Privacy Policy

1. Data Controller / Responsible Party

The data controller (“Responsable” under LFPDPPP) responsible for your personal data is:

2. Personal Data We Collect

We collect the following categories of personal data (“datos personales”):

We do not collect sensitive personal data (“datos personales sensibles” under LFPDPPP) such as racial or ethnic origin, health or genetic data, religious or political beliefs, or biometric identifiers, unless you explicitly provide them.

3. How We Collect Personal Data

• Directly from you — when you register, complete an evaluation, contact support, or fill out a form.
• Automatically — through cookies, pixel tags, and server logs when you use our Services.
• From third parties — from payment processors (e.g., Stripe) and identity/authentication providers when you use social login.
• From our customers — business customers may submit your email to invite you to complete a candidate evaluation.

4. Purposes of Processing (“Finalidades del Tratamiento”)

We process your personal data for the following purposes:

Under LFPDPPP, you may object to secondary purposes (“finalidades secundarias”) at any time by contacting privacy@levelhire.ai. Objecting to secondary purposes will not affect your use of the platform.

5. Legal Basis for Processing

• Contract performance — processing necessary to provide the Services you have subscribed to.
• Consent (“consentimiento”) — where we send marketing communications or collect non-essential cookies.
• Legitimate interests (“interés legítimo”) — for fraud prevention, security monitoring, and aggregate analytics.
• Legal obligation (“obligación legal”) — where required by Mexican or US law (e.g., tax records, court orders).

6. Your Rights (ARCO + US Rights)

You have the following rights regarding your personal data:

7. Data Sharing and Third Parties

We do not sell your personal data. We may share it with:

• Service providers (“encargados”) — cloud hosting (AWS/GCP), payment processing (Stripe), email delivery (e.g., Postmark), error monitoring — all bound by data processing agreements.
• Business customers — if you complete a candidate evaluation, results are shared with the company that invited you.
• Legal and regulatory authorities — when required by law, court order, or to protect our legal rights.
• Business transfers — in connection with a merger, acquisition, or sale of assets, with prior notice to affected users.

8. International Data Transfers

LevelHire processes data on servers located in the United States and may transfer data across borders. When transferring personal data of Mexican residents outside Mexico, we ensure appropriate safeguards are in place as required by LFPDPPP, including contractual clauses with data recipients. When transferring data from the US, we comply with applicable state and federal requirements.

9. Cookies Policy

We use the following types of cookies:

You can manage cookie preferences through your browser settings or by contacting us. Disabling optional cookies will not affect core platform functionality.

10. Business Customers and Candidate Data

LevelHire business customers (hiring companies) act as independent data controllers for the candidate data they collect through our platform. LevelHire acts as a data processor (“encargado”) on their behalf. If you are a job candidate who participated in a LevelHire evaluation, your rights regarding that evaluation data should be directed to the company that invited you. We will assist in facilitating such requests upon verified instruction from the business customer.

11. Data Retention (“Conservación de Datos”)

We retain personal data for as long as necessary to fulfill the purposes described in this Policy, subject to legal, accounting, and regulatory obligations:

• Account data: retained while your account is active and for 3 years after closure.
• Candidate evaluation data: retained for 24 months after evaluation completion, or until deletion is requested.
• Financial/billing records: 5 years (as required under Mexican tax law and US regulations).
• Communication logs: 2 years.

After retention periods expire, data is securely deleted or irreversibly anonymized.

12. Data Security (“Medidas de Seguridad”)

We implement appropriate technical and organizational security measures including encryption in transit (TLS 1.2+) and at rest (AES-256), access controls, regular security audits, and employee training. In the event of a personal data breach that affects your rights and freedoms, we will notify you and relevant authorities within the timeframes required by applicable law (72 hours under applicable regulations). Visit our Security page for details.

13. Children’s Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us at privacy@levelhire.ai and we will promptly delete it.

14. Supervisory Authorities

If you are not satisfied with how we handle your privacy request, you have the right to file a complaint with the relevant supervisory authority:

• Mexico: Instituto Nacional de Transparencia, Acceso a la Información y Protección de Datos Personales (INAI) — www.inai.org.mx
• United States (California): California Privacy Protection Agency (CPPA) — cppa.ca.gov

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated policy on this page with a revised “Last updated” date, and where required by law, by sending a direct notice to registered users. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.

16. Contact

For any privacy-related questions, requests, or complaints, please contact us: