Privacy Policy

Thercore Interviews (“Thercore”, “we”) provides interview and hiring-pipeline software at app.thercore.com.

For the account data of people who sign in to Thercore, we are the data controller. For information about candidates — whether a hiring team enters it or a candidate sends it through one of that company’s job adverts — the hiring company is the controller and we are a data processor acting on its instructions. It decides what is kept and for how long.

Your account. Your name, email address and, if you set one, a profile photo. If you sign in with Google, these come from Google (see section 3). If you sign up with a password, we store a cryptographic hash of it and never the password itself.

What you put in.Everything your team enters to run hiring: candidate names and email addresses, CVs and other attached files, LinkedIn links, interview schedules, written feedback, and internal notes. This is your organization’s data, not ours.

Job applications. If you apply for a job through an advert hosted on Thercore, we collect what the form asks for on behalf of the company you are applying to — see section 4.

Job advert visits.When someone opens a public job advert we count the visit so the company can see how its advert is doing. We record the date, the site you came from (for example linkedin.com), and a one-way hash of your IP address and browser type combined with that day’s date. The hash cannot be turned back into an IP address, we never store the IP address itself, and because the date is part of it the same visitor cannot be linked from one day to the next.

Operational records. Server logs, sign-in times, and the delivery status of emails, kept so the service can be run and debugged. Your IP address is also used briefly, in memory, to rate-limit sign-in and application attempts against abuse; it is not stored for that purpose.

Website analytics.We use self-hosted, cookieless analytics (Umami) to count visits and clicks on our public pages — the home page, sign-up and sign-in — never inside the app. No personal data, no cross-site tracking: it records the page, the site you came from, your browser, device, screen size, language and country, and clicks such as “Get started” or playing the tour. Visitors are counted with a one-way hash of your IP address and browser that changes every month; the IP address itself is not stored. It runs on our own server, nothing is shared with anyone, and if your browser sends Do Not Track, nothing is recorded at all.

We do not use advertising trackers, third-party analytics or third-party cookies. The few cookies we do set are listed in section 7.

If you choose “Continue with Google”, Google sends us three things from your Google profile: your name, your email address and your profile picture. We use them to create and identify your Thercore account and to show you to your colleagues inside the product. That is all we ask for and all we receive — we cannot read your Gmail, Drive, Calendar or Contacts.

Google user data is never sold, never used for advertising, never shared with anyone except as needed to run your account, and never used to train any machine-learning model. You can disconnect Thercore at any time from your Google account permissions page; deleting your Thercore account removes the copy we hold.

Thercore’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Companies use Thercore to publish job adverts, and the application form on those adverts is ours. When you apply, we collect what it asks for: your name and email address, your LinkedIn profile link if you give one, your CV (a PDF, Word or text file of up to 10 MB), and your answers to any screening questions the company added. We collect it for that company: it becomes part of their hiring pipeline, is seen by their hiring team, and is theirs to keep or delete. We do not show it to any other company, and applying to one company does not share your details with another.

After you apply we email you a private status link. It shows where your application stands and lets you withdraw it. It contains a long random key and is the only thing that opens your status page, so treat it like a password and do not share it. We also email you when the status of your application changes; we do not send you anything else, and we do not add you to any mailing list.

To see, correct or delete what you sent, contact the company you applied to — it controls that data. If you cannot reach them, write to privacy@thercore.com and we will pass your request on.

Thercore includes an assistant. When you use it, your messages and a summary of the hiring data relevant to your question are sent to Anthropic to generate a reply. Anthropic processes it to answer and does not use it to train their models.

The assistant only ever sees data belonging to the organization you are working in. If you would rather it saw nothing, do not use it — every other part of the product works without it.

We use a small number of providers to run the service. Each one is bound by contract to process data only as instructed.

Transfers outside the EEA rely on the European Commission’s Standard Contractual Clauses.

We set only what the service needs to work:

Inside the app, a few display preferences (your theme, which view opens first, which columns you show) are kept in your browser’s local storage. They stay on your device and are never sent to us. None of these is used to track you. If you sign up or sign in with Google, a note saying which page you started from is kept in your browser’s session storage until you return, so the visit can be counted as a completed sign-up; it is deleted as soon as it is read.

Your account and your organization’s data are kept for as long as the account is open. Delete a candidate, a note or an interview and it is removed from the database, not hidden; files attached to it go with it.

Backups are retained for fourteen days, so deleted data may persist in a backup for up to that long before ageing out. Server logs are kept for thirty days.

A job application is kept for as long as the company that received it keeps it; when they delete it, your status link stops working. Job advert visit records are deleted along with the advert.

Under the UK GDPR and EU GDPR you may ask for a copy of your data, ask for it to be corrected or erased, object to processing, or ask for it in a portable format. Write to privacy@thercore.com and we will respond within thirty days.

If the request concerns candidate data entered by one of our customers, we will pass it to that customer, who decides — we hold it on their behalf. You also have the right to complain to your national data protection authority.

Traffic is encrypted in transit with TLS. Passwords are hashed. Access to production systems is restricted to those who need it. Every organization’s data is scoped separately, and that boundary is enforced on the server on every request rather than in the interface.

No system is perfectly secure. If we discover a breach affecting your data, we will tell you and the relevant authority as the law requires.

If we change this policy in a way that materially affects you, we will say so in the product before it takes effect. The date at the top always reflects the current version.

Questions about this policy or about your data: privacy@thercore.com.