Hire Match AI - Terms of Service

 

Effective Date: 10-22-25
Last Updated: 05-12-26

IMPORTANT LEGAL NOTICE: THESE TERMS OF SERVICE (“TERMS”) FORM A BINDING AGREEMENT. BY CLICKING “I AGREE,” EXECUTING AN ORDER FORM THAT REFERENCES THESE TERMS, OR USING OUR SERVICES, YOU ACCEPT AND AGREE TO BE BOUND BY THESE TERMS ON BEHALF OF THE ENTITY OR PERSON YOU REPRESENT (“Client,” “you”).

These Terms, together with any applicable Order Forms, the Hire Match AI Data Processing Agreement (“DPA”), and any Statements of Work (“SOW”), form the entire agreement (“Agreement”) between you and Hire Match AI, LLC (“Hire Match AI,” “we,” “us”).
 
1. Definitions

“Aggregated Data” means data derived from Client’s use of the Services that has been aggregated, anonymized, and de-identified such that it does not identify Client, any Authorized User, any Candidate, or any individual, and cannot reasonably be re-identified.
“Applicable Laws” means all applicable U.S. federal, state, and local laws, regulations, and guidance, including without limitation anti-discrimination laws, employment laws, privacy and data protection laws (e.g., CCPA/CPRA), and laws governing automated employment decision tools.
“Authorized User” means an employee or contractor of Client authorized to access and use the Services on Client’s behalf.
"ATS" means an Applicant Tracking System used by a client to manage job applications and candidate data.
“Candidate” means an individual job applicant whose information is submitted to the Services by or on behalf of Client.
“Candidate Data” means data relating to a Candidate, including resumes, applications, and responses, submitted to the Services by or on behalf of Client.
“Client Data” means all data submitted to the Services by or on behalf of Client, excluding Candidate Data.
“Documentation” means user guides, technical documentation, and other written materials made available by Hire Match AI describing the Services.
"Integrated Services" means the Services provided by Hire Match AI through direct integration with a Client's designated ATS.
“Order Form” means an ordering document or online enrollment specifying the Services, subscription term, usage limits, and fees.
“Professional Services” means implementation, training, configuration, advisory, or other Services provided pursuant to a separate SOW.
"Services" means Hire Match AI’s browser-based analytics, compliance and data retention reporting, insights, benchmarking, and decision-support Services relating to hiring and recruitment processes, as specified in an Order Form. The Services analyze data provided by or on behalf of Client (whether directly or via an ATS Integration) and generate analytical outputs, insights, or metrics. The Services do not make final employment decisions.
 
2. The Services & License

2.1 License Grant
Subject to Client’s compliance with this Agreement, Hire Match AI grants Client a limited, non-exclusive, non-transferable right during the subscription term to access and use the Services and Documentation solely for Client’s internal recruitment, hiring, compliance, and workforce planning purposes.

2.2 Acceptable Use
Client agrees not to, and not to permit any third party to:

• Sublicense, resell, embed, or white-label the Services without prior written agreement;

• Use the Services in violation of Applicable Laws;

• Reverse engineer or attempt to extract source code or models;

• Interfere with or compromise the security or integrity of the Services; or

• Rely on the Services as the sole basis for employment decisions in a manner that results in unlawful discrimination or disparate impact.

 

2.3 Professional Services
Professional Services, if any, will be governed by a separate SOW and are not included unless expressly stated.
 

2.4. ATS Integration
If Client elects to use the Services through an ATS Integration: (a) Client authorizes Hire Match AI to access Candidate Data and other relevant information from Client's designated ATS solely as necessary to provide the Services; (b) Hire Match AI may return analytics, scores, or recommendations generated by the Services to Client's ATS as configured by Client; (c) Client is solely responsible for configuring the ATS Integration, granting appropriate permissions within the ATS for Hire Match AI's access, and complying with the ATS provider's terms and policies; and (d) Client's obligations under Section 4 (Client Responsibilities & AI Compliance) apply equally to data accessed via an ATS Integration.
 

