Privacy Policy

• Account and profile data: name, email address, role (recruiter or candidate), company name where relevant, and profile fields you choose to provide (phone, location, social links, skills, compensation expectations, notice period).
• Application materials: resumes, cover letters, portfolio links, and other files or text you submit when applying to jobs.
• Authentication data: when you sign in with a third-party provider (such as Google, GitHub, or LinkedIn), we receive identifiers and basic profile information according to that provider's consent screen.
• Sign in with LinkedIn: if you choose LinkedIn, we use LinkedIn's OpenID Connect sign-in to authenticate you. We may receive your LinkedIn member identifier (sub), name, email address (when you grant it), and profile image URL, solely to create your session and populate your HookStep account. We do not post to LinkedIn on your behalf through sign-in. Use of LinkedIn data is subject to this policy and LinkedIn's Privacy Policy.
• Google One Tap: if you are not signed in to HookStep, our home, jobs, learning, FAQ, about, how-it-works and sign-in pages load Google's sign-in script (accounts.google.com) after you first scroll, tap, type or move the mouse. If your browser is signed in to Google, Google may show a "Continue as" prompt. Google receives the usual technical data any website request sends (such as your IP address and the page address), handled under Google's Privacy Policy. HookStep receives nothing unless you choose to continue; then Google sends us your Google account identifier, name, email address and profile picture, used only to sign you in, exactly as with the "Continue with Google" button. The script is not loaded when you are already signed in or when you open any other page.
• Cloudflare Web Analytics: every page loads Cloudflare's analytics script (static.cloudflareinsights.com) once the page has finished loading. It reports aggregate page views and page-load performance to us: the page address, referrer, country, browser and device type, and load timings. Cloudflare states that this service does not use cookies or local storage and does not track visitors across sites; see Cloudflare's Privacy Policy. Cloudflare also delivers our pages and protects them against abuse, so it sees the technical data of every request.
• Google AdSense (advertising): some public reading pages (our guides under /learn, the hiring guide, the FAQ and how-it-works) show ads served by Google AdSense. Google's advertising script (pagead2.googlesyndication.com) loads after you first scroll, tap, type or move the mouse, never while the page is loading, and it is not used inside signed-in dashboards. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our site and/or other sites on the Internet. Google and its ad partners receive the usual technical data of a page request (such as your IP address and the page address) and may set or read cookies and similar identifiers in your browser. HookStep does not pass your profile or application data to AdSense. You can opt out of personalised advertising in Google Ads Settings, and you can opt out of some third-party vendors' use of cookies for personalised advertising at www.aboutads.info. See how Google uses information from sites or apps that use its services and Google's Privacy Policy.
• Usage and technical data: IP address, device and browser type, pages viewed, and timestamps, used to secure the Service, debug issues, and understand aggregate usage.
• Communications: messages you send us through forms, email, or support channels.

• To create and maintain accounts, authenticate users, and deliver core product features.
• To show job listings, process applications, and help recruiters evaluate candidates.
• To send transactional notices (for example application status, security alerts) and, where permitted, product updates you can opt out of.
• To detect abuse, fraud, and security incidents; to comply with legal obligations.
• To improve reliability, performance, and user experience of the Service.

Depending on your region, we rely on appropriate legal bases such as performance of a contract, legitimate interests (for example securing our systems and improving the product), consent where required, and legal obligation.

We may share information with:

• Employers and recruiters when you apply to their jobs or interact with their listings. Your application content is shared with the relevant company account.
• Service providers who host infrastructure, store files, send email, or provide analytics, under contracts that limit use to providing services to us.
• Advertising partners: Google AdSense, as described above, receives the technical data of page requests on pages that show ads.
• Authorities when required by law or to protect rights, safety, and integrity of users and the Service.

We do not sell your personal information as a commodity.

We keep information for as long as your account is active or as needed to provide the Service, comply with law, resolve disputes, and enforce agreements. You may request deletion where applicable law applies, subject to legitimate retention needs.

We use administrative, technical, and organizational measures designed to protect information. No method of transmission or storage is completely secure; we encourage strong passwords and safe use of linked accounts.

We may process data in countries other than where you live. Where required, we use appropriate safeguards for cross-border transfers.

Depending on jurisdiction, you may have rights to access, correct, delete, or export personal data; to object to or restrict certain processing; and to withdraw consent where processing is consent-based. Contact us to exercise these rights. You may also lodge a complaint with a data protection authority. To limit personalised advertising, use Google Ads Settings or www.aboutads.info, or set your browser to block third-party cookies.

The Service is not directed at children under the age where they cannot lawfully use the platform in their region. We do not knowingly collect personal information from children.

We may update this policy from time to time. We will post the revised version on this page and update the "Last updated" date.

For privacy-related requests, email support@hookstep.in from the address on your account. Every other way to reach us is on the contact page.