Terms of Service

1. About these terms

These Terms of Service ("Terms") are an agreement between you and Navaneeth CT, an individual based in India, trading as Emploist ("we", "us", or "our"). "You", "your", and "Customer" mean the business or organization that uses Emploist.

Who can use Emploist

• Emploist is for businesses and other organizations that are hiring. It isn't for personal, family, or household use, and we don't offer it to consumers.
• The person who creates your company in Emploist or starts its Plan must be at least 18 years old and have the authority to accept these Terms for the organization. By doing so, that person confirms that both are true.
• Everyone on your team who uses Emploist must be at least 18 years old.

How you accept these Terms

You accept these Terms when you sign in to Emploist, create a company, start a Plan, or otherwise use Emploist. The sign-in and invitation pages tell you that by continuing, you agree to our Terms of Service. If you don't agree, don't use Emploist.

Team members use Emploist on their company's behalf. Each team member must follow these Terms, and the company is responsible for their use.

People who apply for jobs through a careers page don't need an account and aren't bound by these Terms. Our Privacy Policy explains how applicants' data is handled.

What our agreement includes

• these Terms, including the data processing terms in section 13
• our list of subprocessors, which is part of the data processing terms and is published in our Privacy Policy

Our Privacy Policy explains how we handle personal data as a controller, such as your team's account details. Apart from the list of subprocessors, it isn't part of our agreement.

If anything conflicts, the data processing terms win over the rest of these Terms and over the Privacy Policy for anything about personal data in Customer Data. Where the Standard Contractual Clauses apply (see section 13), they win over both. Your purchase from Dodo Payments is also covered by Dodo's own Buyer Terms (see section 5).

Words we use

• "Emploist" or "the service" means the Emploist web app, the careers pages and emails it provides, and our related support.
• "Your company" means the company you set up in Emploist. It holds your jobs, careers page, team, settings, and applications.
• "Team members" means the people who belong to your company in Emploist, including admins and members.
• "Applicants" means people who apply to your jobs through Emploist.
• "Customer Data" means the content you and your team members put into Emploist, such as jobs, careers page content and code, application forms, emails, and comments, and the information applicants submit through it, such as their names, contact details, resumes, and answers, together with the match scores and other records Emploist creates from them.
• "Plan" means your company's Emploist subscription, including its free trial. Your Plan is "active" while it's in its free trial, paid up, or in the grace period after a failed payment.
• "Credits" means the AI credits used to rank applications.

2. Accounts, companies, and roles

Signing in

You sign in with a Google or Microsoft account, or with a one-time code we email to you. Emploist doesn't use passwords, so anyone who controls your email or your Google or Microsoft account can sign in as you. Keep them secure, don't share sign-in codes or invitation links, and don't let anyone else use your account.

Your company

• Each person's account can belong to one company at a time.
• Give accurate information about your company, including its name, and keep it up to date.

Admins and members

Your company has two roles:

• Admins manage billing (starting the Plan, buying credit packs, managing payment details and invoices, and canceling), company settings, the careers page and its address and code, the company-wide switches for AI ranking and for emails to applicants, the reply-to address and email layout, invitations, roles, and removing people. Only admins can delete the company.
• Members work with jobs and applications. They can create, edit, publish, and delete jobs, set up a job's stages and stage emails, and move, comment on, export, and delete applications. They can also rank a job's applications again, which uses Credits.

Admins can change anyone's role and remove anyone, including other admins. Every company must always have at least one admin.

Your responsibility for your team

• You're responsible for everything your team members do in Emploist, and for making sure they follow these Terms.
• Only invite people who need access to help you hire, and choose your admins carefully.
• When someone leaves your organization or no longer needs access, remove them from your company promptly.
• If you think someone has accessed your company without permission, tell us right away at support@emploist.com.

3. The service

What Emploist includes

With your Plan, you can:

• publish jobs on a careers page at yourcompany.emploist.com, or on a subdomain of a domain you own, such as careers.yourcompany.com
• collect applications through forms you design
• rank applications with AI (see section 4)
• move applicants through hiring stages and email them along the way
• comment on applications and mention your teammates
• export applications

Emploist is a software tool. We aren't an employment agency or a recruiter, and we don't make hiring decisions for you.

Changes to the service

We're always improving Emploist, so we may change, add, or remove features. If a change would materially reduce what your Plan includes, we'll email your admins at least 30 days before it takes effect, and you can cancel before then. If we need to make such a change sooner for security or legal reasons, we'll tell you as soon as we reasonably can.

Fair use and technical limits

The price doesn't depend on the size of your team: there are no per-seat fees. We don't limit the number of jobs you can post. Emploist does have reasonable technical limits that keep it fast and reliable for everyone, for example on the number of team members, file sizes, the length of text, and how often requests and applications can be made. We may change these limits. If your use goes far beyond normal use for a hiring team, or puts the service or other customers at risk, we may limit it, and we'll contact you where we can.

Support and availability

We provide support by email at support@emploist.com. Dodo Payments handles questions about payments, invoices, and refunds (see sections 5 and 6). We aim to reply quickly, but we don't promise response times. We work to keep Emploist available and reliable, but we don't offer a service level agreement or guarantee uptime. Emploist may sometimes be unavailable, for example during maintenance or because of problems with our providers or the internet.

4. AI ranking

What it does

When AI ranking is on, Emploist scores each application against the job it's for. It reads the resume and the applicant's answers to your questions, and compares them with the job's title, department, employment type, and description. Skills, experience, seniority fit, and, when the job asks for any degrees, certifications, or licenses, qualifications are each scored, then combined into a match percentage. By default, a job's applications are listed with the best matches first, and your team can see how each part was scored.