2.4 ATS Integrations
If Client elects to use Integrated Services:

• Client authorizes Hire Match AI to access data from Client’s designated ATS solely as necessary to provide the Services;

• Hire Match AI may return analytical outputs or insights to Client or the ATS as configured by Client;

• Client is solely responsible for obtaining all necessary permissions and complying with the ATS provider’s terms; and

• Hire Match AI does not represent or warrant any relationship, endorsement, or partnership with any ATS provider unless expressly stated in writing.
   

3. Accounts and Security

Client is responsible for all activity under its accounts. Hire Match AI will maintain commercially reasonable administrative, technical, and physical safeguards. Client is responsible for proper configuration and secure use of the Services.
No security audits or penetration testing may be conducted without prior written consent.
 
4. Client Responsibilities & AI Compliance

4.1 Compliance with Laws
Client is responsible for ensuring its use of the Services complies with Applicable Laws, including obligations relating to Candidate notices and disclosures, recordkeeping, adverse impact analysis, and reporting obligations. 

While Client remains responsible for compliance with bias audits or impact assessments where required, Hire Match AI will supply model documentation, notice of material updates, and cooperation in supporting these bias audits. 
Specifically, to assist with compliance under regulations such as NYC Local Law 144, Hire Match AI will provide a cross-employer bias audit if the employer's historical data is included.
 
4.2 Candidate Consents
Client represents and warrants that it has obtained all required consents, notices, and authorizations prior to submitting Candidate Data to the Services, whether directly or via an ATS Integration.

4.3 Employment Decisions
Hire Match AI is not an employer, co-employer, or agent. The Services are informational, decision-support tools only and are not designed to be used as a substitute for human judgment. All employment decisions are made solely by the Client. Because the Services do not currently support in-platform scoring overrides, Client agrees that its Authorized Users will not rely solely on the Service's outputs. Client is strictly responsible for conducting an independent, manual review of Candidate qualifications outside of the Services before making any final hiring, advancement, or rejection decisions.

 

4.4 Fair Credit Reporting Act (FCRA) 
Disclaimer Hire Match AI is not a "Consumer Reporting Agency" and the analytical outputs and insights provided by the Services do not constitute "Consumer Reports," as those terms are defined under the Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.) or similar state laws. Client agrees that it will not use the Services as a consumer report or background check. If Client uses the Services in a manner that triggers FCRA or similar consumer protection laws, Client is solely responsible for providing all required disclosures, obtaining written authorizations, and issuing adverse action notices to Candidates.
 
5. Fees & Payment

5.1 Fees
You agree to pay all fees associated with your selected subscription tier, as set forth in the applicable Order Form or on the Hire Match AI Pricing Page.

Subscription fees are charged on a monthly basis. Fees paid are non-refundable except as expressly stated in these Terms or as required by law.

5.2 Billing and Invoicing
Hire Match AI bills subscription and usage-based fees in arrears.
 

• Subscriptions are billed at the start of each billing period.
  Invoices are issued at the beginning of each billing period and are due within thirty (30) days of the invoice date, unless otherwise stated in writing.
  If you cancel your subscription, your access will continue through the end of the current billing period. No additional fees will be invoiced after cancellation, and no refunds will be issued for the remainder of the period

​
 
5.3 Payment Method and Authorization
You authorize Hire Match AI (directly or through its third-party payment processor) to charge your designated payment method for all fees due under these Terms, including subscription fees, taxes, and any applicable interest or late fees.

You are responsible for maintaining accurate and up-to-date payment information. If payment cannot be successfully processed, you authorize us to retry the charge using the same payment method.

5.4 Invoice Disputes
You must notify in writing (including via email) of any good-faith dispute regarding an invoice within thirty (30) days of the invoice date, specifying the nature of the dispute in reasonable detail.

Amounts not disputed within this period will be deemed accepted and payable.

You agree to pay all undisputed portions of an invoice while a dispute is being resolved.

5.5 Late Payments
Any undisputed amounts not paid when due may accrue interest at a rate of 1.5% per month, or the maximum rate permitted by law, whichever is lower.

5.6 Suspension and Termination for Non-Payment
We may suspend or limit your access to the Services if your account is more than fifteen (15) days past due, provided we give you written notice of non-payment and an opportunity to cure.

