Privacy Policy

Hosting HR ("we", "us") collects and processes data to provide an applicant tracking system. This page summarizes the categories of data we collect, why, and your rights.

Data we collect

• Account data: name, email, role, organization affiliation.
• Hiring data: positions, candidates, applications, scorecards, interviews, offers.
• Voluntary EEO self-identification (when invited): aggregate-only, separated from hiring decisions, admin-only access.
• Usage telemetry: pages visited, actions taken (for product improvement).

How we use it

• To run AI matching and screening on positions and applications.
• To produce reports and EEO/OFCCP compliance data for your organization.
• To improve the product (we never use customer data to train external models).

Where your data is hosted

All data is stored and processed in the United States. Our application, web, and mail servers run on infrastructure we operate in Warrenton, Virginia (OVH US). The primary application database runs on managed PostgreSQL (Supabase) in a US region (AWS US West, Oregon). No data is stored outside the United States.

Data sharing

We do not sell personal data. We use the following subprocessors:

• Stripe — card payment processing (US).
• Supabase — application database and authentication (US).
• OVH US — server hosting (Warrenton, Virginia).
• Cloudflare — DNS.
• Sentry — production error monitoring.
• Anthropic — AI-assisted features.
• SAM.gov — public verification.

Email is self-hosted on our own mail servers; we do not use a third-party email provider. Customer data is never used to train external models.

Your rights

You can access, export, correct, or delete your data at any time. Email privacy@hitthosting.com.

Your US state privacy rights

If you live in California, Virginia, Colorado, Connecticut, Texas, Oregon, or another US state with a consumer privacy law, you have the right to know what personal data we hold about you, to request its correction or deletion, and to receive a copy. We do not sell your personal data, and we do not share it for cross-context behavioral advertising. Exercising these rights will not result in worse treatment. To make a request, email privacy@hitthosting.com — we may need to verify your identity first.

Security

We protect your data with the following measures:

• Encryption in transit via TLS/HTTPS.
• Application database encrypted at rest (AES-256).
• PostgreSQL row-level security isolating each organization's data.
• Audit logging of access and changes to sensitive data.
• A web application firewall (ModSecurity) with intrusion detection (CrowdSec).
• Regular vulnerability scanning.
• Restricted administrative access.
• Card payments handled by Stripe (PCI-DSS Level 1); full card numbers are never stored on our systems.
• Regular backups and production error monitoring.

We do not hold SOC 2, ISO 27001, HIPAA, ITAR, FedRAMP, or PCI certification. No method of transmission or storage is 100% secure. Customer data is never used to train external models.

Contact

Privacy questions: privacy@hitthosting.com

By mail: Extant 2000 LLC, 7051 Brookfield Plz, PO Box 41, Springfield, VA 22150, USA