Privacy Policy

Last Updated: June 26, 2026

Yardstick, Inc. (“Yardstick”) is committed to protecting the integrity, confidentiality, and security of your Personal Information. We have created this Privacy Policy that outlines who we are, how we collect Personal Information through our Website at yardstick.team and its subdomains (collectively, “Sites”) and our app, platform, and related services (“Services”), and how we store, use, and share your Personal Information.

For purposes of this Privacy Policy, “Personal Information” means any information relating to an identified or identifiable individual (e.g., name, address, e-mail address, or phone number). This Privacy Policy helps guide you through and keep you informed about your right to data protection and privacy.

Our Two Roles: When Yardstick Is a Controller and When We Are a Processor

Yardstick is an applicant tracking system (“ATS”) and recruiting platform. Employers and other organizations (our “Customers”) use the Services to collect, manage, and evaluate information about the people who apply to or are considered for their jobs (“Candidate Data”). Because of how the Services work, Yardstick handles Personal Information in two different capacities, and the role we play determines who is the “data controller” (or, under U.S. state privacy laws, the “business” or “controller”) and who is the “data processor” (or “service provider” or “processor”).

Where Yardstick is the controller. Yardstick acts as the controller — meaning we determine the purposes and means of processing — for Personal Information we collect for our own business purposes, including: (a) visitors to our Sites (including marketing, analytics, and cookie data); (b) the account holders and authorized users at our Customers who register for and administer the Services (for example, recruiters, hiring managers, and account administrators); and (c) billing and payment contacts. For this information, this Privacy Policy describes how we collect, use, and share it, and you may exercise your rights with us directly as described below.

Where Yardstick is a processor. Yardstick acts as a processor (service provider) — meaning we process Personal Information only on a Customer’s behalf and on its documented instructions — for the Candidate Data that a Customer enters into or generates within the platform. In this case, the Customer (the employer) is the controller of the Candidate Data, and Yardstick processes that data to provide the Services to that Customer under our agreement with the employer — our Terms of Service or, for enterprise customers, a Master Service Agreement — and, where applicable, a Data Processing Agreement. We do not decide which roles a Customer recruits for, which candidates it considers, or how it uses the results. Most candidates never create a Yardstick account; their information is entered or generated by the employer that is recruiting them.

Where this Privacy Policy describes the processing of Candidate Data, it does so to be transparent about how the platform works; this does not make Yardstick the controller of that data, and it does not override the privacy notice or instructions of the Customer that controls it. If a Customer’s instructions or its own privacy notice conflict with this Privacy Policy with respect to Candidate Data, the Customer’s role as controller governs.

The Yardstick data protection point of contact for any privacy question or request is privacy@yardstick.team. We offer the Services to employers and do not target or monitor individuals in the EEA or UK; where a Customer uses the Services to process data about individuals in the EEA or UK, the Customer acts as the controller and is responsible for its own obligations under applicable data protection law.

If You Are a Job Candidate or Applicant

If your Personal Information is in the platform because an employer is recruiting, screening, interviewing, or evaluating you, that employer — not Yardstick — is the controller of your information. Yardstick processes your information on that employer’s behalf to provide the Services to it, as a processor, governed by our data processing terms with that employer.

Exercising your rights as a candidate. Because the employer controls your Candidate Data, requests to access, correct, delete, port, restrict, or object to the processing of that data are generally directed to and decided by that employer. If you contact Yardstick directly with such a request about Candidate Data, then, unless we are legally required to act ourselves, we will refer you to the relevant employer-controller (or forward your request to it) and assist that Customer in responding as required by applicable law and our agreement with it. If you are unsure which employer holds your data, contact the organization you applied to, or contact us at privacy@yardstick.team and we will try to help identify the appropriate Customer or route your request.

How Yardstick assists. As a processor, Yardstick provides functionality and support that let our Customers respond to candidate requests — for example, tools to access, export, correct, or delete Candidate Data, and configuration of retention. We act on a Customer’s documented instructions with respect to its candidates’ data, except where applicable law requires otherwise.

The remainder of this Privacy Policy applies in full to the Personal Information for which Yardstick is the controller (Site visitors, account holders, and billing contacts). Where a section is also relevant to Candidate Data, it describes how the platform operates on our Customers’ behalf and does not change the employer’s role as controller.

What Information We Collect About You

Yardstick may collect different types of information, including Personal Information and non-Personal Information from and about you (collectively “Collected Information”), in order to provide our Services to you.

From Your Account: We collect data from you when you create an account (e.g., candidate account or organization account), request information, subscribe for Services, post a question or an answer, upload a resume, create a role, update your job preferences or candidate preferences, create a scorecard, upload content, or otherwise actively send us data on our Sites.

