Privacy Policy

1. Information we collect

Account & authentication information: when you sign up or sign in with "Continue with Google," Google shares your name, email address, and profile photo with us so we can create and secure your account — that's the entire extent of it; this basic sign-in connection does not, by itself, give Candit access to your Calendar, Drive, Gmail, or any other Google Workspace data. If you sign up with email/password instead, we collect the name, email, and password you provide (stored hashed, never in plain text).

Google Calendar data (optional, separate authorization): connecting your calendar is a distinct step from signing in, requested and consented to separately. See Section 3 for exactly what we access, why, and how that use is restricted.

Meeting content: when a Candit bot joins a call, we capture and store the audio-derived transcript, along with any summary, scorecard, extracted facts, and notes generated from it.

Role & candidate data: job descriptions, extracted competencies, and candidate details you or your workspace enter or that are extracted from a transcript.

Billing information: handled directly by our payment processor, Stripe — Candit does not store your card number.

Support tickets: if you contact us (in-app or via our public Support page), we collect your name, email, and message so we can respond — see Section 9.

Usage & device data: standard technical data such as IP address, browser type, and in-app activity, collected for security and product improvement.

2. How we use information

• To provide the Service — joining meetings, generating transcripts/summaries/scorecards, and running search and chat features over your own data;
• To operate your account — billing, plan/usage enforcement, sending transactional email (invites, share notifications, receipts, support replies);
• To maintain security, prevent abuse, and debug issues;
• To improve the Service — in aggregate or de-identified form only; we do not use your Customer Content, and never use Google Workspace data, to train third-party or generalized foundation models.

3. Google API Services — Limited Use disclosure

Candit's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy , including the Limited Use requirements. This section is our affirmative statement of that compliance, and applies specifically to data received through the Google Calendar API when you choose to connect your Google account.

When you connect your Google account, Candit accesses Google Workspace data only to provide the features you request. For example, we use Google Calendar data to display your upcoming meetings, associate meetings with transcripts and notes, enable the Candit bot to join scheduled meetings on your behalf, and organize meeting information within your workspace. We request read-only calendar access (the calendar.events.readonly scope) — we never create, edit, or delete events on your calendar, and we never access a calendar you haven't explicitly connected.

Meeting transcripts, summaries, action items, interview reports, and other AI-generated outputs may be produced using trusted third-party AI providers acting on our behalf (see Section 4). These providers process data solely to deliver the functionality you requested, under agreements that prohibit using it to train their own models.

Specifically, in connection with data received from Google Workspace APIs:

• We only access Google Workspace data after you explicitly authorize the connection.
• We only use Google Workspace data to provide or improve the features you have requested.
• We do not sell Google Workspace data.
• We do not use Google Workspace data for advertising, marketing, or user profiling.
• We do not use Google Workspace data to develop, improve, or train generalized artificial intelligence or machine learning models.
• We do not share Google Workspace data with third parties except as necessary to provide the services you request, or where required by law.

Connecting Google Calendar is entirely optional and can be turned on or off at any time from Settings → Connect. You can revoke Candit's access at any time from Candit itself, or from your Google Account's third-party access settings . Revoking access stops all further Calendar API use immediately; we delete the associated access/refresh tokens from our systems once revoked.

4. AI processing & sub-processors

To generate transcripts, summaries, and scorecards, meeting and role content is sent to third-party AI providers as part of processing your request. Depending on your workspace's configuration, this may be Google (Gemini), OpenAI, or Anthropic; the always-on chat and assistant features currently use Google Gemini specifically. These providers process the content to return a result and do not use it to train their own models under our agreements with them. Other service providers we share data with, only as needed to run the Service: Recall.ai (bot-in-meeting capture and real-time transcription — SOC 2, ISO 27001, GDPR, CCPA, and HIPAA compliant), Stripe (billing), Resend (transactional email), Base44 (application hosting and database infrastructure), and the Google Calendar API (if you connect your calendar). We don't sell your data to anyone, ever.

5. What we receive when you sign in with Google

"Continue with Google" uses standard OpenID Connect sign-in (the openid and userinfo.email scopes) — Google shares only your name, email address, and profile photo with us to create and identify your account. This is a separate authorization from Calendar access (Section 3); granting one does not grant the other, and we ask for each independently, at the point you actually choose to use that feature.

6. Meeting participants who aren't Candit users

When you use Candit in a meeting, other participants — including candidates — will have their spoken words transcribed and processed, even though they don't hold a Candit account and haven't agreed to these policies directly. As explained in our Terms of Service, it's the responsibility of the Candit user (the recruiter) who invites the bot to obtain any consent required by law from everyone on the call before recording begins. The Candit bot joins meetings visibly and, where the meeting platform supports it, identifies itself as an AI notetaker. If you're a meeting participant with questions about a recording made using Candit, please contact the recruiter who hosted that meeting directly, or reach us at privacy@candit.co and we'll assist as we're able.

7. Data retention

We retain Customer Content (transcripts, summaries, scorecards, notes) for as long as your account is active, so your interview history stays searchable. If you delete a session, role, or your account, we delete the associated content from active systems promptly and from backups on our standard backup rotation. Disconnecting Google Calendar deletes your stored calendar tokens immediately; previously imported event data tied to existing sessions is not retroactively deleted. You can export or delete individual sessions at any time from the app.

8. Security

We use industry-standard safeguards — encryption in transit, access controls scoped by workspace, and secrets management for API credentials (including your Google Calendar refresh token, which is encrypted at rest) — to protect your data. Recall.ai, who capture and transcribe your meetings on our behalf, are independently SOC 2, ISO 27001, GDPR, CCPA, and HIPAA compliant. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

9. Support tickets

When you contact support — whether from inside the app or our public Support page — we store your name, email, and message so we can respond and keep a record of the conversation. Tickets submitted from the public Support page don't require an account and aren't linked to one unless the email you provide matches an existing Candit user.

10. Your rights & choices

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, or to object to or restrict certain processing. You can exercise most of these directly in the app (Settings → account and data controls) or by emailing privacy@candit.co . We'll respond within the timeframe required by applicable law.

11. Cookies

We use essential cookies/local storage to keep you signed in and remember basic preferences. We don't use third-party advertising trackers.

12. Children's privacy

The Service is intended for business use by adults and is not directed at children. We don't knowingly collect personal information from anyone under 18 as a Candit account holder.

13. International data transfers

We and the providers listed in Section 4 may process data in countries other than your own. Where required, we rely on appropriate safeguards (such as standard contractual clauses) for these transfers.

14. Changes to this policy

We'll update the date at the top of this page when this policy changes, and notify you by email or in-app if a change is material.

15. Contact

Questions about this policy or your data? Reach us at privacy@candit.co.