Privacy policy

Clients: when you sign in and use the app

If you sign in with Google or Microsoft, we receive your email address and your name from them. We use these to create and identify your account. We do not receive your password and we do not access your mailbox, contacts or files. A cookie keeps you signed in; it is required for the app to work and is not used for tracking or advertising.

Information you give us about your company and roles (the brief, your feedback on candidates) is used to run your search. When your company accepts our Client Terms we keep a record of the acceptance: who accepted, for which company, when, from which IP address and browser, and which version. We keep it as evidence of the contract.

Clients: when you connect your calendar

A company admin can connect a Google Calendar or a Microsoft Outlook calendar so candidates are offered real interview times. Connecting is optional, and the connection belongs to your company account. What we do with it:

• We read when your primary calendar is busy or free, and the calendar's timezone, to work out open slots inside the hours you set. We do not read the titles, descriptions or attendees of your other events, and we do not keep them.
• When a candidate confirms a time, we create one interview event on your calendar (title, time, video link, the candidate as guest), and move or delete that same event if the time changes. We only change events we created.
• The open slots we computed are included in the replies we draft to candidates. Our AI providers process them for that purpose only.

The access we receive from Google or Microsoft (a refresh token) is stored encrypted. We do not sell calendar data, share it for advertising, or use it to train AI models, ours or anyone else's. You can disconnect in the app at any time, which deletes the stored token. You can also revoke access in your Google or Microsoft account settings, which makes the token useless at once. Events we already created stay on your calendar until you remove them.

Highers' use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Candidates: where your data comes from

We find people whose professional background fits roles our clients are hiring for. We collect professional information that is publicly available, mainly on LinkedIn and company websites: name, job titles, employers, career history, education, skills, location and profile links. Contact details may come from data providers. We also hold the messages we exchange with you, and anything you tell us or upload (for example a CV, your salary expectations or your availability).

We use this to contact you about roles that may interest you, to assess whether a role fits you, and, if you tell us you are interested, to introduce you to the hiring company. Our legal basis is our legitimate interest in matching people with roles (GDPR art. 6(1)(f)); where you sign up yourself, or ask us to introduce you, it is also to take the steps you ask for (art. 6(1)(b)), and your consent where we ask for it.

We use AI tools to help find, assess and write to candidates. A person at Highers reviews introductions, and hiring decisions are always made by people at the hiring company. You can ask us to explain how we assessed you, or to have a person look at it again.

Who receives the data

• Hiring companies we introduce you to. Each uses your profile only for its hiring, as an independent controller, and must delete it within 6 months if it does not hire you.
• Service providers that process data for us: hosting (Google Cloud, Vercel), AI providers (Anthropic, OpenAI, TypeSafe), messaging and outreach tools (lemlist, Unipile), contact data enrichment (FullEnrich) and translation (DeepL).

Some providers are in the United States. Transfers outside the European Economic Area rely on an adequacy decision of the European Commission or on the EU standard contractual clauses. We do not sell personal data or share it for advertising.

How long we keep it

Candidate data: as long as it is useful to put you forward for roles, and at most 2 years after our last contact with you, unless you ask us to delete it sooner. Client account data: while the account is open and as long as needed for invoices and claims afterwards. Records of acceptance of our Client Terms: as long as the contract can give rise to a claim.

Your rights

You can ask us to see, correct, export or delete your data, to restrict its use, or object to it at any time, including to any further contact from us. Write to thomas@highers.co; we answer within one month. You can also lodge a complaint with a data protection authority: in the Netherlands, the Autoriteit Persoonsgegevens, or the authority where you live or work.