If payment remains outstanding after reasonable attempts to collect, or if your payment method fails repeatedly, we may terminate your access to the Services upon written notice. Termination does not relieve you of your obligation to pay any accrued fees.

5.7 Pricing Changes
We may modify our fees or pricing structure from time to time. Any pricing changes will take effect at the start of the next billing cycle following reasonable advance notice to you.

Pricing changes will not apply retroactively to fees already accrued.
 
5.8 Billing Errors and Refunds
If we identify a billing error, we will correct it and, where applicable, issue a refund or credit in a commercially reasonable manner.

Except for billing errors or as required by law, fees paid are non-refundable.

5.9 Taxes
Our fees do not include taxes. You are responsible for all applicable taxes, duties, levies, or similar governmental assessments, excluding taxes based solely on our net income.
 
6. Intellectual Property & Data

6.1 Our IP
Hire Match AI retains all right, title, and interest in the Services, Documentation, and Aggregated Data.

6.2 Client Data
Client retains ownership of its data, including any Client Data or Candidate Data accessed via an ATS Integration. Client grants Hire Match AI a limited license to process such data solely to provide the Services.

6.3 Aggregated Data
Hire Match AI may use Aggregated Data for lawful purposes, including Service improvement and the generation of generalized, non-identifiable benchmarking insights. 

However, to clarify the boundaries between Derived Data and Model Training Data, Hire Match AI is explicitly prohibited from using Client Data, Candidate Data, or specific AI outputs to train its machine learning models, unless the Client grants a separate, explicit license for that specific use. Aggregated Data will not identify Client or any individual.
 
6.4 Feedback
Feedback may be used without restriction or obligation.
 
7. Data Processing, Privacy, and Security

7.1. Data Processing Agreement. 
The Hire Match AI DPA is incorporated by reference into this Agreement. The DPA governs the processing of personal data, our role as a "Service provider" or "processor" under Applicable Laws, our use of subprocessors, and our data breach notification procedures.

7.2. Data Residency 
The core Services, including the processing and storage of Client Data and Candidate Data, are hosted and operated exclusively within the United States. You acknowledge that all Client Data and Candidate Data will be processed and stored in the U.S.

7.3. Export Compliance 
You may not use the Services in violation of U.S. export control or economic sanctions laws.

 

7.4 AI Subprocessors
Client acknowledges that Hire Match AI may utilize third-party artificial intelligence models or APIs ("AI Subprocessors") to provide the Services. Hire Match AI will maintain an explicit list of all authorized AI Subprocessors and provide Client with advance notice of any new AI Subprocessors. Hire Match AI contractually prohibits its AI Subprocessors from using Client Data or Candidate Data to train, improve, or fine-tune the AI Subprocessors' underlying foundational models. Hire Match AI remains liable for the acts and omissions of its AI Subprocessors to the extent they violate the data privacy and security obligations of this Agreement.
 
8. Term and Termination

8.1. Term and Renewal 
The Agreement commences on the date you first accept it and continues for the subscription term in your Order Form. Subscriptions will automatically renew for additional periods equal to the expiring term unless either party gives the other notice of non-renewal at least thirty (30) days before the end of the relevant term. We will provide notice of renewal in advance where required by Applicable Laws.

8.2. Termination for Cause 
A party may terminate this Agreement for cause if the other party materially breaches this Agreement and fails to cure such breach within thirty (30) days of receiving written notice.

8.3. Effect of Termination 

Upon termination, your right to access the Services will cease. We will make your data available for export for a period of thirty (30) days. Following this period, Hire Match AI will permanently and securely delete all Client Data and Candidate Data from its active systems. Upon Client's written request, Hire Match AI will provide a formal "Certificate of Destruction" (CoD) verifying that the data has been irreversibly destroyed in accordance with industry-standard data sanitization practices.