What it doesn't do

AI ranking never rejects, advances, moves, or emails anyone by itself. Only your team members move applications between stages. Emails to applicants go out only when an application arrives or when someone on your team moves an application, and only if you've turned on the email for that stage.

Turning it on and off

AI ranking is on by default when a company is created. While your Plan is active, admins can turn it off, or back on, for the whole company in Settings. While it's off, applications aren't sent to our AI provider, match scores are hidden, and new applications aren't ranked. When an admin turns it back on, Emploist asks whether to rank the applications that arrived while it was off, which sends them to our AI provider and uses Credits, or to leave them unranked. If you don't want AI to help review applications, turn it off before you start taking them.

Scores can be wrong

Match scores come from an AI model. They can be inaccurate or incomplete, and they can reflect gaps or bias in the resume, the answers, or your job description. A score isn't a finding about whether someone is qualified, and it isn't legal advice. Some applications can't be scored at all, for example when a resume is a scanned image.

How you must use it

You decide whether and how to use AI ranking, and you're responsible for that decision and for every hiring decision you make. If you use it, you must:

• use match scores only as one input, alongside a real review of the application by people who have the skills and authority to make the decision and to disagree with the score
• never make a decision about an applicant based only on a score, and never treat a low score, or a missing score, as a reason not to review an application
• tell applicants that AI helps review applications whenever AI ranking is on. While it's on, the default careers page shows this notice on job and application pages: "We use AI to help review applications against this job's requirements." It doesn't show it while AI ranking is off, so before you rank applications that arrived then, make sure those applicants were told in another way. If you use your own careers page code, add a notice like it yourself.
• give any other notices, and meet any other requirements, that the law places on you for using AI in hiring. If you rely on scores in a way that makes AI ranking an automated employment decision tool under a law such as New York City's Local Law 144 (for example, by giving scores more weight than your other criteria, or by using them to overrule your team's judgment), you must meet that law's requirements, including bias audits and advance notices to candidates. Other examples include notices in job postings where those are required, and the duties of deployers of high-risk AI systems under the EU AI Act, such as human oversight, informing workers' representatives where the law requires it, and informing the people affected.
• handle applicants' requests about AI, such as requests for an explanation, a human review, or a different process, where the law gives them those rights

You're responsible for complying with the employment, anti-discrimination, data protection, and AI laws that apply to your hiring. This section and the guidance in the app are our instructions for using AI ranking. We don't monitor how you use it.

Uses that aren't allowed

Don't use AI ranking:

• to screen applicants on protected characteristics, such as race, ethnicity, national origin, religion, caste, sex, gender identity, sexual orientation, age, or disability, or on things that stand in for them, such as postal codes or photos. This includes writing job details meant to favor or exclude any such group.
• to monitor, evaluate, promote, discipline, or dismiss employees or other workers, or for anything other than reviewing applications for the job they were submitted to. Reviewing an application that an employee submits for a job is fine.
• to make decisions automatically, or in any process that acts on scores without a person's review
• in a way that misleads anyone about the role of AI, for example by presenting a score as a person's judgment
• in a way that breaks the law or violates applicants' privacy or other rights

Our AI provider

To rank an application, we send the resume text, as it is, including any names and contact details in it, and the applicant's answers (other than phone numbers), together with the job's details, to our AI provider, which is named in our list of subprocessors. We don't use Customer Data to train AI models. Our AI provider's terms say it won't use the data we send to train its AI models without our consent, and we don't give that consent. Its terms also let it keep and use that data in other ways, as described in section 13. We may change our AI provider or the model we use. A new AI provider is a new subprocessor, so we'll give notice of it as described in section 13. Scores already given don't change unless you rank the applications again.

Where AI ranking is available

We may limit or turn off AI ranking in some countries or regions, or for some companies, where the law requires it or where a law would require steps we can't reasonably take. We'll tell affected admins in advance where we can.

5. Plan, free trial, and payments

The Plan

Emploist has one Plan. It costs US$29 a month, plus applicable taxes, billed monthly in advance. It includes everything Emploist offers and 1,000 Credits each billing period. Your Plan renews automatically every month until it's canceled.

Dodo Payments, our merchant of record

Our order process is conducted by our online reseller Dodo Payments ("Dodo"). Dodo is the merchant of record for all our orders. This means you buy your Plan and credit packs from Dodo, which handles checkout, charges your payment method, issues invoices and receipts, collects sales tax and VAT, and handles payment questions and refunds. Dodo's Buyer Terms also apply to your purchase, and these Terms govern your use of Emploist. Your payment details go to Dodo, and we never see your full card number.

Taxes

Prices are in US dollars and don't include taxes. Dodo adds sales tax, VAT, GST, or similar taxes where they apply, and shows them at checkout.

Free trial

• Your first Plan can start with a free trial of 14 days, which includes 100 Credits.
• You add a payment card at checkout, and you aren't charged during the trial. When the trial ends, Dodo charges the first monthly payment, unless you've canceled before then (see section 6).
• If you cancel during the trial, Emploist keeps working until the trial ends, and then your Plan ends.
• Each company, and each person, can have only one free trial. Don't create new accounts or companies, or ask others to, to get another trial.

