Privacy policy

Last updated 3 November 2026

Hirelabs runs hirelabs.io, igamingjobs.io and web3vacancy.com. This policy covers all three sites. It explains what personal data we collect, why, who helps us process it, how long we keep it and what choices you have.

• What we collect
• How we use it
• What hiring teams see
• AI assistants connected by hiring teams
• Analytics, cookies and storage
• Service providers
• How long we keep data
• Your choices and data requests

What we collect

Everyone who visits

• Page address, referring page, browser and device type, and country.
• On the boards, clicks such as apply, search and filter.
• Your IP address reaches our servers and our network provider. Our own board analytics do not store it. They use a visitor code built from the date, your IP address and browser, which changes every day.

Candidates with a profile

• Your CV file (PDF or DOCX) and the text in it.
• Profile details you give or that we read from your CV: name, email, phone or Telegram handle, headline, role, seniority, years of experience, skills, languages, experience, education, links, location, timezone, work type, availability, salary or rate expectations and a short summary.
• Your settings: visibility, job alert frequency, and when you gave consent and to which version of the consent text.
• If you sign in with Telegram: your Telegram id, username, first name and profile photo.

Applicants

• Your application, your CV, your answers to short questions about the role and a copy of your profile at the time you applied.
• A hashed form of your IP address and browser, used against abuse.
• Where an apply form asks you to join the board on Telegram first: your Telegram id, username and whether you joined.

Hiring teams on hirelabs.io

• Your email, or your Telegram id and username when you sign in with Telegram, and the name and company you add.
• The roles and job descriptions you add, your AI searches and their results, chats and Connect taps.
• Your IP address, used for security and rate limits. For searches made before sign-in we keep only a hashed form.
• A hashed form of your IP address at sign-up, used to spot groups of free accounts that share one. We do not keep the address itself for this.
• Which profiles you open and which people your lists show you, on the website or through an AI assistant, with the time. We use this to detect scraping.
• If you connect an AI assistant: the name and return address it registers with, the permissions you allow, sign-in tokens stored only as hashes, and a log of its calls (see AI assistants).

Buyers of job posts and plans

• For a job post: the job details, company name, website and logo, how to apply, your email, your support contact or Telegram handle, plan, amount, payment method and payment reference.
• For a Hirelabs plan: your plan, its status and dates, and your Stripe customer and subscription ids.
• Stripe collects your card details. For Hirelabs plans it also collects your billing address and any VAT or tax ID. OxaPay handles crypto payments. We never receive your full card number.

People who write to us

If you email us, we keep your message and our reply.

How we use it

• Job matching: to send candidates job alerts that fit their profile, and to show hiring teams candidates who fit a role.
• AI reading and ranking: AI reads CVs to fill profiles, writes short profile summaries and scores, ranks profiles against roles, and ranks applications for the person hiring.
• Applications: to pass your application to the person hiring for that job.
• Chats and Connect: to deliver messages between hiring teams and candidates, by email, in the workspace and through the board's Telegram bot.
• Notifications: confirmation and sign-in links, job alerts, chat updates, receipts and account messages.
• Payments: to take payment, publish paid posts and run plans.
• Safety: to prevent abuse, enforce rate limits, and handle reported or paused chats. Our team can read chats to handle reports, abuse and support requests. Our team gets internal alerts, for example about a new application or a reported chat, in a private Telegram group.
• Scraping detection: we count the profiles an account opens, the people its lists show, its AI searches and its AI assistant calls. When those counts look like bulk collection, that account's AI assistant pauses and our team is told, then clears or suspends the account.
• Improving the sites: to understand which pages and features are used.

We do not sell personal data.

What hiring teams see

• Before Connect, a hiring team sees your professional profile: headline, role, skills, experience, location, languages, availability, salary or rate expectations, and a short AI summary of how you fit a role. Names, employers' and schools' names and contact details are not shared at this stage.
• After you both tap Connect, they see your name, contact details, links and CV when there is one.
• Until both tap Connect, messages that include contact details are not delivered.
• When you apply to a job on a board, the person hiring for that job gets your application, CV and answers.
• Hidden profiles are not shown to hiring teams.
• A hiring team may do this work through an AI assistant they connect. It gets what they see at that stage, as set out below.

Hiring teams may use candidate details only to discuss the role they contacted the candidate about, as set out in our terms.

AI assistants connected by hiring teams

A recruiter can connect an AI assistant to Hirelabs, as described in Hirelabs for AI assistants. The recruiter chooses the assistant and approves it on a Hirelabs page. That assistant and its provider then receive what each tool returns, and they are recipients the recruiter chose, not our service providers. The recruiter who owns the assistant account is responsible for that provider's terms. Once data reaches the assistant, it is handled under those terms, not this policy.

