Privacy Policy
1. Overview
This Privacy Policy (“Privacy Policy”) explains how Company collects, uses, shares, and retains information in connection with the Platform. This Platform is intended for employer-side customers and their authorized Users.
This Privacy Policy applies to information we collect through the Platform, in communications with Customer and Users (including email, text, chat, and other electronic messages), and through related applications, products, and services that link to this Privacy Policy. This Privacy Policy does not apply to information collected offline or through any third-party website, application, product, or service that does not link to this Privacy Policy.
We may provide additional or different privacy notices for certain features, services, jurisdictions, or activities, and those supplemental notices will apply to the extent of any conflict with this Privacy Policy.
By accessing or using the Platform or providing information to Company in connection with the Platform, Customer and Users acknowledge the collection, use, and disclosure of information as described in this Privacy Policy.
Any capitalized term that is not defined in this Privacy Policy shall have the meaning given to it in the Company’s Platform Terms of Service.
This Privacy Policy does not apply to any website, application, product, or service operated by a third party or affiliate unless that property specifically links to this Privacy Policy.
2. Minors
The Platform is not intended for children or individuals under the age of 18, and Company does not knowingly collect personal information directly from children under 18. If Company becomes aware that it has collected personal information directly from a child under 18 without appropriate authorization, Company may delete that information.
3. Information We Collect
3.1 Customer Account and Usage Information
- Account details (name, business email, role, authentication info)
- Billing and plan information
- Usage logs, device/browser info, and security logs
Company may also collect information automatically through cookies, pixels, web beacons, SDKs, log files, and similar technologies, including information about device type, browser type, IP address, operating system, access times, pages viewed, interactions with Platform features, and other usage and diagnostic information.
3.2 Customer Data Submitted by Users
Roles, notes, evaluations, hiring workflow status, and other Customer Data.
3.3 Candidate Data
Candidate professional information may be collected from public sources and permitted third-party providers, and may include contact details, work history, skills, and enrichment attributes and information collected from individuals who provide professional references regarding Candidates, including recordings or transcripts of reference check calls facilitated through the Platform.
3.4 Recordings and Transcripts
The Platform may record and transcribe Customer–Candidate calls and calls involving Candidates or third parties when scheduled, hosted, or facilitated through the Platform (including via third-party call assistants). Customer is responsible for providing notice and obtaining legally required consent.
3.5 Information from Other Sources
Company may receive information from service providers, integration partners, affiliates, business partners, public sources, and other lawful third-party sources, and may combine that information with information collected directly through the Platform.
To the extent third-party services or integrations use their own collection technologies, Company does not control those third parties’ technologies or practices, which are governed by their own notices and policies.
3.6 COBOTA Browser Extension
Company offers an optional browser extension for use by a Customer’s authorized recruiting Users. The extension runs only on LinkedIn Recruiter pages (linkedin.com/talent and recruiter.linkedin.com) and acts only when the User explicitly activates it on a candidate the User has already opened. It does not browse, crawl, or collect in the background, and it is inactive on every other website.
When activated by the User, the extension collects:
- Personally identifiable information and website content. The candidate’s professional details as displayed on the page the User is viewing — name, professional headline, work history, education, skills, and any contact details LinkedIn already displays to that User — together with the LinkedIn profile identifier used to match the candidate to the Customer’s existing records.
- Location. The candidate’s self-published city, region, and country as shown on their profile. This is profile text, not device geolocation; the extension does not request or access the User’s device location.
- Authentication information. The User’s COBOTA account email address and password, submitted by the User to sign in to the Platform. The password is used solely to obtain a session token and is never stored, logged, or retained by the extension. Session tokens are held in the browser’s local extension storage on the User’s own device and are cleared on sign-out.
The extension deliberately does not collect special-category or affiliation information, including the organizations, associations, causes, or interests a candidate lists.
Information collected by the extension is transmitted directly to the Customer’s own COBOTA workspace and is handled as Candidate Data and Customer Data under this Privacy Policy. It is used solely to create and update candidate records and to generate interview invitations for that Customer. It is not sold, rented, used for advertising, used to build profiles unrelated to the Customer’s hiring, or transferred to any third party except the service providers described in Section 5.2.
4. How We Use Information
- Provide, maintain, secure, and support the Platform
- Operate sourcing, ranking, screening, and outreach features
- Generate transcripts and summaries for Customer Users
- Prevent fraud, abuse, and security incidents
- Comply with legal obligations and enforce agreements
- Analyze, measure, audit, develop, improve, optimize, and report on the Platform and related services
- Create, use, and disclose aggregated, statistical, and deidentified information for lawful business purposes
- Develop, train, improve, and validate automated, machine learning, and AI-assisted features and systems using Usage Data, feedback, and aggregated, statistical, deidentified, or anonymized information, and not Customer Data, Candidate Data, recordings, transcripts, prompts, inputs, Output, or Customer confidential information in identifiable form, except with consent or as otherwise agreed in writing
The Platform may use automated or AI-assisted features to support sourcing, ranking, screening, outreach, and related hiring workflows. These features and related Output are intended to assist, and not replace, Customer’s independent judgment, and should not be used as the sole basis for any employment decision without meaningful human review. We may use information as described in this Privacy Policy to maintain, test, review, and support reasonable safeguards for such features and to provide reasonably available information about their intended functionality and material limitations. Customers remain responsible for employment decisions, required notices, human review, accommodations, and compliance with employment, anti-discrimination, disability accommodation, privacy, and automated decision-making laws.
- Fulfill any other purpose disclosed at the time information is collected or provided
- Personalize user experience, remember preferences, improve search and navigation, and recognize returning Users
5. How We Share Information
5.1 With Customer
We share Candidate Data, recordings, transcripts, and Output with Customer Users under Customer’s account.
5.2 With Service Providers
We share information with vendors who help us provide the Platform (hosting, analytics, security, recording/transcription, support), under contractual safeguards.
5.3 With Affiliates
We may share information with our current or future affiliates, subsidiaries, contractors, service providers, and subprocessors for purposes consistent with this Privacy Policy, including to operate, support, secure, improve, and administer the Platform, subject to appropriate confidentiality, security, and data protection obligations.
5.4 With Consent or Direction
We may also share information with consent or at the direction of Customer or the applicable individual, where permitted by law.
5.5 Legal and Safety
We may disclose information to comply with law, protect rights and safety, investigate fraud, or respond to lawful requests. We may also disclose information to enforce our agreements, collect amounts owed, detect, prevent, or investigate fraud, abuse, or security incidents, and protect the rights, property, and safety of Company, Customers, Candidates, Users, or others.
5.6 Corporate Transactions
We may disclose or transfer information in connection with an actual or proposed merger, acquisition, financing, due diligence, reorganization, bankruptcy, receivership, sale of assets, or other corporate transaction in which information held by Company is among the transferred or reviewed assets.
5.7 No Sale of Customer Data
We do not sell Customer Data or personal information of Candidates or Users. We may share data with affiliates, service providers, or in corporate transactions as described in this Privacy Policy, which may be considered “sharing” under some laws but not a sale.
5.8 To Fulfill Requested Purposes
We may share information as reasonably necessary to fulfill the purpose for which the information was provided or the purpose for which the Platform feature was used.
6. Data Retention
We retain information as long as reasonably necessary to provide the Platform, comply with legal obligations, resolve disputes, and enforce agreements. Recordings and transcripts may be retained consistent with Platform operations unless prohibited by law or otherwise agreed in writing.
In determining retention periods, Company may consider the nature and sensitivity of the information, the purposes for which it is processed, legal and contractual requirements, security and fraud-prevention needs, dispute resolution needs, and operational necessity. At the end of the applicable retention period, information may be deleted, destroyed, or deidentified, unless otherwise required or permitted by law.
7. Security
We use commercially reasonable safeguards designed to protect information. No method of transmission or storage is fully secure; we cannot guarantee absolute security.
Email, text, chat, and other communications channels may not be fully secure, and individuals should use discretion in deciding what information to transmit through such channels. Any transmission of information to Company or through the Platform is at the sender’s own risk.
8. Your Choices
Customer administrators may access, export, or delete certain Customer Data via the Platform features. Some Candidate Data may be retained for sourcing operations and compliance.
Customer and Users are responsible for maintaining the confidentiality of account credentials and for taking reasonable steps to protect information they access through the Platform from unauthorized access, disclosure, or misuse.
Certain Platform features may be unavailable or may not function properly if required information is not provided, if permissions are disabled, or if certain collection technologies are blocked.
A User may stop all collection by the browser extension at any time by signing out of it or removing it from their browser.
9. U.S. State Privacy Notices
If required by applicable law (such as the California Consumer Privacy Act (CCPA) as amended), we will provide additional notices and mechanisms. The Platform is primarily business-to-business; Candidate-related requests may be directed to legal@cobota.ai.
Any privacy rights available under applicable law may be subject to verification requirements, legal exceptions, and limitations that vary by jurisdiction. Company may deny or limit a request to the extent permitted by applicable law.
Where required by applicable law, Company may recognize browser-based or device-based privacy preference signals and provide mechanisms for certain opt-out choices.
The categories of information we may disclose include account information, usage information, Customer Data, Candidate Data, recordings, transcripts, Output, and other information described in Section 3.
Because there is not yet a consistent industry standard for interpreting browser-based “Do Not Track” signals, the Platform may not respond to all such signals except as required by applicable law.
Company may take reasonable steps to verify the identity and authority of a requestor before responding to a privacy rights request.
10. Updates
We may update this Privacy Policy from time to time and will post the updated version with a revised effective date. To the extent permitted by law, continued access to or use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of the updated Privacy Policy. Customer and Users should review this Privacy Policy periodically for updates.
11. Contact
To submit a privacy request, ask questions about this Privacy Policy, or contact Company regarding privacy practices, please contact us at legal@cobota.ai. Candidate-related privacy requests may also be directed to this contact point unless otherwise stated in a supplemental notice.