AI credits

• Your Plan includes 1,000 Credits each billing period. They're added when the payment for that period succeeds.
• Plan Credits don't carry over. When a new period's Credits are added, any Credits left from the previous period or the trial expire.
• Ranking one application successfully uses one Credit. If ranking fails or a resume can't be read, no Credit is used.
• Ranking an application again uses another Credit, for example when you change a job's details and choose to rank its applications again.
• If you run out of Credits, applications still arrive. They wait until an admin chooses to rank them, which uses Credits, or to skip ranking them.
• Credits can only be used while your Plan is active. They have no cash value, can't be transferred or sold, and aren't refundable, except where the law requires.

Credit packs

Admins can buy extra Credits in packs, plus applicable taxes:

• 1,000 Credits for US$9
• 5,000 Credits for US$39
• 10,000 Credits for US$69

• Pack Credits never expire, but they can only be bought and used while your Plan is active. If your Plan ends, unused pack Credits are kept, and you can use them again once your Plan is active again.
• Your Plan's Credits are used before your pack Credits.
• Unused pack Credits are lost if your company is deleted, including if we delete it after 12 months without an active Plan (see section 14).
• If a pack is refunded, in full or in part, its remaining Credits are removed. Credits already used aren't affected.
• Pack prices may change, but changes don't affect packs you've already bought.

Failed payments

If a payment fails, Emploist keeps working for a short grace period, and the Billing page shows when it ends. If the payment still hasn't gone through by then, your company becomes read-only (see section 6) until an admin updates the payment method in Dodo's customer portal. Dodo may also cancel your Plan if it can't collect payment.

Chargebacks

Chargebacks and other billing disputes are handled by Dodo under its Buyer Terms, which ask you to contact Dodo before you raise a dispute with your bank or card issuer. While a charge is disputed, we may suspend your company.

Price changes

The Plan's price may change. We'll email your admins at least 30 days before a price increase applies to your existing Plan. The new price applies from your first billing period that starts after those 30 days. If you don't want to pay it, cancel before then. Dodo may also tell you about the change and, where the law requires, ask for your consent.

6. Refunds and cancellation

Canceling your Plan

• An admin can cancel anytime from the Billing page in Emploist, which opens Dodo's customer portal. If that doesn't work for you, email us at support@emploist.com and we'll help.
• Cancel before your free trial or billing period ends, and you won't be charged again. Your Plan keeps working until then, and an admin can undo the cancellation before it ends.

Refunds

• Payments are non-refundable, except where the law requires a refund, or if we stop offering Emploist (see section 14). Otherwise, there are no refunds or credits for partial billing periods, unused time, unused Credits, or credit packs.
• If you believe the law entitles you to a refund, email us at support@emploist.com. Refunds are only ever paid by Dodo, to the original payment method. Dodo's Buyer Terms say that refunds are at Dodo's discretion and that there are no refunds for unused subscription periods.
• If you're registered for sales tax, VAT, or GST and were charged it, you may be able to claim it back from Dodo. Dodo's Buyer Terms require you to contact Dodo within 60 days of the purchase.

Deleting your company

An admin can delete your company at any time in Settings. If you're the only person in your company and you delete your own account, your company is deleted too, in the same way. Deleting it:

• cancels your Plan immediately, with no refund for the rest of the billing period or the trial
• permanently deletes your company's data, including its jobs, applications, resumes, and unused pack Credits, as described in section 13
• can't be undone, so export anything you need first

After your Plan ends

When your Plan ends, or when the grace period after a failed payment ends without payment, your company becomes read-only. A company that hasn't started a Plan is read-only in the same way. While your company is read-only:

• your team can still sign in, see everything, and export applications
• team members can still leave the company or delete their own account
• admins can start or restart the Plan (or, if a payment failed, update the payment method), remove team members, cancel invitations, and delete the company
• you can't make other changes, such as deleting individual applications or jobs, closing jobs, turning AI ranking on or off, changing the reply-to address, or removing a custom domain. If you need an application or job deleted, for example to answer an applicant's request, email us and we'll delete it.
• your careers page stays online and keeps listing your open jobs, but it stops taking applications
• Credits can't be used, so nothing is ranked

We keep your company's data until you delete it, except as described in section 14.

7. Your content and applicants' data

Customer Data is yours

You keep all your rights in Customer Data, including your jobs, careers page, forms, emails, and comments, and the applicant data you collect. We don't claim ownership of any of it.

What you allow us to do

You give us a worldwide, non-exclusive, royalty-free license to host, store, copy, process, transmit, display, and publish Customer Data, only as needed to provide, secure, and support Emploist as described in these Terms, including finding and fixing problems, and including through our subprocessors. This lets us, for example, publish your jobs on your careers page, send your emails to applicants, and rank applications while AI ranking is on. The license ends when the Customer Data is deleted.

What we don't do

We don't sell Customer Data, use it for advertising, or use it to train AI models. We only look at Customer Data when we need to provide, support, or secure Emploist, when you ask us to, or when the law requires it.

Your responsibilities for applicants' data

You decide what applicant data to collect and how to use it. You must:

• have a lawful basis, and any consents the law requires (such as a parent's consent for applicants under 18, where needed), for collecting and using applicants' data in Emploist, including for AI ranking and for our processing described in section 13
• give applicants your own privacy notice that covers your use of Emploist, including AI ranking while it's on, at or before the time they apply. The default careers page doesn't include one, so add it yourself, for example in your job descriptions, as text or a checkbox on your application form, or in your careers page code.
• keep the AI notice described in section 4 whenever AI ranking is on, including if you use your own careers page code
• only ask questions you're allowed to ask, and not ask for sensitive information, such as about health, religion, ethnic origin, or criminal records, unless the law allows it
• respond to applicants who ask to see, correct, or delete their data, or who use their other rights. We'll help as described in section 13.
• decide how long to keep applicants' data, and delete it when you no longer need it. Emploist doesn't delete applications automatically.
• make sure what you publish and send, such as jobs, careers pages, and emails to applicants, is accurate and lawful

We don't check whether you meet these responsibilities.

