Privacy Policy

1. Overview

Ravix Group Inc. ("Company", "we", "us", or "our") operates thepassband, a cloud-based applicant tracking platform ("Service"). This Privacy Policy explains how we collect, use, disclose, and protect information about organizations that subscribe to the Service ("Subscribers") and the individuals whose data is processed through it ("Candidates").

By using the Service, you acknowledge that you have read and understood this policy. If you have questions, contact us at privacy@thepassband.com.

2. Information We Collect

2a. Subscriber Account Information

When an organization registers for the Service, we collect:

• Organization name, industry, and contact details
• User names, email addresses, and roles
• Billing and payment information (processed by our payment provider)
• Login credentials (passwords are stored as one-way hashed values)

2b. Candidate Data (Submitted by Subscribers)

Subscribers upload and manage candidate information through the Service. This may include:

• Name, email address, phone number, and mailing address
• Resume content, work history, and educational background
• Skills, certifications, and professional licenses
• Geographic preferences and compensation expectations
• Interview notes, recruiter ratings, and pipeline status
• Email correspondence via the outreach features
• LinkedIn profile URLs and other professional identifiers

We process this data on behalf of Subscribers as a data processor. The Subscriber is the data controller responsible for the lawful basis of collection and use.

2c. Usage and Technical Data

We automatically collect certain technical information when you use the Service:

• IP address and device/browser type
• Pages visited, features used, and session duration
• API request logs and error reports

3. How We Use Information

Subscriber Account Data

• To provision, operate, and improve the Service
• To authenticate users and maintain account security
• To process payments and send billing communications
• To send service-related notifications and product updates
• To respond to support requests and inquiries

Candidate Data

• To parse and structure resume content using AI models
• To match candidates to job requirements as instructed by Subscribers
• To send outreach emails on behalf of Subscribers
• To maintain the candidate's profile, status, and pipeline history

We do not use Candidate Data to train our AI models for purposes outside of providing the Service. We do not sell Candidate Data to third parties.

4. AI and Automated Processing

The Service uses third-party AI models (including models provided by Anthropic) to parse resumes, generate candidate summaries, and assist with matching and outreach drafting. Resume content and structured profile data may be transmitted to these providers for processing. We have data processing agreements in place with these providers that prohibit them from using your data to train their general models.

Automated processing is used as a tool to assist human recruiters. No hiring decisions are made solely by automated means — all material decisions remain with the Subscriber's personnel.

5. Sharing and Disclosure

We do not sell personal information. We may share information with:

• Service providers — cloud infrastructure (AWS), AI processing (Anthropic), email delivery (SendGrid), and payment processing — each bound by data processing agreements
• Subscribers — who have full access to the Candidate Data they have uploaded
• Law enforcement or regulatory authorities — when required by valid legal process or to protect the rights and safety of persons
• Successors — in connection with a merger, acquisition, or sale of assets, with notice to affected Subscribers

6. Email Outreach and Candidate Rights

Candidates who receive outreach emails from Subscribers via the Service may opt out by clicking the unsubscribe link included in each outreach email. Upon opt-out, the candidate's status is updated to Do Not Contact and no further outreach emails will be sent.

Candidates wishing to access, correct, or request deletion of their personal data should contact the Subscriber (the recruiting firm) directly, as they are the data controller. If you are unable to reach the Subscriber, you may contact us at privacy@thepassband.com and we will assist in routing your request.

7. Data Retention

Subscriber account data is retained for the duration of the subscription and for thirty (30) days following termination to allow for data export. Candidate Data uploaded by Subscribers is retained until the Subscriber deletes it or their account is terminated.

System logs and usage data are retained for up to ninety (90) days for security and operational purposes.

8. Security

We implement industry-standard security measures including encryption in transit (TLS), encrypted storage of sensitive credentials, role-based access controls, and audit logging. We conduct periodic security reviews. However, no system is completely secure, and we cannot guarantee absolute security of your data.

In the event of a data breach that affects your personal information, we will notify affected Subscribers as required by applicable law.

9. Cookies and Tracking

The Service uses session cookies necessary for authentication and maintaining your logged-in state. We do not use third-party advertising cookies or behavioral tracking technologies. You may disable cookies in your browser, but this will prevent you from logging in to the Service.

10. California Privacy Rights (CCPA)

California residents have rights under the California Consumer Privacy Act including the right to know what personal information is collected, the right to delete personal information, the right to opt out of sale (we do not sell personal information), and the right to non-discrimination for exercising these rights.

To exercise these rights, contact us at privacy@thepassband.com. We will respond within the timeframes required by law.

11. International Data Transfers

The Service is hosted in the United States. If you are located outside the United States, your data will be transferred to and processed in the United States. By using the Service, you consent to this transfer. For Subscribers subject to GDPR, we offer a Data Processing Agreement upon request.

12. Children's Privacy

The Service is not directed to individuals under the age of 18 and we do not knowingly collect personal information from minors. If you believe we have inadvertently collected such information, contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to Subscribers via email or in-app notification at least fourteen (14) days before taking effect. The updated policy will be posted at this URL with a revised effective date.

14. Contact Us

For privacy questions, requests, or concerns:
privacy@thepassband.com
Ravix Group Inc., San Francisco, CA