8.4. Data Retention & Destruction 
The Services provide automated reports ("Snapshots") to assist Client in identifying records that may meet jurisdictional retention thresholds (e.g., EEOC, OFCCP, or state-specific standards). Client acknowledges that Hire Match AI provides information for operational awareness only and does not perform the actual deletion or purging of data within the Client’s ATS. Client is solely responsible for: (a) verifying the accuracy of the retention periods identified in the Snapshots; (b) executing any data destruction or purging within its own systems; and (c) ensuring its data destruction practices comply with all Applicable Laws. Hire Match AI shall have no liability for Client’s failure to delete data or for any unauthorized or premature deletion of data performed by Client or its ATS provider.

8.5. Survival 
The following sections will survive any termination or expiration of this Agreement: 1, 4, 5, 6, 7.3, 8.5, 10, 11, 12, 13, and 14.
 
9. Confidentiality

9.1 Definition of Confidential Information
“Confidential Information” means any non-public information disclosed by one party (“Disclosing Party”) to the other party (“Receiving Party”) in connection with this Agreement that is designated as confidential or that reasonably should be understood to be confidential given the nature of the information and the circumstances of disclosure. Confidential Information includes, without limitation, Client Data, Candidate Data, pricing, product roadmaps, security information, technical materials, business plans, and non-public features of the Services.

9.2 Exclusions
Confidential Information does not include information that the Receiving Party can demonstrate:
(a) is or becomes publicly available without breach of this Agreement;
(b) was known to the Receiving Party prior to disclosure without restriction;
(c) is independently developed without use of the Disclosing Party’s Confidential Information; or
(d) is rightfully received from a third party without a duty of confidentiality.

9.3 Confidentiality Obligations

The Receiving Party will:

• Use the Confidential Information solely for purposes of performing under this Agreement;

• Not disclose Confidential Information to any third party except to its employees, contractors, or professional advisors who have a need to know and are bound by confidentiality obligations at least as protective as those herein; and

• Protect the Confidential Information using at least the same degree of care it uses to protect its own confidential information of similar importance, but no less than reasonable care.

​

9.4 Compelled Disclosure
The Receiving Party may disclose Confidential Information to the extent required by law, regulation, or court order, provided it gives the Disclosing Party prompt notice (where legally permitted) and reasonably cooperates to limit the scope of such disclosure.

9.5 Survival
The confidentiality obligations under this Section will survive termination or expiration of this Agreement for a period of three (3) years, except with respect to trade secrets, which will be protected for so long as they remain trade secrets under applicable law.
 
10. Service Levels & Support

10.1. Support 
We will provide technical support as specified in the applicable Order Form.

10.2. Service Availability 
We will use commercially reasonable efforts to make the Services available. We may, at our discretion, introduce a minimum uptime commitment and associated Service credits via a Service Level Agreement ("SLA"), which would be attached to an Order Form. Any Service credits provided under an SLA will be your sole and exclusive remedy for any breach of such SLA.

 

10.3 Model Updates and Deprecation
Hire Match AI continuously monitors the Services for model drift and performance degradation. Hire Match AI reserves the right to update, retrain, or modify its algorithms to improve accuracy, mitigate bias, or comply with Applicable Laws. Hire Match AI will use commercially reasonable efforts to provide Client with advance written notice before making material algorithm changes, deprecating core models, or removing features that substantially alter the candidate scoring logic.
 
11. Disclaimers

THE SERVICES ARE PROVIDED "AS IS" AND "AS AVAILABLE." EXCEPT AS EXPRESSLY PROVIDED HEREIN, WE DISCLAIM ALL WARRANTIES, WHETHER EXPRESS, IMPLIED, STATUTORY, OR OTHERWISE, INCLUDING THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT.
 
12. Limitation of Liability

12.1. Liability Cap 
TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT WILL EITHER PARTY'S AGGREGATE LIABILITY ARISING OUT OF OR RELATED TO THIS AGREEMENT EXCEED THE TOTAL AMOUNT PAID BY CLIENT HEREUNDER IN THE TWELVE (12) MONTHS PRECEDING THE INCIDENT GIVING RISE TO THE LIABILITY. 
This liability cap, as well as any exclusion of consequential damages, shall not apply to specific carve-outs for data breaches or gross negligence.