Emails to applicants

You decide which stages send emails and what they say. We send them from our email address, with your company's name as the sender name. Replies go to the reply-to address an admin sets, so use an address you control. If you haven't set one, replies can't be delivered, and we don't receive them. Only use these emails for messages about the applicant's application, not for marketing.

Exporting your data

Any team member can export a job's applications at any time, including while your company is read-only. The export is a spreadsheet (CSV file) with each applicant's details, stage, and answers, along with their resumes. It doesn't include match scores, comments, or activity. If you need the match scores, their breakdown, or comments, email us and we'll send them.

Content we may remove

We don't monitor Customer Data. But if we learn that content breaks these Terms or the law, or a court or authority orders us to act, we may remove it or disable access to it, for example by unpublishing a job or turning off careers page code. We'll tell you when we do, unless the law doesn't allow it or there's an urgent risk.

8. Acceptable use

These rules apply to you and everyone on your team. If they're broken, we may remove content, suspend your company, or end these Terms, as described in sections 7 and 14.

Hiring

Don't:

• post fake, misleading, or scam jobs, or jobs used to collect personal data or to recruit people into schemes that take their money
• charge applicants any fee to apply or to be hired
• publish job ads, criteria, or questions that discriminate unlawfully, for example on the basis of race, ethnicity, national origin, religion, caste, sex, gender identity, sexual orientation, age, disability, or marital status
• collect personal data you have no right to collect, or ask for sensitive information the law doesn't allow you to ask for
• impersonate another company or person, or mislead people about who you are, including through your company name, careers page address, email sender name, or reply-to address
• send spam, marketing, or any unlawful email through Emploist
• create new accounts or companies to get another free trial

Content

Don't put anything in Emploist that:

• you don't have the right to use, or that infringes anyone's copyright, trademark, or other rights
• is obscene, pornographic, or sexually explicit, or harms or exploits children in any way
• is defamatory, harassing, threatening, or hateful, insults anyone on the basis of gender, is racially or ethnically objectionable, or promotes hostility between groups on the basis of religion or caste
• invades anyone's privacy, including their bodily privacy
• promotes money laundering, gambling, or any other illegal activity
• misleads people about where a message comes from, or knowingly spreads false or misleading information
• threatens the unity, integrity, defense, security, or sovereignty of India, India's friendly relations with other countries, or public order, incites any offense, gets in the way of investigating any offense, or insults any other nation
• contains viruses, malware, or other harmful code
• breaks any law

The service

Don't:

• access other companies' data, probe or test our security, or get around any security measure or limit, unless we've agreed to it in writing
• overload or disrupt Emploist, or access it with bots, scrapers, or other automated tools, except through the features we provide
• copy, decompile, or reverse engineer Emploist, except where the law allows it despite this rule
• resell, sublicense, or white-label Emploist, or offer it to others as a service. Using Emploist to hire on behalf of your clients is fine.
• use Emploist, or non-public information about it, to build or help build a competing product, or copy Emploist's software or design, except as section 9 allows
• use Emploist in breach of sanctions or export control laws, including from a country or region under comprehensive sanctions
• use Emploist in a way that would make us break the acceptable use rules of our AI provider or of our other subprocessors, for example by discriminating against people, violating their privacy, or misleading people about AI output
• help or encourage anyone else to do any of these things

9. Careers pages, domains, and code

Careers page addresses

• Your careers page is at a subdomain of emploist.com that you choose, such as yourcompany.emploist.com. Subdomains are first come, first served, and some names are reserved.
• We may refuse or take back a subdomain that impersonates someone, infringes someone's rights, or is misleading.
• If you change your subdomain, the old one stops working at once, and anyone else can take it.

Custom domains

Admins can connect a subdomain of a domain you own, such as careers.yourcompany.com. If you do:

• you confirm that you own or control the domain and have the right to use it
• you authorize us and our providers to get and renew TLS certificates for it, so your careers page works over HTTPS
• you're responsible for its DNS records. Keep the records we ask for in place, and remove the domain from Emploist before you stop controlling it. You can only remove it while your Plan is active.

Your own code

Admins can write their own careers page code and email layouts. You're responsible for that code and what it does, including:

• its security, accessibility, and legality
• having licenses for any fonts, images, and other material it uses
• any resources it loads from other websites, such as fonts, images, or styles, and any trackers. Loading them can share visitors' IP addresses and other information with those websites, and you're responsible for any notice or consent this requires.
• including the notices you must show, such as the AI notice and your privacy notice

Your code runs in a restricted environment. Scripts don't run on careers pages, and some other things may be blocked. If your code fails on a live careers page, visitors see our default design instead. If an email layout fails, we use our default layout. We may disable code that we reasonably believe is harmful, insecure, or against these Terms.

Our default code and the preview kit

We own the default careers page code and the downloadable preview kit. While these Terms are in effect, we give you a limited, non-exclusive, non-transferable, revocable license to use, copy, and modify them, only to build and preview your company's careers page on Emploist. Don't use them for anything else, and don't share them except with people helping you build your careers page. Open-source components included in them keep their own licenses, which apply to those components. You own the changes you make, and we keep our rights in the code you started from.