What the tools return before Connect

• Who: a candidate id, name initials and a link to the profile in Hirelabs.
• Professional profile: headline, seniority, years of experience as a band, country, languages, skills, salary or rate expectations, availability, remote preference, whether the profile is verified, and whether there is a CV.
• Profile detail: summary, experience (titles, how long, what the person did), education (degree), expertise, what they are open to, work type and time zone family.
• AI results: match scores, the reason for a score, which must-haves are met, and scores for the recruiter's other roles.
• The recruiter's own records: saved people, stage, chats, chat status, messages in both directions, unread state, and who has tapped Connect.
• Applicants to the recruiter's posted jobs: the name as the role page shows it, headline, location, years of experience, languages, seniority, application date and status, AI score, rationale and highlights.

What the tools also return after Connect

• For a person who tapped Connect with that recruiter: full name, location, full experience and education with employers, schools and dates, email, phone, Telegram and links.
• For an applicant, once the role is unlocked: skills, salary or rate expectations, answers to the role's questions, experience, education, whether there is a CV, and email, Telegram and phone.

The tools also return the recruiter's own plan, roles, role descriptions and must-haves. No tool returns a CV file.

What we keep about a connection

• Sign-in: connecting uses OAuth. Access tokens last an hour and refresh tokens last 30 days. We store both only as hashes.
• Call log: one row per tool call with the tool name, a hash of the arguments, the status, how long it took, the time, the account and the connection. We do not log the text of the arguments.

The recruiter can disconnect an assistant at any time under Account. Hirelabs then stops answering it at once. What the assistant already received stays with its provider.

Analytics, cookies and storage

Analytics

• Google Analytics runs on all three sites. On the boards it counts a page view only after you first scroll, tap, move the pointer or press a key.
• Umami, which we host ourselves and which uses no cookies, runs on both boards with the same rule, and on hirelabs.io.
• Yandex Metrica runs on igamingjobs.io. It records clicks and how pages are used, including session replay, and sets its own cookies.
• Our own analytics on the boards and on some hirelabs.io pages record page views and clicks.

Cookies

• Sign-in: one cookie keeps hiring teams signed in to the workspace (90 days). One keeps candidates signed in on the boards (30 days).
• Telegram: one cookie remembers that you confirmed your Telegram account when applying (24 hours). One remembers that you joined the board on Telegram (1 year).
• Analytics: Google Analytics sets its own cookies, and so does Yandex Metrica on igamingjobs.io.
• Where you came from: on hirelabs.io, one cookie remembers the site or link that first brought you there (90 days). If you sign up, it is saved with your account.

Browser storage

Your browser may keep small items on your device, such as the role you typed on our homepage, a search you started before signing in, short-lived copies of your profile while you edit it, and a code used by our own analytics on hirelabs.io.

Service providers

We use these providers to run the sites. They process data only to provide their service to us.

• Stripe: card payments, receipts and plan billing.
• OxaPay: crypto payments for job posts on the boards.
• Resend: email delivery.
• Telegram: sign-in, board bots, chat messages and notifications.
• AI model providers, reached through OpenRouter: reading CVs and job descriptions, and ranking profiles and applications.
• Google Analytics and Yandex Metrica (igamingjobs.io only): site analytics.
• Umami, hosted on our own servers: site analytics.
• Cloudflare: network delivery and security in front of the sites, and some incoming email.
• Google Fonts: fonts on hirelabs.io pages. Your browser loads them from Google, which sees your IP address.
• Hosting: the servers that run the sites and store data and CV files.

AI assistants that hiring teams connect are their own choice, not providers of ours: see AI assistants.

Job posts are marked up so search engines such as Google can list them. That markup carries the job details, not personal data about visitors.

How long we keep data

• Board analytics we collect ourselves are deleted after 90 days.
• Candidate profiles and CVs stay until you delete them.
• Applications: answers, profile copies, scores and hashed IP and browser data are removed after 12 months. Applications that are never confirmed are deleted after 30 days.
• Searches started on the hirelabs.io homepage before sign-in are deleted after 7 days if nobody claims them.
• Hiring team accounts, with their chats and searches, stay while the account is open. When you ask us to delete your account, we delete it.
• AI assistant call logs are deleted after 90 days.
• AI assistant sign-in tokens are deleted 30 days after they end. An assistant's registration is deleted after 7 days if it never got access.
• Profile open and list records and the hashed sign-up IP address stay while the hiring team account is open.
• Payment and order records are kept as long as we need them for billing and tax.
• Sign-in links expire within 30 minutes.

Your choices and data requests

• Candidates can edit their profile, set it to hidden, change or turn off job alerts, or delete their profile and CV at any time from their account on the board. Every job alert has an unsubscribe link.
• Anyone can ask for a copy of their data, ask us to correct or delete it, or object to how we use it.

Write to [email protected] from the email you use with us, or tell us your Telegram username. We reply within 30 days.

Changes

We will post any update to this policy here with a new date, and tell account holders about significant changes.