12.2. Exclusions from Cap 
THE FOREGOING LIMITATION WILL NOT APPLY TO A PARTY'S OBLIGATIONS UNDER SECTION 12 (INDEMNIFICATION), A BREACH OF CONFIDENTIALITY, CLIENT’S PAYMENT OBLIGATIONS OR LIABILITY ARISING FROM A PARTY'S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT.

12.3. Exclusion of Consequential Damages 
IN NO EVENT WILL EITHER PARTY BE LIABLE FOR ANY INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES, INCLUDING LOST PROFITS.
 
13. Indemnification

13.1. By UsHire Match AI will defend and indemnify Client against any third-party claims, and will be explicitly liable for damages, in the event that the AI output infringes on third-party intellectual property, violates data security obligations, or produces biased or discriminatory results. However, this indemnification shall not apply to claims or damages arising from: (a) Client's failure to maintain Meaningful Human Oversight or failure to utilize the Service's human override features; (b) biases or discrimination inherent in historical Client Data or Candidate Data provided to Hire Match AI; or (c) Client's use of the Services in violation of the Acceptable Use restrictions in Section 2.2.

13.2. By You 
You will defend us against any third-party claim arising from: 
(a) Client Data or Candidate Data; 
(b) your breach of this Agreement, including your obligations under Section 4 (Client Responsibilities & AI Compliance); 
(c) any hiring decisions or employment-related claims made by a Candidate or third party against you; 
(d) your failure to conduct legally required bias audits or provide legally required notices, except where such failure was directly caused by our failure to provide the cooperation outlined in Section 4.1; 
(e) your reliance on any retention reporting or Snapshots provided by the Services; or 
(f) your non-compliance with any federal or state record-keeping laws. You will indemnify us against any damages and costs finally awarded.

13.3. Procedure 
The indemnified party must provide prompt notice of the claim, grant the indemnifying party sole control of the defense and settlement, and provide reasonable cooperation.

14. Independence; No Conflicts of Interest

Hire Match AI operates as an independent analytics and technology provider.

• Hire Match AI does not favor, rank, or weight outputs based on any commercial relationship with an ATS provider, law firm, or other third party.

• Hire Match AI does not share Client Data or Candidate Data with ATS providers, law firms, or other third parties except as authorized by Client or required by law.

• Any future partnerships, integrations, or additional products will not alter Hire Match AI’s obligation to provide Services in a neutral and independent manner unless expressly agreed in writing.

​

Nothing in this Agreement creates an agency, fiduciary, or joint venture relationship.
 
15. Governing Law & Venue

These Terms are governed by the laws of the State of Florida, without regard to conflict of law principles. The parties agree to the exclusive jurisdiction of the state and federal courts located in Tallahassee, Florida, unless a different forum is required by mandatory applicable law.
 
16. General Provisions

16.1. Entire Agreement 
This Agreement is the entire agreement between the parties and supersedes all prior agreements.

16.2. Assignment 
Neither party may assign its rights or obligations without the other's prior written consent, except in the case of a merger, acquisition, or sale of all or substantially all of its assets.

16.3. Publicity 
Client grants us the right to use Client's name and logo as a reference for marketing or promotional purposes, unless otherwise agreed in writing. Clients may revoke this right at any time by submitting a written request to us.

16.4. Force Majeure 
Neither party will be liable for any failure or delay in performance due to circumstances beyond its reasonable control.

16.5. Severability 
If any provision of this Agreement is found to be unenforceable, the remaining provisions will remain in full force.

16.6. Electronic Acceptance 
By executing an Order Form, clicking “I Agree,” or otherwise indicating acceptance electronically, you agree these Terms are enforceable to the fullest extent permitted by law, and that such acceptance constitutes a binding electronic signature.
 
17. Compliance Insights & Not Legal Advice
 
17.1 No Legal Advice. 
Any retention periods, legal citations, or jurisdictional triggers provided within the Services (including Monthly Compliance Snapshots) are for informational and operational purposes only. They do not constitute legal advice.
 