10. Third-party services

Emploist relies on services run by other companies, including:

• Google and Microsoft, if you sign in with them
• Dodo Payments, which sells our Plan and credit packs (section 5)
• our subprocessors, which help us run Emploist (section 13)

Their own terms and privacy policies may apply when you use them, for example when you sign in with Google or pay through Dodo. We aren't responsible for third-party services you choose to use with Emploist, such as your domain provider, your email inbox, or websites your code loads resources from.

Microsoft and Google aren't parties to these Terms. To the extent permitted by law, all warranties and all liability on their behalf are disclaimed, both for Emploist and for signing in to it with their accounts.

11. Our intellectual property

We own Emploist, including its software, design, default careers page code, documentation, and the Emploist name and logo. These Terms give you the right to use Emploist as they describe, and no other rights. We keep all rights we don't expressly give you.

Feedback

If you send us ideas or feedback, we may use them freely, without any obligation to you.

Publicity

We won't use your name, logo, or trademarks to promote Emploist without your permission.

12. Confidentiality

"Confidential Information" means non-public information that one of us shares with the other in connection with Emploist, and that is marked as confidential or should reasonably be understood to be confidential. Customer Data is your Confidential Information. Non-public information about Emploist's security and systems is ours.

Whoever receives Confidential Information will:

• use it only to exercise their rights and meet their obligations under these Terms
• protect it with at least reasonable care
• share it only with people and service providers who need it for that purpose and are bound by confidentiality duties

This doesn't apply to information that becomes public through no fault of the recipient, that the recipient already knew or developed independently, or that the recipient received lawfully from someone else without a duty of confidentiality. Either of us may disclose Confidential Information when the law or a court requires it, after telling the other where the law allows. These duties last for as long as the information stays confidential. Section 13 also applies to personal data in Customer Data, including how our subprocessors may use it.

13. Privacy and data processing

This section is our data processing agreement. It applies whenever we process personal data in Customer Data on your behalf. It's designed to meet the requirements for contracts with processors under the EU and UK General Data Protection Regulation (GDPR), and to work in the same way under other data protection laws.

Words such as "controller", "processor", "personal data", "processing", "data subject", and "personal data breach" have the meanings given in the GDPR, or the closest equivalents in other data protection laws. "Data protection laws" means all data protection and privacy laws that apply to the processing of Customer Data.

Our roles

• For personal data in Customer Data, you're the controller (called the "business" or "data fiduciary" in some laws), and we're your processor (called the "service provider" or "data processor" in some laws).
• If you're a processor yourself, for example a recruitment agency hiring for a client, we're your subprocessor. You confirm that your controller has authorized our processing, including our use of subprocessors, and you'll pass on any information or instructions between us and your controller.
• We're a controller for the personal data we collect to run our business, such as your team members' sign-in and account details, the invitations we send, billing contacts, support emails, security logs, and visits to our website. Our Privacy Policy covers that data.

Details of the processing

Following your instructions

We process Customer Data only on your documented instructions, including about transferring it to other countries. Your instructions are these Terms, your use of Emploist, and the settings you and your team choose, such as turning AI ranking or stage emails on or off. They include transferring Customer Data to the places and subprocessors described in this section. You may give us further instructions in writing. If one would need work outside the normal service, we'll agree with you how to handle it.

We'll process Customer Data in other ways only where EU or Member State law requires it, or UK law for data covered by the UK GDPR, or another data protection law that applies to us. If so, we'll tell you about that requirement before we process the data, unless that law forbids telling you on important grounds of public interest.

We'll tell you immediately if we think an instruction infringes data protection laws, and we don't have to follow it. You're responsible for making sure that your instructions, and your use of Emploist, comply with data protection laws.

People who handle Customer Data

Anyone we authorize to process Customer Data is bound by a duty of confidentiality. Access is limited to people who need it to provide, support, or secure Emploist.

Security

We take appropriate technical and organizational measures to protect Customer Data, taking into account the nature of the data and the risks. They include:

• Access control. Every request for a company's data in the app is checked against the signed-in person's company, and admin-only actions are checked separately. Resumes are kept in private storage and are only served to team members of the company that received them.
• Sign-in. There are no passwords to steal. One-time sign-in codes are stored hashed, expire after a few minutes, and allow only a few attempts. Invitation links are random and stored only as a hash.
• Encryption. The app and careers pages are served over HTTPS, and stored data is encrypted at rest.
• Backups. We back up Customer Data regularly, and we can restore it from those backups.
• Browser protections. We use strict security headers and content security policies. Careers pages run in a sandbox, without scripts.
• Untrusted content. Customer code for careers pages and email layouts runs in worker threads with time and memory limits. Uploaded files are checked by their contents and size, and resumes are read in worker threads with time and memory limits. Rich text, email layouts, and SVG logos are sanitized.
• Abuse prevention. Rate limits apply to the app, careers pages, and applications, and application forms have a spam trap.
• Logging. Sign-in credentials, cookies, and secret links are kept out of our logs.
• Payments. Card details are handled by Dodo, and we never receive them.
• Incident response. We have a process for investigating and containing security incidents, and for telling you about personal data breaches as described below.
• Our practices. Access to production systems is limited to people who need it, and we review these measures as Emploist and the risks change.

We may update these measures, as long as we don't reduce the overall protection of Customer Data. You're responsible for your own security, such as protecting your team's sign-in methods and the data you export.

