Privacy Policy

This Privacy Policy explains how Narbad (“Narbad”, “we”, “us”) collects, uses, and protects personal data when you use our websites and our suite of applications, including Narbad Recruit (together, the “Services”).

In short: we collect what we need to provide the Services, we keep each customer’s data isolated, we do not sell personal data, and you stay in control of the data in your workspace.

Who we are and our roles

When you create a Narbad account or visit our websites, Narbad acts as a data controller for the personal data described in this policy.

When an organization (our customer) uses the Services to process data about its own candidates, employees, or contacts, that organization is the controller and Narbad acts as a data processor on its behalf. If you are, for example, a candidate who applied through a careers site hosted on Narbad, the hiring organization decides how your data is used, and you should direct requests to them first; we will assist them in honoring your rights.

Data we collect

We collect the following categories of data:

• Account data — name, email address, password hash or passkey credentials, two-factor authentication settings, and organization membership.
• Customer content — the data our customers put into their workspace, such as job openings, candidate CVs and profiles, interview notes, transcripts, and related records.
• Usage data — log data such as IP address, browser type, pages viewed, and actions taken, used for security and to improve the Services.
• Communications — messages you send us, such as support requests and emails.

How we use data

We use personal data to:

• Provide, operate, and secure the Services.
• Authenticate users, including via passwords, passkeys, and two-factor authentication.
• Provide product features, including AI-assisted features described below.
• Respond to support requests and communicate service updates.
• Detect, prevent, and investigate abuse, fraud, and security incidents.
• Comply with legal obligations.

We do not sell personal data, and we do not use customer content for advertising.

AI features

Some features of the Services use machine-learning models, for example, extracting structured profiles from CVs, rating candidates against a job description, transcribing interviews, and generating interview summaries.

• Customer content processed by AI features is used to provide the feature to that customer’s workspace, not to train our own models.
• AI outputs (such as ratings and summaries) are assistive. Decisions about people, including hiring decisions, are made by the customer’s human users, and Narbad does not automatically reject candidates.

Data isolation and security

Each customer workspace runs on its own subdomain, and its content is stored in an isolated, per-tenant database. Additional measures include:

• Encryption of data in transit.
• Password hashing with modern algorithms and support for passkeys (WebAuthn) and TOTP two-factor authentication.
• Role-based access control within each organization.
• Logging and monitoring for security-relevant events.

No system is perfectly secure, but isolation by design means one customer’s data is never commingled with another’s.

Sharing and subprocessors

We share personal data only with:

• Service providers (subprocessors) that help us run the Services, such as cloud hosting, storage, email delivery, and AI model providers, bound by contracts that limit their use of the data to providing services to us.
• Authorities, where required by law and after reviewing the request’s validity.
• A successor entity in the event of a merger or acquisition, subject to this policy.

Retention

We retain account data for as long as your account is active and for a reasonable period afterwards. Customer content is retained according to the customer’s own settings and instructions; when a workspace is deleted, its isolated database and stored files are deleted after a short recovery window. Log data is retained for a limited period for security purposes.

Your rights

Depending on where you live, you may have rights to access, correct, export, restrict, object to the processing of, or delete your personal data. You can exercise many of these directly in your account settings, or by contacting us at privacy@narbad.com. If we process your data on behalf of one of our customers, we will refer your request to them and assist them in responding.

Cookies

We use strictly necessary cookies to keep you signed in and to secure the Services. We do not use third-party advertising cookies on our websites.

International transfers

Where personal data is transferred across borders, we rely on appropriate safeguards such as standard contractual clauses with our subprocessors.

Children

The Services are for business use and are not directed at children under 16. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. Material changes will be announced through the Services or by email before they take effect, and the “Last updated” date above always reflects the current version.

Contact us

Questions or requests about privacy? Contact us at privacy@narbad.com.