Privacy Policy
Candidate Collective Inc. is committed to protecting your personal data and ensuring transparent privacy practices.
Google API User Data & Limited Use Notice
Candidate Collective's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We never sell your Google user data or contact lists, nor do we use it for advertising.
We at Candidate Collective Inc. (“Candidate Collective”, “we,” “us,” or “our”) created this privacy policy (“Privacy Policy”) because we know that you care about how the information you provide is used and shared and to be transparent about our data privacy and security practices.
This Privacy Policy describes how we collect, use, protect and disclose your Personal Information in connection with your use of our websites, including, without limitation, https://www.candidatecollective.com/, along with the features, functionalities, applications, browser extensions and other services available through our website or via subscription (collectively, our “Website”), your use of our products and services (collectively, our “Services”), and Personal Information we obtain from any third party site connected to our Websites or Services including, without limitation, LinkedIn and Google (collectively, “Third Party Sites”). We collectively refer to our Websites, Services, and Third-Party Sites as our “Platform.”
This Privacy Policy only applies to our practices—it does not apply to the practices of third parties, including some users on our websites and applications.
By continuing to use our Services and Platform, you acknowledge that you accept our Terms and Conditions and have read and understand this Privacy Policy. When you visit our Website, provide us with information by means of using our Platform, or participate in our Services, you consent to our collection, use, and disclosure of your Personal Information as described in this Privacy Policy. Please read this Privacy Policy carefully. If you do not want us to collect, use or disclose your Personal Information in the ways described in this Policy, please do not use our Platform, provide us with your Personal Information or authorize a third party to make your Personal Information available to us.
1. Information We Collect
Personal Information
We do not collect any Personal Information from you unless you voluntarily provide it to us. When you sign up to become a user of the Website or participate in our Services (a “User”), you will be asked to provide us with certain Personal Information, such as:
- Identifiers and Contact Information: name, email address, telephone number, postal address, physical address, social security number, date of birth, online identifier, IP address and other similar information.
- Demographic Information: age, national origin, and other similar information.
- Internet and Network Activity: browsing history, search history, interactions with online portions of our Platform and advertisements.
- Information from Third Party Services (including Google):
- If you register or visit the Site through Facebook Connect or another social media website, you authorize Candidate Collective to collect, store, and use information agreed through its API. We do not receive or store passwords for your social media accounts.
- Specific Google User Data Accessed: If you sign in through Google and consent to the requested permissions, you authorize Candidate Collective to collect, store, and use specific data obtained through Google's API, including your Google profile information (first name, last name, email address, profile picture, and location).
- Google Contacts: Furthermore, to provide specific community features of our Service, we request access to your Google Contacts when explicitly initiated by you. If granted, we access only the following fields from your contact list: First Name, Last Name, and Email Address.
- Education and Skills: academic performance, education history, degrees, languages, training history, resume.
- Professional or Employment-Related Information: job history, professional experience, employment information, affiliations, union membership, certifications.
- Online Identifiers: username, social media handles, and other similar identifiers.
- Communication Information: information contained in voicemails, chats, emails, and reach-outs.
- Location Information: where you live or are located.
- Other information: information you directly provide us or authorize us to collect.
Usage Information
Like most websites, we use automatic data collection technology when you visit the Site to record information that identifies your computer, to track your use of our Site, and to collect certain basic information about you and your surfing habits (the “Usage Information”). We collect this Usage Information by using cookies and pixel tags.
2. How We Collect Your Information
A large portion of the Personal Information we collect is collected directly from you when you engage with us, request information, create an account, communicate with us, or interact on the Platform.
We may also collect information from Third Party Sources when:
- You access, use, or interact with our Platform through Third Party Sites;
- You use single sign-on tools (such as Google Sign-In). When you use these features, we gather the data necessary to create and manage an account on our Platform from the applicable Third Party Single Sign-On Provider.