Subprocessors

• You give us general authorization to use subprocessors to process Customer Data. Our current subprocessors are shown in our list of subprocessors, with what each one does, the data it receives, and where it processes it.
• We put written data protection terms in place with each subprocessor, as data protection laws require. We remain responsible to you for our subprocessors' processing of Customer Data.
• Our AI provider's published terms say it won't use the data we send to train its AI models without our consent, and we don't give that consent. They also let it keep and use that data to monitor for fraud and abuse, to comply with the law, and to derive service telemetry, such as technical logs, statistics, classifications, and learnings about how its service is used, which it may use without restriction, including to improve its services. They don't set a fixed period for keeping the data. By using AI ranking, you authorize this processing. You can turn AI ranking off, and then nothing is sent to our AI provider.
• At least 30 days before we add or replace a subprocessor on our list, we'll update the list and email your admins. Our subprocessors use their own providers, which they may change with shorter notice. For those, we rely on the notice our subprocessors give us.
• You can object to a change to our list on reasonable data protection grounds by emailing us before it takes effect. We'll work with you in good faith to resolve your concern. If we can't, you may cancel your Plan, and you won't be charged again. If you don't want your Customer Data to reach the new subprocessor at all, you can also export it and delete your company before the change takes effect. If the change is to our AI provider, you can instead turn off AI ranking, and applications won't be sent to it.
• You can ask us for more information about our subprocessors, including the data protection terms we have with them. We may remove commercial information first.

International transfers

Our cloud hosting provider stores Customer Data in the European Union. We access it from India, where we're based, and some subprocessors process it outside the European Union, including in the United States. Data protection laws treat this as a transfer, and we protect it as follows.

• EU Standard Contractual Clauses. Where the EU GDPR applies to a transfer of Customer Data from you to us, the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914 of 4 June 2021 (the "SCCs") are incorporated into these Terms. Module 2 (controller to processor) applies where you're a controller, and Module 3 (processor to processor) applies where you're a processor. You're the data exporter and we're the data importer. Accepting these Terms counts as signing the SCCs and their Annexes.
• UK. Where the UK GDPR applies, the SCCs apply as amended by the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses, version B1.0, issued by the UK Information Commissioner (the "UK Addendum"). The UK Addendum's tables are completed with the information in this section: Table 1 from the parties' details below, Table 2 from the SCC modules and options below, and Table 3 from the Annexes below. For Table 4, neither party may end the UK Addendum under its Section 19.
• Switzerland. Where the Swiss Federal Act on Data Protection applies, the SCCs apply with these changes: references to the GDPR mean that Act, the Swiss Federal Data Protection and Information Commissioner is the competent supervisory authority for those transfers, and the term "Member State" doesn't stop data subjects in Switzerland from bringing claims where they normally live.
• Our subprocessors. When a subprocessor in a country without an adequacy decision processes Customer Data, we use the SCCs or another transfer mechanism that data protection laws recognize.
• Other laws. If another data protection law requires a transfer mechanism, we'll work with you in good faith to put one in place.

For the SCCs:

• Clause 7 (docking clause) applies.
• Under Clause 9(a), Option 2 (general written authorization) applies, and the notice period for adding or replacing subprocessors is 30 days.
• The optional language in Clause 11(a) doesn't apply.
• Under Clause 13 and Annex I.C, the competent supervisory authority is the one determined by Clause 13(a). Where that depends on where data subjects are, it's the supervisory authority of the EU Member State where most of the data subjects whose data is transferred are located.
• Under Clause 17, Option 1 applies, and the governing law is the law of Ireland.
• Under Clause 18(b), disputes are resolved by the courts of Ireland.
• Annex I.A (the parties): the data exporter is you, as a controller (Module 2) or a processor (Module 3), with the details and contacts in your Emploist account, using Emploist to hire. The data importer is Navaneeth CT, trading as Emploist, based in India, as your processor or subprocessor, providing Emploist to you. The importer's contact person is Navaneeth CT, reachable at support@emploist.com.
• Annex I.B (description of the transfer) is the "Details of the processing" table above.
• Annex II (security measures) is the "Security" list above.
• Annex III (subprocessors) is our list of subprocessors.
• Audits and certifications of deletion under the SCCs are carried out as described in this section, as far as the SCCs allow.

If anything in these Terms conflicts with the SCCs or the UK Addendum, they prevail. Data subjects can enforce their rights under the SCCs as third-party beneficiaries. If a public authority asks us for Customer Data, we'll tell you unless the law forbids it, and we'll disclose only what we're legally required to.

Helping you meet your obligations

• Data subject requests. You can handle most requests yourself in Emploist by viewing, exporting, or deleting applications. For the rest, email us and we'll help. For example, we'll correct applicant details, which can't be edited in Emploist, delete individual applications or jobs while your company is read-only, and send you match scores, their breakdown, and comments, which aren't in the export. If an applicant or another data subject contacts us about Customer Data, we'll pass the request on to you without undue delay. We won't respond to it ourselves, except to say we've passed it on, unless the law requires us to.
• Assessments and authorities. We'll give you reasonable help with data protection impact assessments, and with any consultation with a supervisory authority, taking into account the nature of the processing and the information available to us. This includes information about how AI ranking works.
• Costs. This help is free when it takes reasonable effort. If a request would need significant work, we'll tell you first and agree with you how to handle it.

Personal data breaches

If we become aware of a personal data breach affecting Customer Data, we'll notify your admins without undue delay, and within 72 hours of becoming aware of it. We'll include the information we have at the time, such as what happened, the data and people likely to be affected, the likely consequences, and what we're doing about it, and we'll send more as we learn it. We'll take reasonable steps to contain the breach and reduce its effects, and help you meet your own duties to notify authorities and the people affected. Telling you about a breach isn't an admission of fault.