17.2 Jurisdictional Accuracy. 
While Hire Match AI uses commercially reasonable efforts to maintain accurate jurisdictional tables, labor laws are subject to frequent change. Client is responsible for consulting with legal counsel to confirm that its retention policies meet its specific legal obligations.
 
17.3 Reliance on Client Data. 
Client acknowledges that retention reporting is dependent on the accuracy of location and disposition data provided by Client or the ATS. Hire Match AI is not responsible for incorrect retention suggestions resulting from missing or inaccurate candidate or employee location data.

​

18. Insurance Obligations

​

During the term of this Agreement, Hire Match AI shall maintain, at its own expense, commercially reasonable insurance coverage appropriate to the nature of the Services. This shall include, at a minimum: (a) Technology Errors & Omissions (Tech E&O) insurance; and (b) Cyber Liability insurance covering data breaches, unauthorized access, and privacy violations. Upon Client's written request, Hire Match AI will provide a certificate of insurance evidencing such coverage.

​​

​

EXHIBIT A: DATA PROCESSING AGREEMENT (DPA)

 

Effective Date: 10/22/25 

Last Updated: 05/12/26

 

This Data Processing Agreement ("DPA") is appended to and incorporated by reference into the Hire Match AI Terms of Service, and together with any applicable Order Forms and Statements of Work, forms part of the entire agreement (the "Agreement") between Hire Match AI, LLC ("Hire Match AI," "we," "us") and the client executing the Agreement ("Client," "you")

 

This DPA applies to the Processing of Personal Data as part of the Services provided by Hire Match AI to Client.

​

1. Definitions

• "ATS Integration" means the Services provided by Hire Match AI through direct integration with a Client's designated ATS.

• Terms such as "Agreement," "Services," "Client Data," and "Candidate Data" have the meanings given to them in the Agreement.

• "Controller," "Processor," "Data Subject," "Personal Data," and "Processing" will have the meanings given to them in Applicable Data Protection Law. For the purpose of this DPA, they also relate to the processing of "personal information" under laws like the CCPA/CPRA.

• "Applicable Data Protection Law" means all laws and regulations applicable to the Processing of Personal Data under the Agreement, including but not limited to the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act (CTDPA), and the Utah Consumer Privacy Act (UCPA).

• "Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data transmitted, stored, or otherwise Processed by us.

• "Subprocessor" means any third-party Processor engaged by Hire Match AI to Process Personal Data.

 

 

2. Roles and Scope of Processing

​

2.1. Roles

For the purposes of the California Privacy Rights Act (CPRA), Hire Match AI explicitly acts as a "Service Provider" to the Client. 

Where Personal Data is accessed from a Client-designated ATS via an ATS Integration, Hire Match AI acts as a Subprocessor to Client with respect to such data and processes it pursuant to Client’s instructions and authorizations.

​

2.2. Client's Obligations 

Client represents and warrants that it has a lawful basis for the Processing of all Personal Data submitted to the Services and has provided all necessary notices and obtained all necessary consents from Data Subjects as required by Applicable Data Protection Law.

​

2.3. Hire Match AI's Processing 

We will Process Personal Data only on Client's documented instructions. 

Documented instructions include instructions provided through the Services, Order Forms, Client’s written communications to Hire Match AI, and the configuration of the ATS Integration. 

​

The primary instruction is to Process Personal Data for the purpose of providing the Services as described in the Agreement. 

As a Service Provider, Hire Match AI is explicitly prohibited from selling or sharing personal information, retaining or using it for any purpose outside the specified business purposes set forth in the Agreement, and from combining it with outside data. 

​

Client further instructs Hire Match AI to Process Personal Data (specifically Candidate location data, including that obtained via an ATS Integration) to determine applicable jurisdictional retention periods and to generate compliance-related insights as part of the Services.

​

2.4. Control of Retention Decisions

Client acknowledges that while the Services provide insights regarding data retention periods, Client remains the Controller of the Personal Data and is solely responsible for making final determinations regarding the deletion or retention of Candidate Data within their own systems and the Services.

 

3. Subprocessing

​

3.1. General Authorization 

Client provides a general written authorization for Hire Match AI to engage Subprocessors to provide the Services.

