Last changed 25 October 2026

Privacy

This page describes what Humsana Hiring stores, where it goes, and what a candidate or a company can ask us to do with it. It is written to be read, not to protect us.

Who is responsible

The company that runs the hiring process is the data controller for its candidates. Humsana processes their applications on that company's instructions: we read, store and present evidence, and we do not use a candidate's data for any other purpose. For account data, Humsana is the controller.

What we hold

• The company's account: name, email, company name, a password hash.
• The role and the scorecard: the founder's answers, the criteria, the approved version and its hash.
• Each application: the CV file, the text extracted from it, the applicant's own answers, and their contact details as supplied.
• The reading: a verdict per criterion, the quoted sentence behind it, a summary, and what would change the answer.
• The decision: who decided, when, on which criterion, with a reason if one was given, and a signature.
• An audit trail of who opened, read, imported and decided what.

How a CV is read

Before anything reads an application, name, email, phone number, city, college, graduation year, links and gendered pronouns are removed by rule, and the count of what was hidden is kept so the process can be audited. The redacted text is sent to a language model to find evidence for each criterion. The model's sentence is checked against the document; if the sentence is not there, the verdict is discarded. The model is never asked to make a decision about a person.

Who else sees it

• Hosting. DigitalOcean, Bangalore region, where the database and the uploaded CVs live.
• Reading. DeepSeek's API receives the redacted CV text and the criteria, not the file, not the name, and not the contact details.
• Email. ZeptoMail delivers the shortlist to the company that owns the role.
• Sheets. Only if the company connects its own Google account, in which case the spreadsheet is created in that account's Drive. We do not keep a copy.

We do not sell personal data, and we do not use candidate data to train a model.

The model that reads an application is a third-party language model, used through its developer API. It receives the redacted text, never the name, email, phone, city, college or links. We do not rely on the consumer product's privacy terms for this; the API terms, the retention at that provider and the location of processing are reviewed before real applications are read, and companies can ask which provider is in use before they send us anything.

How long

CVs, extracted text and evidence are deleted ninety days after an application is received, or sooner if the company asks. The deletion runs automatically and every run is recorded. A signed decision record survives, because it contains no name, no email and no document: it is a statement about the process, not about a person. Decision records are kept without the CV, because a decision has to remain checkable after the paper is gone. Account data stays until the account is deleted.

What a candidate can ask for

A copy of what we hold, a correction, or deletion. Write to contact@humsana.com from the address used to apply, or reply to the acknowledgement email. We answer within thirty days. If a candidate asks us directly, we will tell the company that asked us to process the application, because the company is the controller.

Cookies

One cookie, for the company's own sign-in. No analytics, no advertising, no third-party scripts on the candidate pages.

Contact

contact@humsana.com. This page is a plain description of how the system works; it is not legal advice, and it will be reviewed before the product is offered commercially.