3. How We Use Your Information (General)
We may use your Personal Information and Usage Information in a manner consistent with this Privacy Policy and the context of our relationship with you for purposes including:
- Identifying you when you sign in to your account and validating your identity;
- Responding to your requests and providing you with the Services;
- Carrying out our obligations and enforcing our rights arising from any contracts entered into;
- Sending you emails to provide you with alerts, notifications, and updates about your engagement with our Platform;
- Enhancing and improving the Site and Services, including personalized community features;
- Analyzing usage of the Platform to improve our experience and content;
- Investigating, preventing, or taking action regarding illegal activities, suspected fraud, or situations involving potential threats to physical safety.
4. Specific Use of Google User Data
Notwithstanding the general uses outlined above, we use specific Google User Data accessed via Google OAuth scopes strictly for the following limited purposes:
- Connection Recommendations: We process the required fields from your Google Contacts list (names and email addresses only) to cross-reference them against our existing user database. This allows us to identify which individuals in your professional community are currently active on our platform.
- Automated Suggestions: Based on this analysis, we provide you with recommendations to help you connect with colleagues and industry peers you already know who are using Candidate Collective.
5. Disclosure of Personal Information to Third Parties
We do not disclose your Personal Information to third parties for their direct marketing purposes. To operate our Platform and provide our Services, we may share certain Personal Information under the following circumstances:
- With your consent: When you have directed us to share your information (e.g. sharing a candidate profile with prospective employers).
- With our Service Providers: To provide essential technical infrastructure and hosting (e.g., cloud hosting, email delivery).
- For business transfers: In connection with a merger, reorganization, or sale of company assets.
- For legal reasons: When compelled by government authorities, court order, or applicable law.
6. Data Storage and Protection
We take commercially reasonable administrative, technical, and physical measures to protect Personal Information from loss, misuse, and unauthorized access, disclosure, alteration, or destruction.
Google Cloud Infrastructure
All user data, including data accessed via Google APIs, is securely stored on the Google Cloud Platform (GCP). We utilize the security infrastructure provided by Google Cloud, including encryption at rest (AES-256) and encryption in transit (TLS 1.3), to safeguard your information against unauthorized access.
7. Data Retention and Deletion
We only retain your personal data for as long as necessary to provide our services to you.
- Active Accounts: We retain your personal data while your account is active.
- Inactive Accounts: If you stop using our platform, your data is retained for a maximum of 3 months following your last successful login, after which it is scheduled for automated permanent deletion.
Your Deletion Rights
You have full control over your data. You may request deletion of your Personal Information at any time by emailing us at dev@candidatecollective.com.
Alternatively, you may delete your account directly through the Platform:
- Log in to your account at candidatecollective.com.
- Navigate to your User Profile Settings.
- Select the Delete Account option. Upon confirmation, all personal data, synced contacts, and profile records are permanently removed from our databases.
8. Google API Services User Data Policy & Artificial Intelligence (AI) Disclosures
Candidate Collective's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
8.1 Data Accessed
When you authenticate via Google Sign-In or grant permission to sync contacts, Candidate Collective accesses only the specific Google user data necessary to provide our core professional community and referral services:
- Account Profile & Identity Data: Your Google account email address, primary name, profile picture URL, and Google user ID (via
userinfo.emailanduserinfo.profile). - Google Contacts (Read-Only): If you explicitly choose to sync your contacts during onboarding or from your settings, we access read-only contact fields: contact names, email addresses, organization/company names, and job titles (via
contacts.readonly). We do NOT access contact phone numbers, physical addresses, private notes, photos, or interaction history.
8.2 Data Usage
We use, process, and handle the Google user data we access strictly for the following purposes:
- Authentication and Account Management: Authenticating your identity, creating and securing your Candidate Collective member account, and displaying your profile information in your member dashboard.
- Peer Connection Recommendations: Comparing your synced contacts against our verified database of active hospitality members to identify industry colleagues you already know and provide relevant peer connection and referral recommendations.
Explicit Non-Usage: We do NOT use Google user data (including contacts data) for serving advertisements, retargeting, or personalized advertising. We do NOT use Google Workspace or Google user data (raw, aggregated, or derived) to train, develop, or improve generalized AI/ML models.
