Data Processing Addendum (draft)

Who is responsible for what

• This addendum is part of the Terms for Companies. For the personal data the Company receives or creates in Tabhar for Hiring (“Company Personal Data”), the Company is the controller and Tabhar is its processor: we process it only to provide the portal, on the Company’s instructions. Using the portal’s features is the Company’s instruction.
• A candidate’s own Tabhar account — their CVs, profile and settings — is not Company Personal Data. Tabhar is responsible for it under our Privacy Policy.

What data, about whom

• About applicants: the copy of the CV they chose (without the e-mail address and phone number in its contact fields), their cover letter and answers to the job’s questions, their contact details only when they choose to share them, and the messages, interview and offer details exchanged with the Company.
• Created by the Company: its stages, internal notes and scorecards about an application, and copies of messages its members share with colleagues (with the candidate’s e-mail address and phone number removed).
• About the Company’s members: their names, work e-mail addresses and roles.
• People the Company finds through CV search are covered too, once they appear in the Company’s portal.

What we do with it

• We store it, show it to the Company’s members according to their roles, send the e-mails the Company’s actions trigger, run the AI tools the Company chooses to use, and delete it as described below.
• We do not sell it, and we do not use it for any purpose of our own.

How long it is kept

• A candidate can withdraw an application at any time; the Company’s copy is then deleted at once. Otherwise the copy is deleted 90 days after the job closes.
• Notes and scorecards are deleted with the copy of the application. A member’s copy of a message loses its text when the candidate withdraws and is deleted 90 days after it was sent.
• A conversation and its messages are deleted after 12 months.
• A profile the Company keeps for future roles, with the candidate’s agreement, is kept for 12 months unless the candidate renews it, and the candidate can remove it at any time.
• AI summaries and reviews are deleted together with the copy of the application.

How it is protected

• Every connection is encrypted, and the data is stored by our database provider on servers that encrypt it at rest.
• The database itself checks every request, so one company cannot read another’s data.
• Every member who can open a CV signs in with two-step verification. Our own administrators sign in with two-step verification too, and their actions on an account are recorded.
• A strict content-security policy limits what code can run in the portal, and no analytics tool records the portal’s pages.
• Only people at Tabhar who need to — to review a company, a job, a report or a help request — look at Company Personal Data, and they keep it confidential.

Sub-processors

• Supabase — our database, sign-in and file storage. The data is stored in Tokyo, Japan.
• Vercel — hosting. Our server functions run in Tokyo, Japan; pages may be delivered from the network location nearest to the visitor.
• Resend — sending the e-mails the portal sends, such as the messages the Company sends candidates.
• Anthropic (Claude) — the main provider of the AI tools the Company chooses to use. Before text is sent, the details our redaction covers (such as names and contact details) are removed.
• Google (Gemini) — the fallback provider of the same AI tools, with the same redaction.
• Providers that do not receive candidate content: Upstash (counting requests to limit abuse), Cloudflare (the bot check on our forms) and Lemon Squeezy (the Company’s own billing, as merchant of record).
• We will publish a change to this list at least 30 days before a new sub-processor starts processing Company Personal Data, and the Company may object by writing to us.

Where the data goes

The data is stored in Japan. Our AI and e-mail providers may process it in other countries to provide their service. We rely on each provider’s own contractual protections for these transfers.

Helping the Company

• If a candidate asks the Company to see, correct or delete their data, we help the Company answer. A candidate can also withdraw an application or delete their account at any time, which removes the Company’s copy.
• We tell the Company without undue delay after we become aware of a personal data breach affecting Company Personal Data, with what we know and what we are doing about it.
• We give the Company the information it reasonably needs to show it meets its obligations for the data processed in the portal.

The Company’s part

• The Company has a lawful basis for its hiring and tells candidates what it needs to tell them about its own processing.
• The Company uses Company Personal Data only for its own hiring, as the Terms for Companies require.

AI tools

• The AI tools never score, reject or hide a candidate; a person at the Company always decides.
• An application is read by the AI applicant review only if the candidate applied under the notice that says so and did not choose “Don’t use AI on my application”.

When the agreement ends

When the Company’s account closes, Company Personal Data is deleted under the periods above, and the Company may ask us to delete it sooner by writing to support@tabhar.com.