Privacy Policy

1. Scope

This policy covers the TopCatch client portal — the authenticated application where our clients follow the progress of their open roles. It is separate from the privacy policy published on our public website, which addresses candidates and site visitors.

The portal is closed. Accounts are issued to representatives of companies that have a services agreement with us. There is no public registration.

2. Whose data appears here

Two groups, treated differently:

2.1 Portal users — your team

• —Work email address, used as the login.
• —A password, kept only as a one-way cryptographic hash. We never store it in a readable form and cannot recover it.
• —Session records: an identifier stored in a cookie, its expiry, and the IP address and browser used to sign in.
• —Actions taken in the portal, such as moving a candidate through the pipeline or recording a decision.

2.2 Candidates

• —Name, contact details, and links to public professional profiles or CVs.
• —Work history, seniority, location and language, stated expectations.
• —Our own notes, pipeline stage, and recruiter assessments.
• —Recordings and transcripts of screening interviews, and the written summary produced from them — see section 4.

3. Where candidate data comes from

• —From the candidate: applications, CVs, and what they tell us in conversation.
• —From public professional profiles and job platforms where a person has made their experience visible to recruiters.
• —From specialised providers of professional-profile data, acting under contract with us.
• —From screening interviews we conduct.

4. Interview recordings, transcripts and summaries

Screening interviews are recorded and transcribed automatically. Participants are informed at the start of the call, and a recording notice is visible for the duration.

• —The recording and the full transcript are internal. They are used by our team to assess a candidate and are not made available through the portal.
• —What you see is a written summary: why the person is worth considering, their relevant experience, why they are leaving their current role, and their compensation expectations.
• —Recording and transcription are carried out by a specialist provider engaged by us, under contract and confidentiality obligations.
• —A candidate may ask us not to record, or to delete an existing recording, by writing to contact@topcatch.io.

5. Why we process this data

• —To deliver the service — to search for, assess and present candidates for your open roles, and to run the hiring process to a decision.
• —To give you access — authentication, sessions, and keeping each company's data separate from every other company's.
• —To communicate — about candidates, scheduling and the progress of your roles.
• —To meet our obligations — invoicing, accounting and record-keeping required by law.
• —To keep the service safe — detecting misuse and investigating security incidents.

We rely on the performance of our agreement with you, our legitimate interest in operating a recruitment service, and — where required — consent, which can be withdrawn at any time.

6. Automated processing and AI

No hiring decision is made automatically. We use automated tools to read and organise information faster, not to decide about people.

• —Interview summaries are generated automatically from the transcript and then reviewed by a recruiter.
• —Match scores and rankings are suggestions that order a list; they do not accept or reject anyone.
• —Every candidate presented to you has been looked at by a person first.
• —Automated tools have limits and may not capture every aspect of someone's experience. A candidate may ask for a human review of anything automated that affected them.

7. Who else sees this data

We share personal data only in the following cases:

• —With you, our client — candidate information for your own vacancies only. Other clients' roles and candidates are never visible to you, and yours are never visible to them.
• —With service providers we engage to operate the service. We name categories rather than companies, because the list changes: secure hosting and storage; meeting recording and transcription; calendar and email; internal databases and workflow tools; providers of professional-profile data; AI processing; and payment and payroll processing. Each acts on our instructions, under confidentiality obligations, and only as far as the service requires.
• —Where the law requires it, or to establish or defend legal claims.
• —In a business transfer — if the business is merged or acquired, data may pass to the acquiring entity. We will give notice of any such change.

We do not sell personal data and do not share it for advertising.

8. Payments

Fees under your agreement are settled through a third-party payroll and payments partner. That partner receives the details needed to process a payment — your company's billing information and the amounts due — and does not receive candidate data. Payment card details are handled by the payment provider and never reach our systems.

9. How long we keep it

• —Portal accounts and their activity — for as long as your agreement is in force, and for a limited period afterwards for accounting and dispute-resolution purposes.
• —Candidate profiles — while they remain relevant to placing that person, or until the candidate asks us to remove them.
• —Recordings and transcripts — kept while the role they relate to is active, then deleted.
• —On a valid deletion request we act within 30 days, unless the law requires us to keep something longer.

10. How we protect it

• —All traffic to the portal is encrypted in transit (TLS).
• —Passwords are stored only as one-way hashes; session identifiers are stored hashed as well.
• —Access is separated by company at the data layer, so one client cannot reach another's records.
• —The database is not reachable from the public internet, and backups are taken daily.
• —Providers we engage are bound by confidentiality obligations.

If a breach is likely to create a risk to affected people, we will notify the competent authority without undue delay — within 72 hours where the law requires it — and inform those affected where the risk is high. Report a suspected problem to contact@topcatch.io.

11. Your rights

Subject to applicable law, any individual whose data we hold may ask us to:

• —Access — provide a copy of the data we hold.
• —Correct — fix anything inaccurate or incomplete.
• —Delete — erase the data, including recordings and transcripts.
• —Port — receive it in a machine-readable format.
• —Object or restrict — stop or limit particular processing.
• —Withdraw consent — where processing rests on consent.
• —Complain — to the data protection authority where they live.

Write to contact@topcatch.io. We respond within 30 days, or tell you if we need longer.

12. Cookies

The portal sets one cookie, which keeps you signed in. It is strictly necessary for the service to work and cannot be switched off while you are using it. Signing out removes it. The portal carries no advertising or tracking cookies.

13. International transfers

Our infrastructure and some of our providers operate outside the country where you or a candidate are located, so personal data may be processed abroad. Where that happens, we put appropriate safeguards in place, consistent with applicable law.

14. Changes

We may update this policy. Material changes will be announced in the portal or by email to the address on your account before they take effect.

15. Contact

For any privacy question, or to exercise the rights above, write to contact@topcatch.io.