics unless you later choose otherwise through “Cookie settings”. Exercising any of these rights costs nothing and never leads to a worse service — write to privacy@smartsifty.com.

10. Australia

If you are in Australia, we handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may ask us for access or correction at privacy@smartsifty.com, and you may complain to the Office of the Australian Information Commissioner (OAIC).

11. International transfers

Where personal data is transferred outside the United Kingdom or the European Economic Area, we put appropriate safeguards in place — such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses — together with the additional measures those transfer tools require.

12. Children

The service is intended for business use by adults. It is not directed at children and we do not knowingly collect personal data from anyone under 18.

13. Changes to this policy

We may update this policy. When we do, we post the new version on this page and change the “Last updated” date at the top. Continuing to use the service after a change means you accept the updated policy.

14. Contact