Last updated 31 October 2026

Privacy notice

This notice explains what information Humsana stores, how it is used and shared, how long it is kept, and what a candidate or a company can ask us to do with it.

Who is responsible for the data

The company running the hiring process is the data controller for candidate information. Humsana processes applications on that company's instructions: we read, store and present evidence, and we do not use a candidate's information for another purpose. For account information, Humsana is the controller.

Information we store

• Company account information: name, email address, company name and a password hash.
• Role and brief information: the founder's answers, the criteria, the approved version and its hash.
• Application information: the CV file, the text extracted from it, the candidate's answers and the contact details they provide.
• Assessment information: a verdict for each criterion, the quotation supporting it, a summary and what evidence could change the assessment.
• Anything the candidate sends later: a work sample, a reply to a follow-up question, or an email applying for the role.
• Decision information: the action, the criterion, the staff account that recorded it, the time, the signature and any note that person wrote. We also keep an audit trail of who opened, read, imported or decided on an application.

How applications are assessed

Before assessment, the system removes names, email addresses, phone numbers, city, date of birth, institution, graduation year, links and gendered pronouns according to its rules. It records how many items were removed, by category, so the process can be checked. The redacted text is sent to a language model to identify evidence for each criterion. The quoted text is checked against the application; if the passage is not present, the assessment is discarded. The model is not asked to make a hiring decision about the candidate.

A public page is read only after a person confirms that it belongs to this candidate. That page's text is added to what the model reads, and it is redacted in the same way as the CV first. The address of the page is kept in Humsana so a founder can open it, and it is not sent to the model: a profile address contains a name.

Service providers

• Hosting: DigitalOcean, Bangalore region, where the database and uploaded CVs are stored.
• Assessment: DeepSeek's API receives redacted CV text, redacted text from confirmed pages, and the criteria. It does not receive the original file, the name, or the contact details.
• Email: ZeptoMail sends the shortlist to the company responsible for the role, and any follow-up question the company has explicitly asked us to send.
• Google Sheets: only when a company connects its own Google account. The spreadsheet is created in that account's Drive and Humsana does not keep a copy. Connecting Google stores an authorisation token for that account until the company disconnects it.

We do not sell personal information or use candidate information to train a model.

The assessment model is a third-party language model accessed through its developer API. We do not rely on the consumer product's privacy terms. The API terms, the provider's retention practices and the location of processing are reviewed before real applications are processed, and companies can ask which provider is in use before sending applications.

How long we keep information

CV files, the text extracted from them, the assessment and everything else attached to an application are deleted 90 days after the application is received, or sooner at the company's request. The deletion runs automatically every six hours, and every run is recorded, including the runs that delete nothing.

What that removes is the whole application: the file, the extracted text, the evidence, the work sample, any reply the candidate sent, and any email that came with it. A note a founder wrote against an assessment is cleared at the same time. The verdict, the reason it was given, and the run and brief version it belongs to are kept for calibration, because they describe the reading rather than the person.

Humsana keeps a signed record of decisions after an application is deleted. It includes the action, the criterion, the staff account that recorded it, the time, the signature, and any note entered by the reviewer. A note may contain information from the application. The record does not contain the candidate's name, email address or CV, which is what allows the process to remain checkable after the file is gone.

Account information is kept until the account is deleted.

Requests from candidates

Candidates can ask for a copy of their information, a correction or deletion. Email contact@humsana.com from the address used to apply, or reply to the acknowledgement email. We aim to respond within 30 days. If a candidate contacts us directly, we will tell the company that asked us to process the application, because that company is the controller.

Cookies

Humsana uses one cookie, for company sign-in. The candidate pages do not use analytics, advertising or third-party scripts.

Contact

contact@humsana.com. This notice describes the current product and its data flows. It is not legal advice and must be reviewed against the live deployment and by counsel before commercial launch.