​

3.2. Subprocessor Obligations 

We will enter into a written agreement with each Subprocessor containing data protection obligations that are at least as protective as those in this DPA. We remain liable for the acts and omissions of our Subprocessors to the same extent we would be liable if performing the services of each Subprocessor directly under the terms of this DPA.

​

We remain liable for the acts and omissions of our Subprocessors to the same extent we would be liable if performing the services of each Subprocessor directly under the terms of this DPA. For any Subprocessor providing foundational artificial intelligence models or APIs (“AI Subprocessors”), Hire Match AI will ensure the written agreement explicitly prohibits the AI Subprocessor from using Client Data or Candidate Data to train, fine-tune, or improve its own underlying models.

​

3.3. Subprocessor List & Changes 

We will maintain a current list of our Subprocessors, available at [. We will provide the Client with at least thirty (30) days' prior written notice of any new Subprocessor. Clients may object to the appointment of a new Subprocessor on reasonable data protection grounds. If the parties cannot resolve the objection, the client may terminate the applicable Order Form.

 

4. Security and Audits

​

4.1. Security Measures 

Bias Audit Cooperation Client acknowledges that under Applicable Laws (such as NYC Local Law 144), Client may be required to conduct independent bias audits of the Services. Hire Match AI agrees to reasonably cooperate with Client’s designated independent auditor by providing access to necessary model documentation, high-level scoring logic, and historical Aggregated Data. Hire Match AI shall not be required to disclose proprietary source code, trade secrets, or raw Candidate Data of other clients. Any independent auditor must execute a strict non-disclosure agreement with Hire Match AI prior to accessing such materials.

​

4.2. Confidentiality

We will ensure that our personnel authorized to Process Personal Data are subject to binding confidentiality obligations.

​

4.3. Audits and Compliance Verification 

Upon Client’s reasonable written request provided with at least thirty (30) days' notice, and subject to appropriate confidentiality undertakings, we will make available information necessary to demonstrate our compliance with this DPA. 

​

We will satisfy such requests by: (a) responding to Client's written security questionnaire; (b) providing you with our internal security documentation and policies, such as the measures described in Appendix 2; or (c) providing a SOC 2 Type II report in lieu of a physical audit. 

​

Such requests may be made no more than once per calendar year. 

​

Nothing in this Section requires Hire Match AI to permit on-site audits or provide access to systems.

​

Such requests may be made no more than once per calendar year. Nothing in this Section requires Hire Match AI to permit on-site audits or provide access to systems. Notwithstanding the foregoing, Hire Match AI’s cooperation with independent bias audits required by Automated Employment Decision Tool (AEDT) laws (such as NYC Local Law 144) shall be governed exclusively by the 'Bias Audit Cooperation' provisions set forth in the Agreement.

 

5. Data Subject Rights and Assistance

​

5.1. Assistance with Requests 

We will provide reasonable assistance, taking into account the nature of the request and available information to you, through appropriate technical and organizational measures, to enable you to respond to requests from Data Subjects seeking to exercise their rights under Applicable Data Protection Law, including any rights related to profiling, human intervention, or automated decision-making. We will not respond to a Data Subject directly unless legally compelled to do so.

​

5.2. DPIA Assistance 

To the extent required by law, we will provide reasonable assistance to you in relation to data protection impact assessments and prior consultations with data protection authorities.

 

6. Personal Data Breach Notification

​

In the event of a confirmed Personal Data Breach affecting Client's Personal Data, we will notify Client without undue delay, and no later than seventy-two (72) hours of becoming aware of the breach, unless prohibited by law. 

​

The notification will, at a minimum: 

(a) Describe the nature of the Personal Data Breach; 

(b) Provide the name and contact details of our data protection contact point; 

(c) Describe the likely consequences of the Personal Data Breach; and 

(d) Describe the measures taken or proposed to be taken to address the breach.

 

7. Data Return and Deletion

Upon termination or expiration of the Agreement, we will, at Client's choice, delete or return all Personal Data to Client in a commonly used, machine-readable format. This process will commence after the thirty (30) day data export period specified in the Agreement has expired. We will delete existing copies unless Applicable Law (including but not limited to federal EEOC/OFCCP requirements and applicable state-specific employment or record-retention statutes) requires continued storage of the Personal Data.

 

8. General Provisions

​

8.1. Conflict 

In the event of a conflict between this DPA and the Agreement, the terms of this DPA will prevail with respect to the subject matter of data processing.

​

8.2. Liability 

Each party's liability arising out of or related to this DPA is subject to the limitations of liability set forth in the Agreement.

​

8.3. Governing Law 

This DPA will be governed by and constructed in accordance with the governing law and jurisdiction provisions in the Agreement. Following this period, Hire Match AI will permanently securely delete all Client Data and Candidate Data from its active systems. Upon Client's written request, Hire Match AI will provide a formal 'Certificate of Destruction' (CoD) verifying that the data has been irreversibly destroyed in accordance with industry-standard data sanitization practices.

Insurance Obligations 

​

During the term of this Agreement, Hire Match AI shall maintain, at its own expense, commercially reasonable insurance coverage appropriate to the nature of the Services. This shall include, at a minimum: (a) Technology Errors & Omissions (Tech E&O) insurance; and (b) Cyber Liability insurance covering data breaches, unauthorized access, and privacy violations. Upon Client's written request, Hire Match AI will provide a certificate of insurance evidencing such coverage.
 

Appendix 1: Details of Processing

​

A. Subject Matter of Processing

The Processing of Personal Data to provide browser-based analytics, benchmarking, and decision-support insights related to hiring and recruitment workflows, as described in the Agreement. This includes the processing of Personal Data accessed from Client’s designated ATS through a Client-authorized ATS Integration.

​

B. Duration of Processing

For the term of the Agreement, plus any additional period required for data export as specified in the Agreement.

​

C. Nature and Purpose of Processing

To ingest, store, and analyze Personal Data provided by or on behalf of Client for the purpose of generating analytical insights, comparative metrics, and jurisdictional data retention/compliance reporting related to Client’s recruitment and hiring processes.

​

D. Categories of Personal Data

Name, contact information (email, phone number), resume/CV content (including employment history, education, skills, qualifications), application information, assessment evaluations or classifications (including such data obtained via an ATS Integration), and geographic location data strictly limited to the Candidate's State of residence. To actively prevent algorithmic proxy bias, Hire Match AI does not extract or process granular location data, such as zip codes. Prohibited Data: Hire Match AI does not intentionally process, and Client is strictly prohibited from submitting, "Special Category Data" (including race, ethnic origin, political or religious beliefs) or "Biometric Data" (including photos, facial geometry, or voiceprints).

​

E. Categories of Data Subjects

Job applicants and prospective employees of the Client ("Candidates").

Client's employees and contractors who are authorized to use the Services ("Authorized Users").

​

 

Appendix 2: Technical and Organizational Security Measures (TOMs)

​

Hire Match AI will implement and maintain the following technical and organizational measures:

• Access Control

  • Access to systems is granted on a need-to-know basis and the principle of least privilege.

  • Use of unique user IDs and strong password requirements.

  • Multi-factor authentication (MFA) for access to production environments.

• Encryption

  • Personal Data encrypted in transit using TLS 1.2 or higher.

  • Personal Data encrypted at rest using AES-256 or equivalent.

• System Resilience and Availability

  • Hosting with a major cloud infrastructure provider (e.g., AWS) with redundancy.

  • Backup and disaster recovery plans for timely restoration.

 

• Security Testing and Monitoring

  • Logging and monitoring to detect and alert on security events.

  • Periodic vulnerability assessments and internal security reviews.

  • Use of security questionnaires and documented control reviews to assess and improve security posture.

  • Penetration testing by qualified third parties may be conducted periodically as part of Hire Match AI’s evolving security program.

  •  

• Personnel Security

  • Personnel subject to confidentiality agreements.

  • Regular security awareness training for all personnel with access to Personal Data.​

 

Appendix 3: Subprocessors

​

A current list of Hire Match AI's Subprocessors is maintained in our Subprocessors page.