Deleting and returning Customer Data

• While your Plan is active, you can delete individual applications and jobs in Emploist. While your company is read-only, email us and we'll delete them. Admins can delete your whole company at any time.
• When your Plan ends, Customer Data stays available, read-only, so you can view and export it, until you delete your company or we delete it as described in section 14.
• The export doesn't include match scores or comments. If you need them, email us before you delete your company and we'll send them.

When an application, job, or company is deleted, we delete it from our active systems, except that:

• a notification that a team member has already read keeps the applicant's name and the job title until that team member's account, or your company, is deleted
• copies in our backups and logs are removed over time as they're deleted or overwritten, and stay protected by these Terms until then
• rarely, if deleting a stored file fails, the file can remain until we remove it. We'll remove it when we find it or when you ask.
• data already sent to our subprocessors is kept and deleted under their terms, as described in this section

If you ask, we'll confirm in writing what we've deleted, and which of these exceptions still apply.

Information and audits

• We'll make available the information reasonably needed to show that we comply with this section, and answer reasonable security and privacy questionnaires.
• Where that isn't enough to meet a requirement of data protection laws, or a supervisory authority requires it, you or an independent auditor you appoint may audit our compliance with this section. Audits are limited to once a year, need reasonable advance notice, are at your cost, must not disrupt our business or expose other customers' data, and are confidential. These limits apply only as far as data protection laws and the SCCs allow.

US state privacy laws

Where the California Consumer Privacy Act or another US state privacy law applies, we're your service provider (or contractor or processor) for Customer Data. You disclose Customer Data to us only for these business purposes:

• hosting, storing, and displaying it in Emploist
• publishing your careers pages and collecting applications
• ranking applications with AI while AI ranking is on
• sending your emails to applicants
• exporting and deleting it when you ask
• keeping Emploist secure, finding and fixing problems, and providing support

We won't:

• sell or share it, as those laws define those words
• keep, use, or disclose it for any purpose, including any commercial purpose, other than those business purposes, or as those laws otherwise allow
• keep, use, or disclose it outside our direct business relationship with you
• combine it with personal information we get from others or collect ourselves, except as those laws allow

We'll meet the obligations those laws place on service providers and give Customer Data the level of privacy protection they require. We'll tell you if we decide we can no longer meet them, and you may then take reasonable steps to stop and fix any unauthorized use. You may also take reasonable steps to make sure we use Customer Data in line with your obligations under those laws. We'll help you respond to consumer requests as described above. If a consumer request needs us to act, and you can't act on it yourself in Emploist, tell us and give us the information we need. We certify that we understand these restrictions and will comply with them.

India

Where India's Digital Personal Data Protection Act, 2023 applies to Customer Data, you're the data fiduciary and we're your data processor. We'll process Customer Data only under these Terms, protect it with reasonable security safeguards, tell you about personal data breaches as described above, help you respond to requests from the people the data is about, and erase it as described above.

14. Suspension and termination

If you want to stop

You can stop using Emploist at any time. Cancel your Plan to stop future charges (see section 6), and delete your company if you want its data deleted. These Terms end when your company is deleted. Team members can delete their own account in Settings. If you aren't in any company, email us and we'll delete your account.

Suspension

We may suspend your company's access to Emploist, or to part of it, if:

• a payment fails and isn't fixed, in which case your company becomes read-only as described in section 6
• a charge is disputed with your bank or card issuer
• you or your team members seriously or repeatedly break these Terms
• your use creates a security risk, or could harm Emploist, other customers, applicants, or anyone else
• the law, a court, or an authority requires it

We'll tell you in advance where that's reasonable. We'll limit a suspension to what's needed, and lift it once the problem is fixed.

Termination for breach

We may end these Terms and close your company if you materially breach them and don't fix the breach within 30 days of our notice. We may do it straight away if the breach can't be fixed or is serious, such as fraud, scam jobs, illegal content, or an attack on our security. If we do, we'll give your admins at least 30 days to export Customer Data before we delete it, unless the law or a serious risk prevents it. There's no refund, except where the law requires one.

If we stop offering Emploist

We may stop offering Emploist. If we do, we'll email your admins at least 30 days in advance, so you have time to export your data. Unless we've ended these Terms because of your breach, we'll arrange through Dodo a refund of the unused part of your current billing period.

Data after your Plan ends

When your Plan ends, your company becomes read-only and we keep its data, so you can view and export it, or subscribe again. We keep it until you delete your company. But if your company has had no active Plan for 12 months in a row, we may delete it and all its data. We'll email your admins at least 30 days before we do.

What continues after these Terms end

Any part of these Terms that by its nature should continue after they end will continue. This includes amounts you owe for your Plan and credit packs, the data processing terms for as long as we hold Customer Data, confidentiality, our intellectual property, disclaimers, limitation of liability, indemnity, governing law and disputes, and the general terms.

15. Disclaimers

Except as these Terms expressly say, including in section 13, and to the extent permitted by law, Emploist is provided "as is" and "as available", without warranties of any kind, whether express, implied, or statutory. This includes any warranties of merchantability, fitness for a particular purpose, title, non-infringement, and accuracy, and any warranty that Emploist will be uninterrupted, secure, or free of errors.

In particular, we don't promise:

• that match scores or any other AI output will be accurate, complete, or free of bias
• any hiring result, such as a number of applications or finding the right person
• that your use of Emploist will meet the legal requirements that apply to you, including employment, anti-discrimination, data protection, and AI laws

Our guides and the text in the app aren't legal advice.