8.3 Data Sharing
Candidate Collective does NOT sell, rent, license, or trade Google user data to data brokers, advertisers, marketers, or third parties. Google user data is only transferred or disclosed under the following strictly limited conditions:
- Cloud Infrastructure: To our cloud hosting provider (Google Cloud Platform) solely for hosting, database storage, and executing application services in accordance with this Privacy Policy.
- Legal Compliance: When strictly required by applicable legal process, subpoena, or government authority pursuant to valid law.
8.4 Data Storage & Protection
We maintain industry-standard administrative, physical, and technical safeguards to protect all user data accessed through Google APIs:
- Encryption: All Google user data is encrypted in transit using Transport Layer Security (TLS 1.3) and encrypted at rest using AES-256 standard encryption on Google Cloud Platform (GCP).
- Access Controls: Access to production databases containing user data is strictly restricted via role-based access control (RBAC), multi-factor authentication (MFA), and isolated VPC firewalls.
8.5 Data Retention & Deletion
We retain Google user data only for as long as needed to fulfill the purposes described in this policy:
- Retention Period: Google profile and contact information is retained while your Candidate Collective account remains active. If your account becomes inactive, data is retained for a maximum of 3 months following your last login, after which it is automatically scheduled for permanent deletion.
- Revoking Access: You can revoke Candidate Collective's access to your Google account and contacts at any time via your Google Security Settings at myaccount.google.com/permissions.
- Requesting Data Deletion: You have an accessible, guaranteed right to delete all of your data at any time. You can delete your account and all associated Google data directly in the app under Profile Settings > Delete Account, or by emailing our privacy team at dev@candidatecollective.com. Deletion requests are processed and confirmed within 30 days.
8.6 Purpose-Bound Use of Artificial Intelligence (AI) on the Platform
Candidate Collective employs artificial intelligence (specifically Google Cloud Vertex AI / Gemini API) strictly for user-directed resume parsing and professional bio drafting:
- Opt-In Resume Parsing: When a candidate voluntarily uploads a resume document (such as a PDF or Word file) during onboarding or profile editing, our secure document parsing pipeline uses the Gemini API to extract structured information such as previous employer names, dates of employment, hospitality titles, and culinary skills.
- Candidate Bio Generation: AI assists in composing a concise, professional candidate summary based exclusively on the information extracted from the candidate's voluntarily submitted resume.
- User Review and Control: All AI-extracted employment history and generated summaries are displayed to the candidate for mandatory review, editing, and explicit approval before any data is saved to their profile.
B. Absolute Prohibition on Using Google User Data for AI/ML Model Training
In strict compliance with the Google Workspace API User Data and Developer Policy, Candidate Collective strictly prohibits and does not use, transfer, or disclose Google Workspace or Google user data (including Google Contacts data, whether raw, aggregated, or derived) to create, develop, train, fine-tune, or improve foundational, generalized, or third-party machine learning (ML) and artificial intelligence (AI) models.
Google user data (such as names and emails accessed via the contacts scope) is completely isolated from all AI workflows and is exclusively processed for identity verification, cross-referencing against our registered member database, and sending platform invitations as directed by the user.
9. Third-Party Links
The Website may contain links to websites operated by third parties. We have no control over those third-party sites, and this Privacy Policy does not apply to their practices. We encourage you to review their respective privacy policies.
10. California Privacy Rights (Shine the Light Law)
If you are a California resident, California's “Shine the Light” law permits you to request information regarding our disclosure of Personal Information to third parties for direct marketing purposes. To submit a request, email us at dev@candidatecollective.com.
11. Do Not Track Signals
We do not monitor, recognize, or honor automated browser “Do Not Track” (DNT) signals due to the lack of industry-wide consensus standards.
12. Notice to Users Outside the United States
Our Platform and Services are operated in the United States. If you are located outside the United States, please be aware that any information you provide will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our legal obligations or Service features. When updates occur, we will post the revised Policy on this page and update the “Last Updated” date at the top. We encourage periodic review of this Policy.
14. How to Contact Us
If you have questions, comments, or data deletion requests regarding this Privacy Policy or our data practices, please contact our privacy and engineering team at: