Hefest Privacy Policy

EU review version 6 November 2026

Proposed revision for legal approval. Effective date to be set on publication. This version does not replace the published terms until approved and published.

Hefest Technologies Inc is the controller responsible for personal data processed through hefest.ai, quiz.hefest.ai, platform.hefest.ai and the Hefest services covered by this notice. Contact details are in section 13. This notice explains processing; reading it is not consent to every use of your data.

1 Data we process

Account and contact data: name, email, authentication information and account settings. Career data: CVs, work history, education, skills, profile links, desired roles, search country and location, salary expectations and quiz answers. Application data: selected vacancies, prepared documents, answers, approvals, submission records and related technical results.

Where you use Inbox, we process employer correspondence, attachments, drafts and replies associated with your application, including business contact information of recruiters and other correspondents. Where an application reply address is used, we process the routing information needed for that feature.

Transaction data includes the offer, amount, currency, payment status, masked payment-method information, order references, subscription dates, credit purchases and refund records. Full card numbers and card security codes are handled by the payment provider rather than stored in Hefest.

Technical data may include device and browser details, IP address, approximate location, language, timezone, session identifiers, page and feature activity, errors and referral or advertising identifiers. The use of non-essential tracking depends on the relevant choice and applicable law. Support messages, privacy requests and consent/preference records are also processed.

2 How data reaches us

We receive information you enter or upload, information generated when you use the service, payment updates from payment providers, and correspondence or technical results from application and email systems used for your selected application. If you choose a supported third-party sign-in, we receive the account information supplied through that sign-in.

We do not need you to upload unrelated sensitive information. Do not include unnecessary health, ethnic-origin, religious, trade-union or criminal-record information in your CV or messages. An employer form may ask additional questions. We identify the form and ask you to provide any necessary answer or consent; we do not treat a general profile entry as permission for every sensitive-data use.

3 Purposes and legal bases

We process account, career and application information to provide the service you request: create your account, maintain your profile, match vacancies, prepare materials, transmit applications you approve and deliver related correspondence. Where necessary for these requested functions, the GDPR basis is performance of the contract or steps at your request before entering it.

We process purchase and subscription information to perform the contract and meet accounting, tax and other legal obligations. We process essential account, security, payment and cancellation communications to administer the service, comply with law and protect users.

Security, abuse prevention, fault diagnosis and necessary service administration may rely on our legitimate interests, where those interests are not overridden by your rights, or on legal obligations. Optional analytics, session recording, advertising attribution and marketing use the consent or other lawful basis applicable to the particular activity; a contractual basis for the core service is not a blanket basis for advertising.

We keep limited records needed to handle complaints and establish, exercise or defend legal claims. Where processing requires explicit consent or another condition for special-category data, that condition must be satisfied separately; general Terms acceptance does not supply it.

4 AI and personalization

We use the information relevant to a requested feature to match vacancies, identify missing details and generate document or answer drafts. Relevant content may be supplied to AI service providers operating the feature for us. AI output may be incorrect and must be reviewed before use. We do not promise that a match score predicts an employer's decision.

Applications and employer replies are sent following your selected or approved action, rather than because a draft exists. Hefest does not make the employer's hiring decision. We do not use solely automated processing to make a decision about you producing legal or similarly significant effects within the meaning of GDPR Article 22.

The actual providers, permitted use of inputs and outputs and retention settings must be reflected in our provider information and agreements. No right to use your personal data for unrelated model training is created by accepting the Terms.

5 Employers and application systems

When you approve an application, the identified employer or hiring platform receives the application materials, answers and contact details needed for that submission. Those recipients may become independent controllers under their own notices. Review the displayed recipients and information before sending.

Where authorized account creation or email verification is needed for an application, we process the data required for that step and request the relevant user action or authorization. A hiring platform may retain information under its own rules after an application is sent. Removing your local copy in Hefest does not necessarily remove the receiving platform's copy.

For Inbox, we process correspondent data to route and display messages, provide the requested communication tools and protect the service. We do not treat a recruiter's contact details contained in your correspondence as permission for unrelated marketing.

6 Providers and other disclosures

We use providers for hosting, security, AI features, communications, authentication, payments, support and analytics. Payment providers include Solidgate and PayPal where enabled. Analytics and advertising systems used by Hefest include PostHog, Google, Meta and Microsoft/Bing where active and permitted by your choices. The Cookie Policy provides further information about tracking categories.

Providers acting on our behalf are subject to appropriate contractual instructions and safeguards. Employers, advertising platforms and some other recipients may act independently for part of their processing, under their own notices. We disclose information where legally required, reasonably necessary to defend rights, or in a lawful business transfer with applicable safeguards.

We do not add a cross-subscription to another product or disclose your data to enroll you in one merely because you purchase the Hefest subscription described in our Subscription Terms.

7 Cookies and communications

Necessary technologies support authentication, security, requested payment functions and privacy choices. Non-essential categories are governed by the consent controls described in the Cookie Policy. You can reject optional categories without losing access to core requested services and can change your choice later.

Job-digest settings and advertising/news preferences are separate from essential service messages. You can turn off digests in settings or use the unsubscribe route supplied in those emails. Marketing opt-outs do not stop essential payment, security or cancellation confirmations. We do not automatically re-enable an opt-out as a result of an unrelated purchase.

8 International transfers

Hefest is established in the United States and some providers may process data outside the EEA. For transfers subject to GDPR Chapter V, we use an applicable adequacy decision or an appropriate safeguard, such as the European Commission's Standard Contractual Clauses, together with required supplementary measures where relevant. You can request information about the safeguard applicable to a transfer and how to obtain a copy by contacting [email protected].

This notice does not assert that every provider is in the EU or that every US recipient is certified under an adequacy framework. The applicable mechanism must match the recipient and processing in question.

9 Retention

We retain information only as long as needed for its purpose and applicable obligations. Account, CV, profile, application and Inbox data are generally kept while you maintain the account or the relevant item, subject to deletion controls and limited lawful exceptions.

Payment, tax and accounting records may need to be retained after account closure for the legally required period. Complaint, support and privacy-request records are retained to complete the request and demonstrate compliance or defend legal claims. Technical logs, recordings and analytics data follow their actual configured and justified retention periods, rather than an indefinite retention rule.

Consent and suppression records may be kept to honor your choice and demonstrate compliance. Deleted information may remain in protected backups until the scheduled overwrite, with access restricted to recovery and legal purposes. We provide applicable retention periods or criteria on request and in the provider/retention information maintained for the service.

10 Your rights

Where applicable, you may request access, correction, erasure, restriction, portability and information about processing; object to processing based on legitimate interests; withdraw consent; and complain to a competent supervisory authority, including in your country of residence, work or the alleged infringement.

You may object to direct marketing at any time. Withdrawing consent affects future processing and does not make earlier lawful processing unlawful. To make a request, contact [email protected]. We request only proportionate verification information where necessary.

For GDPR requests, we respond without undue delay and normally within one month. If a lawful extension is needed because of complexity or the number of requests, we notify you within that month with the reason; the extension may be up to two further months. If we cannot grant a request, we explain the applicable reason and complaint rights.

Some records may be retained despite an erasure request because of legal obligations or legal claims. We communicate applicable limits instead of treating them as a blanket reason to retain your complete profile.

11 Account deletion and security

You can use available account controls or contact support to request deletion. Before completing deletion, we clearly identify any active subscription and the cancellation route. A request for erasure does not authorize us to ignore an explicit cancellation or withdrawal request made at the same time.

We use appropriate technical and organizational safeguards and restrict access to people and providers who need it. No service can promise absolute security. Where a personal-data breach triggers notification duties, we notify the competent authority and affected people as required.

12 Children and updates

Hefest is not directed at children under 16. If applicable law requires a higher age or authorization, that requirement applies. Contact us if you believe a child provided information contrary to these requirements.

We update this notice when processing or legal requirements change and provide required notices or obtain required consent before a relevant new use. The effective date is set when the approved version is published.

13 Contact

Hefest Technologies Inc

40 W 2nd St, 2nd Floor, Office 202

Dayton, OH 45402, United States

Email: [email protected]

Phone: +1 (833) 991-9098