16. Limitation of liability

To the extent permitted by law:

• Neither of us will be liable to the other for any indirect, incidental, special, consequential, or punitive damages, or for any loss of profits, revenue, business, goodwill, or data, or the cost of replacement services, even if told they were possible.
• Our total liability for all claims arising out of or relating to these Terms or Emploist, on any legal theory, is limited to the total amount you paid for Emploist, through Dodo, in the 12 months before the claim arose, not counting taxes.

These limits don't apply to liability that the law doesn't allow to be limited or excluded, such as liability for fraud. The first point doesn't limit what you owe for your Plan and credit packs, your obligations under section 17, or your liability for breaking section 8 or infringing our intellectual property. Nothing in these Terms limits data subjects' rights under data protection laws or the SCCs, or any liability under the SCCs that the SCCs don't allow to be limited.

17. Indemnity

To the extent permitted by law, you'll defend us against any claim, demand, or proceeding brought by a third party, such as an applicant, a team member, or an authority, and pay any resulting damages, fines, penalties, settlements, costs, and reasonable legal fees, to the extent it arises out of:

• Customer Data and any other content you or your team members put into or publish through Emploist, including your careers pages and emails
• your hiring decisions
• a breach of these Terms or of any law by you or your team members, including employment, anti-discrimination, data protection, and AI laws
• code you or your team members add to Emploist

This doesn't apply to the extent the claim is caused by our breach of these Terms or the law, by our negligence, or by the way Emploist works when you use it as these Terms allow. Nothing in these Terms requires either of us to indemnify, defend, or hold harmless the other against liability arising from the other's own acts or omissions in violation of anti-discrimination law, to the extent the law doesn't allow such a term.

We'll tell you promptly about any claim, let you control its defense, and give you reasonable help at your cost. We may take part in the defense with our own lawyers, at our own cost, and we'll keep control of any matter with an authority about our own obligations. You won't settle a claim in a way that admits fault on our behalf or puts obligations on us without our written consent.

18. Changes to these terms

• We may update these Terms. When we do, we'll post the new version here and update the date at the top.
• For material changes, we'll email your admins at least 30 days before they take effect. If you don't agree, you can cancel your Plan or delete your company before then. If you keep using Emploist after the changes take effect, you accept them.
• Other changes, such as clarifications or terms for new features, take effect when we post them.
• Changes won't reduce the overall protection that the data processing terms in section 13 give Customer Data, unless the law requires the change. We can't change the SCCs or the UK Addendum ourselves.

19. Governing law and disputes

• These Terms, and any dispute arising out of or relating to them or Emploist, are governed by the laws of India, without regard to conflict of laws rules.
• Before starting legal proceedings, email us at support@emploist.com with the details of the dispute. We'll both try in good faith to resolve it informally within 30 days.
• If we can't, the courts at Kozhikode, Kerala, India have exclusive jurisdiction, and we both agree to their jurisdiction.
• Either of us may still ask any court for urgent relief, such as an order to protect intellectual property or confidential information.
• This section doesn't take away rights that the law doesn't allow a contract to remove. Disputes under the SCCs are governed by the law and courts the SCCs specify.

20. General

• Entire agreement. These Terms, including the data processing terms and our list of subprocessors, are the entire agreement between you and us about Emploist, and replace any earlier agreements about it. Terms in your purchase orders or other documents don't apply. Your purchase from Dodo is also covered by Dodo's Buyer Terms.
• Transfer. You can't transfer these Terms to anyone else without our written consent. We may transfer these Terms, with all our rights and obligations under them, to a successor that takes over Emploist, such as a company Navaneeth CT sets up to run it, or a buyer, and you agree to that now. We'll tell your admins before the transfer takes effect. The successor will be bound by these Terms, including the data processing terms and the SCCs. If you object, you can cancel your Plan.
• Events beyond our control. Neither of us is responsible for delays or failures caused by events beyond reasonable control, such as natural disasters, war, civil unrest, government action, epidemics, power or internet failures, or failures of our providers. This doesn't excuse paying for your Plan and credit packs, or our responsibility for our subprocessors under section 13.
• Notices. We send notices to your admins' email addresses, and may also show them in Emploist, so keep your admins' addresses up to date. Send notices to us at support@emploist.com. An email notice counts as received when it's sent, unless the sender gets a delivery failure.
• Severability. If any part of these Terms can't be enforced, it will be enforced as far as possible, and the rest of these Terms still apply.
• No waiver. If either of us doesn't enforce a part of these Terms, that doesn't give up the right to do so later.
• Independent parties. We're independent of each other. These Terms don't create a partnership, joint venture, employment, or agency relationship.
• Third parties. Nobody else has rights under these Terms, except data subjects' rights under the SCCs.
• Sanctions and export control. You confirm that you aren't located or organized in a country or region under comprehensive sanctions, and that you and your team members aren't named on a sanctions list. You'll comply with the sanctions and export control laws that apply to you, to us, or to our providers.
• Language. These Terms are written in English. If we provide a translation, the English version controls.
• Interpretation. "Including" and "for example" mean "including without limitation". Headings and the summary at the top are for convenience only.

21. Contact

Questions about these Terms, notices, or complaints? Email us at support@emploist.com.

Emploist is operated by Navaneeth CT, an individual based in India, trading as Emploist. Our Grievance Officer is Navaneeth CT, reachable at support@emploist.com. We'll acknowledge a grievance within 24 hours and resolve it within 15 days of receiving it.