1. Information we collect
Chesky collects information necessary to deliver our hiring intelligence platform. Categories of information we collect depend on how you interact with our services.
Account and organization data
When you create an account, we collect your name, email address, organization name, job title, and billing information. For enterprise accounts, we also collect your organization's domain, ATS configuration details, and team member information.
Candidate evaluation data
To provide our core services, we process candidate data flowing through our platform: names and contact information, resumes and CVs, LinkedIn profiles and public professional information, GitHub profiles and public repository data, case study submissions, video responses, and evaluation scores. This data is provided by enterprise customers (Controllers) in connection with active hiring processes.
ATS integration data
When you connect an ATS (Greenhouse, Lever, Workday, Ashby, or other supported platforms), we access your data in read-only mode. We do not write data back to your ATS unless explicitly configured. We collect job descriptions, candidate pipeline data, and evaluation metadata.
Usage and analytics data
We automatically collect information about how you use our platform, including pages visited, features used, time spent, browser type, IP address (anonymized after 90 days), and device information. We use this data solely to improve platform performance and user experience.
2. How we use data
We use collected information for the following purposes:
- Providing, maintaining, and improving the Chesky platform
- Generating AI-powered candidate evaluations and evidence records
- Creating role-specific case studies from job descriptions
- Performing anti-AI detection analysis on candidate submissions
- Analyzing cultural fit through public digital footprint data
- Processing payments and managing subscriptions
- Sending transactional and service communications
- Responding to support requests and inquiries
- Complying with legal obligations and enforcing our Terms of Service
- Detecting and preventing fraud, abuse, and security incidents
We do not use candidate data to train our AI models without explicit written consent from the enterprise customer. All AI processing is performed in isolated environments on a per-evaluation basis.
3. Data sharing and third parties
We do not sell your personal information. We share data only in the following limited circumstances:
Service providers
We work with trusted service providers including cloud infrastructure (AWS), AI model providers (via secure API gateways), payment processors (Stripe), email providers (Resend), and analytics services. All service providers are bound by data processing agreements.
Legal requirements
We may disclose information if required by law, regulation, legal process, or governmental request.
Business transfers
If Chesky is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice before such transfer.
4. Data security
We implement industry-standard security measures to protect your data:
Encryption in transit
All data transmitted to and from Chesky is encrypted using TLS 1.3.
Encryption at rest
All stored data is encrypted using AES-256. Database-level encryption is enforced.
Access controls
Role-based access control (RBAC) with least-privilege principles. MFA required for all internal systems.
Penetration testing
Annual third-party penetration testing. Vulnerabilities tracked and remediated within SLA windows.
Incident response
Documented incident response plan. Enterprise customers notified within 72 hours of a confirmed breach.
5. Your rights (GDPR / CCPA)
Depending on your location, you may have the following rights regarding your personal data:
Right to access
You can request a copy of the personal data we hold about you.
Right to rectification
You can request correction of inaccurate or incomplete personal data.
Right to erasure
You can request deletion of your personal data, subject to legal retention requirements.
Right to restriction
You can request that we restrict processing of your data in certain circumstances.
Right to data portability
You can request your data in a structured, machine-readable format.
Right to object
You can object to processing based on legitimate interests, including profiling.
Right to opt-out (CCPA)
California residents may opt out of the sale of personal information. We do not sell personal data.
Right to non-discrimination (CCPA)
We will not discriminate against you for exercising your CCPA rights.
To exercise any of these rights, contact privacy@chesky.ai. We will respond within 30 days.
6. LGPD notice (Brazil)
This section applies to individuals located in Brazil and supplements the rights described above. It is provided in accordance with Lei Geral de Protecao de Dados Pessoais (Lei 13.709/2018), the Brazilian General Data Protection Law (LGPD).
Chesky, Inc. acts as the Controller (Controlador) with respect to personal data processed in the context of its hiring intelligence platform. Enterprise customers who submit candidate data via the platform may act as joint Controllers or as independent Controllers, as agreed in their Data Processing Agreement.
Bases legais de tratamento
We process personal data of Brazilian individuals on the following legal bases under LGPD Art. 7: consent (consentimento), legitimate interest (interesse legitimo), execution of a contract (execucao de contrato), compliance with a legal obligation (cumprimento de obrigacao legal), and regular exercise of rights in judicial, administrative, or arbitral proceedings (exercicio regular de direitos).
Seus direitos (LGPD Art. 18)
Under the LGPD, you have the following rights with respect to your personal data:
Confirmacao e acesso
Confirm whether we process your personal data and request a copy.
Correcao
Request correction of incomplete, inaccurate, or outdated data.
Anonimizacao, bloqueio ou eliminacao
Request anonymization, blocking, or deletion of unnecessary or excessive data.
Portabilidade
Request portability of your data to another service provider.
Eliminacao dos dados tratados com consentimento
Request deletion of personal data processed with your consent.
Informacao sobre compartilhamento
Receive information about public and private entities with which we share your data.
Nao consentimento
Receive information about the possibility of not providing consent and the consequences of refusal.
Revogacao do consentimento
Revoke consent at any time, free of charge, by a simple procedure.
Encarregado (DPO)
Nos termos do Art. 41 da LGPD, indicamos o seguinte Encarregado pelo Tratamento de Dados Pessoais (Data Protection Officer):
Contact: privacy@chesky.ai
Chesky, Inc., 2261 Market Street, STE 36318, San Francisco, CA 94114, USA
Requests will be acknowledged within 15 days and resolved within 15 additional days, as required by LGPD Art. 18, para. 3.
7. Data retention
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements.
| Data type | Retention period |
|---|---|
| Account data | Duration of subscription + 90 days post-termination |
| Candidate evaluation data | Duration of contract + 30 days, then permanently deleted |
| ATS integration data | Session-only. Not persisted after sync |
| Usage analytics (raw) | 90 days, then anonymized |
| Support communications | 3 years from last interaction |
| Payment records | 7 years (tax and compliance) |
| Security logs | 12 months rolling window |
8. International data transfers
Chesky, Inc. is based in San Francisco, California, USA, and is part of the BeGlobal ecosystem. For transfers from the EEA, United Kingdom, or Switzerland to the United States, we rely on Standard Contractual Clauses (SCCs), Data Processing Agreements with all sub-processors, and technical and organizational measures aligned with GDPR requirements.
For transfers of personal data from Brazil under the LGPD, we apply equivalent protections including contractual safeguards and technical measures consistent with LGPD Chapter V requirements.
9. Contact us
Chesky, Inc.
2261 Market Street, STE 36318, San Francisco, CA 94114, USA