Legal

Privacy Policy

Last updated: June 2026

1. Introduction

LeapOne, operated by EightLeaps ("LeapOne," "we," "our," or "us"), is committed to protecting privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use our AI-powered recruitment platform (the "Service") or visit our website.

This policy covers two groups of people, whose data we handle in different roles:

2. Our Roles: Controller and Processor

For Customer account and usage data, LeapOne is the data controller. For Candidate data that a Customer uploads or sources through the Service, the Customer is the controller and LeapOne acts as a processor, handling that data only on the Customer's documented instructions and under a Data Processing Agreement (DPA). Where a candidate wishes to exercise rights over data held on a Customer's behalf, we will support the Customer in responding and, where appropriate, direct the request to that Customer.

3. Information We Collect

3.1 Customer Information

3.2 Candidate Information (from applications)

When a candidate applies through a Customer's career site or is added by a Customer, we may process:

3.3 Sourced Candidate Information (from third parties)

Where a Customer uses our sourcing and enrichment features, we obtain professional information about potential candidates from third-party data providers and public professional sources (such as professional networking profiles and business contact databases). This information typically includes name, professional title, employer, work history, skills, and business contact details. Because this data is processed on a Customer's behalf, the Customer is the controller and is responsible for the lawful basis and for providing any direct notice required by law. Individuals may object to this processing or request deletion using the contacts in Section 13; we will route such requests to the relevant Customer and assist in honoring them.

3.4 Usage Information

4. Legal Bases for Processing

Where the GDPR, the India Digital Personal Data Protection Act (DPDPA), or similar laws apply, we rely on the following bases:

For Candidate data, the Customer is responsible for identifying the appropriate legal basis under its own jurisdiction.

5. How We Use Your Information

We do not use Candidate data to train any machine-learning model, and we do not sell personal information.

6. AI Processing and Automated Decision-Making

Important: Our platform uses artificial intelligence (AI) to support recruitment. This section explains how your data is processed by AI systems and the safeguards we apply.

6.1 AI-Powered Features

6.2 AI Providers

We use third-party large language model providers (currently OpenAI) for inference, and specialist providers for AI voice interviews and for the recording and transcription of interviews where a Customer enables those features (see the sub-processor list in Section 8). When data is sent to these providers:

6.3 Safeguards on AI Scoring

Before candidate data is sent to a language model for scoring, and as part of every scoring call, we apply technical safeguards:

6.4 Human Oversight and the Right to Human Review

AI scores and recommendations are advisory tools only. All final hiring decisions are made by the Customer's personnel, not by LeapOne and not by an automated system acting alone. Candidates have the right to request human review of any adverse decision that was influenced by AI scoring, and to contest that decision.

6.5 AI Transparency

Where a candidate interacts with an AI interviewer or AI assistant, that interaction is disclosed as AI-driven so the candidate knows they are not speaking with a person.

6.6 Voice and Video Data

AI voice interviews and recorded video interviews are conducted only with the candidate's prior consent, which can be declined. Recordings and transcripts are stored encrypted and retained for the periods in Section 10. Depending on the candidate's jurisdiction, voice and facial data in these recordings may constitute biometric or sensitive data; we process it solely to deliver the interview features the Customer has enabled, do not use it to build biometric identifiers, and do not use it to train AI models.

7. Google User Data

When you connect your Google account to LeapOne, we request access to specific Google services to enable interview scheduling and video conferencing features. This section describes what Google user data we access, how we use it, and your rights regarding that data.

7.1 Google API Scopes We Request

7.2 How We Use Google User Data

Data accessed through Google APIs is used solely to:

7.3 Storage and Retention of Google User Data

7.4 Sharing of Google User Data

We do not sell, rent, or share Google user data with third parties for advertising or any unrelated purposes. We do not use Google user data to train AI or machine learning models. Google user data is processed only on infrastructure under our direct control (Google Cloud Platform) and is not transferred to any other AI provider.

7.5 Limited Use Disclosure

LeapOne's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7.6 Revoking Access

You can revoke LeapOne's access to your Google account at any time by:

Revoking access immediately stops LeapOne from making further API calls to your Google account. Already-created events on your calendar will remain unless you delete them manually.

8. Data Sharing and Sub-processors

We may share personal data with:

We do not sell personal information to third parties. Our sub-processors are:

Outbound recruiting and candidate-facing email is sent through the Customer's own connected mailbox (for example Gmail, Microsoft 365, or another SMTP provider the Customer configures); LeapOne does not route that email through a separate transactional email sub-processor.

We will give Customers 30 days' notice before adding or replacing a sub-processor. A Customer may object on reasonable grounds; if the objection cannot be resolved, the Customer may terminate the affected portion of the Service without penalty.

9. International Data Transfers

Personal data may be transferred to and processed in countries other than your own, including the United States (for AI inference and certain sub-processors). Where the GDPR or UK GDPR applies, we rely on Standard Contractual Clauses (SCCs) and equivalent safeguards, and we have committed to enterprise data terms with our AI provider that restrict the use of prompts for training. For Indian candidates, transfers comply with the DPDPA cross-border rules, including any notifications required by the central government.

10. Data Retention

We retain personal data only as long as necessary for the purposes in this policy, unless a longer period is required by law:

Customers may configure shorter retention windows per organization. Retention may be extended for an individual record where needed for a legal hold or active dispute.

11. Data Security

12. Special-Category and Sensitive Data

We do not solicit, and we ask Customers not to provide, special categories of data (GDPR Art. 9 / DPDPA sensitive personal data). Where such information appears in candidate-supplied free text — for example, a mention of a disability in a cover letter — our AI pipeline is instructed to ignore it and not factor it into any evaluation.

13. Your Rights

Subject to the laws of your jurisdiction, you may:

For Candidate data uploaded or sourced by a Customer, deletion and similar requests must ultimately be honored by that Customer as controller; we will route your request to them and support them in responding. To exercise any right, contact us at [email protected]. We will respond within 30 days, or sooner where required by local law.

14. Cookies

We use strictly necessary cookies for authentication and session management, and analytics cookies only with consent. You can manage cookie preferences through your browser settings.

15. Children

The Service is not directed to anyone under 18, and we do not knowingly collect personal data from minors.

16. Data Breach Notification

We maintain a documented incident-response process and will notify affected Customers without undue delay — and, where required, within 72 hours — of a confirmed personal-data breach, so that controllers can meet their own notification obligations.

17. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify Customers of material changes by email to the Customer admin and by posting the updated policy on this page, and we will update the "Last updated" date above. Prior versions are archived for the duration of any consent or contract that referenced them.

18. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, please contact us at:

Email: [email protected]
Address: EightLeaps, 71 Erintol Way, Markham, Ontario, Canada

EU-resident data subjects may contact us at the address above; we will respond as though an Article 27 representative were in place.

More about LeapOne