This may include, but is not limited to, your user name, password, first and last name, e-mail address, telephone number (including mobile phone number), street address, gender, occupation, interests, achievements, career goals, professional certification or license numbers, messages you send to users, your desired work schedule or salary and other job preferences, Yardstick profile, your resume, application materials, interview sequence, or answers to custom questions, screening questions, job history interview, job-related exercise, or technical interview submitted to Yardstick, or sent to you, and any other data included in your account.

This may further include, but is not limited to your scorecard or role-related information such as a title, level, department, job description, goals, competencies, interview planning, interview sequence submitted to Yardstick, or sent to you, and any other data included in your account.

Yardstick employs Large Language Models (LLMs) in our app to enhance our services for logged-in users. Yardstick currently uses Google Gemini to help members of the hiring team generate hiring-related content such as interview questions, scorecards, and interview plans (collectively, “LLM Services”), and may also use Anthropic (Claude) and OpenAI as generative AI sub-processors for drafting these content outputs. When you use these LLM Services, the candidate, customer, and other data you include in your request is sent to the applicable generative AI sub-processor solely to produce the output you have requested. This processing is solely for the purposes of: (a) generating the interview questions, scorecards, interview plans, and other outputs you request; (b) providing and maintaining the functionality and quality of the LLM Services; and (c) ensuring the LLM Services perform accurately and reliably. We do not use your Personal Information or Customer Data (as defined below under “When Providing Employer Information”) to train external or third-party LLM models. Your data is used to structure prompts and generate requested outputs. We use Customer Data that contains Personal Information only to provide and support the Services, not for our own purposes. We may also create and use aggregated, de-identified, or anonymized data — which no longer identifies any individual and is no longer Personal Information — to operate, evaluate, improve, and develop our products and services, including the quality and accuracy of our AI features. We do not use Customer-identifiable Personal Information to train or retrain our own models. We have entered into data-processing terms with these providers and use paid API tiers under which the providers represent that data submitted is not used to train their models. Each provider handles data under its own retention and security practices, which we do not control. This includes the read-only development-and-support access described below, which is likewise subject to no-training terms. All data processed through LLMs is subject to the security measures outlined in our “How We Keep Your Personal Information Secure” section.

AI-Assisted Development and Support Tools: Yardstick’s engineers use AI-assisted software-development tools — including Claude Code (provided by Anthropic) and Codex (provided by OpenAI) — to build, operate, debug, and support the Services. For troubleshooting, these tools are granted read-only access to production databases and may, in the course of diagnosing issues, process Customer Data. We use these tools under provider terms that disable the use of submitted data to train the providers’ models, and our engineers limit access to Personal Information to what is necessary to resolve the issue.

Support and Setup Access by Yardstick Personnel: At a Customer’s request, Yardstick personnel may be granted access to a Customer’s account — for example, by being added as a user — to help configure the Services, provide onboarding or support, or advise the Customer. In the course of this work, our personnel may come into contact with Customer Data, including Candidate Data. We access such data only to provide the requested assistance to that Customer, limit our access to what is necessary, and remain bound by confidentiality. This access is processing carried out on the Customer’s behalf as a processor and is subject to our Data Processing Agreement.

All of this information may be associated with your Yardstick account.

Through Your Activity on the Sites:

In addition, as part of the standard and necessary operation of the Sites, Yardstick may collect, analyze, process, store, track, and record in real-time and analyze any and all of your activity on, interaction with, and communications on or through the Sites, including, but not limited to, by collecting, analyzing, processing, storing, and recording the areas of the Sites you visit (such as specific URLs), whether and where you click, scroll, hover-over, mouseover, or otherwise interact with or communicate with or through our Sites, pages accessed and links clicked, and when and for how long each such activity occurred.

This also may include Yardstick collecting, analyzing, processing, storing, and recording information from and about your computer or mobile device and your actions taken on the Sites, including, but not limited to, session activity, browser type, operating system, type of device, unique device identification numbers, MAC address, IP address, digital signature, broad geographic location (e.g., country or city-level location), other technical information, and any of your other behavior or actions on, interaction with, or communications with or through the Sites.

We distinguish between two kinds of activity data. First, as part of the standard and necessary operation of the Sites, we and our infrastructure providers process operational and security logs — for example, server request logs, IP address, browser and device information, and session activity — which are essential to deliver the Sites securely, prevent fraud and abuse, and diagnose problems. This first-party operational logging is not used for analytics or advertising and cannot be switched off while you use the Sites, because the Sites cannot function securely without it.

Second, we use analytics technologies — including cookies, tags, and similar technologies managed through Google Tag Manager and Google Analytics — to understand site performance and how visitors interact with the Sites. These analytics technologies are off by default and are used only after you opt in through our consent controls; if you decline, these non-essential analytics Cookies are not used. We use these analytics for our own first-party purposes only; we do not use them to share your activity with third-party advertising networks or data brokers. You can review or change your choices at any time, as described in our Cookie Notice at yardstick.team/cookies, and you can also control cookies at the individual browser level.

When Using Automated Interview Preparation Product:

If you use any interview preparation product, Yardstick will record and store your interview questions, including competency questions, custom questions, situational questions, behavior questions, reference questions, technical questions, or job-related questions, notes on candidate answers, and scores on competencies and abilities to perform against the role scorecard, and will analyze your hiring practices and results to create better-suited interview questions.

If you use such a product, you will agree in advance to Yardstick storing and analyzing the results in accordance with this Privacy Policy.

When Using Sourcing and Outreach Features: Our Customers may also use the Platform to source, save, and organize information about prospective candidates and other contacts (“Prospects”), and to send outbound recruiting communications (available on certain plans). Information processed for these features may include, for example, a Prospect’s name, contact details, professional and employment background, how they are organized within the Platform, and the content and delivery status of communications sent to them. Prospects are typically added by the Customer rather than by the individual, and the Customer is the controller of this data. Where Yardstick processes Personal Information that was not obtained from the individual — for example, candidate or Prospect data entered by the employer-Customer or gathered through the sourcing tools it uses — the source of that data is the employer-Customer and, where applicable, those tools. Outbound communications are sent through our communications sub-processors (see our Sub-processors page) and are subject to the Customer’s obligations regarding consent and applicable anti-spam laws.

When Providing Employer Information:

If you are an Organization (e.g., Employer), we may request that you provide certain information in order to verify your account. This information may include, but may not be limited to, your Federal Employer Identification Number (EIN), Business Registration information, or a utility bill, the name and e-mail address of an Employer representative. This Employer Information is considered Customer Data. “Customer Data” means the data an employer-Customer submits to or generates in the Services, including Candidate Data; where it relates to an identifiable individual it is “Personal Information” as defined above (and is referred to in our Data Processing Agreement as “Customer Personal Data”). We use it to operate and provide the Services — for example, to verify your account — and, in aggregated and de-identified form that no longer identifies any individual, to analyze, benchmark, and improve our Services, as permitted under our agreement with the employer — our Terms of Service or, for enterprise customers, a Master Service Agreement — and, where applicable, a Data Processing Agreement. Disclosure may also occur in response to a request by law enforcement or a court order.

When Using Chargeable Services

In connection with chargeable services, we will also collect payment information (e.g., the last four digits of credit, debit, or other payment card numbers and related verification information). We use Stripe, Inc. (“Stripe”) as our payment processor; your full card details are submitted directly to Stripe and are not stored by Yardstick. Please note that Yardstick only has access to the last four digits of credit, debit, or other payment card numbers, and does not store full card numbers or related card security codes.

Social-Login / Single Sign-On

You may choose to access or create your Yardstick account using “Sign in with Google” or “Sign in with Microsoft.”

When you do, the relevant provider—Google LLC or Microsoft Corporation (each, an “Identity Provider”)—will ask your permission to share select information with us.

Data we receive from the Identity Provider

• Name (first, last)
• Email address
• Profile-picture URL (if available)
• Unique provider ID (a random string)
• OpenID Connect / OAuth access and ID tokens

We do not receive your password or any additional data (e.g., Google Contacts, Microsoft Calendar) unless you explicitly grant such scopes during a separate consent flow.

Purpose

• Authenticate you and let you log in without a Yardstick-specific password
• Populate your profile so you can start using the Services immediately
• Maintain your session and protect your account (fraud prevention / security logging)

Legal basis

• Performance of a contract (Terms of Service)
• Legitimate interests (secure authentication)
• Your explicit consent when you click “Continue” on the provider consent screen

Limited use

We use the data above exclusively to authenticate you, operate your Yardstick account, and secure the Services. We do not sell, rent, or share this data for advertising, nor do we combine it with unrelated datasets for profiling.

Session cookies

Google Identity Services sets a first-party cookie (g_state) to maintain your sign-in session. Microsoft Entra may set an msal-prefixed cookie for the same purpose. You can control cookies in your browser, but disabling them may break single sign-on.

Retention & deletion

We store the provider ID and related tokens only for the life of your Yardstick account or until you unlink the provider, whichever comes first.

You may unlink at any time from Account Settings → Security → Connected Accounts. Doing so removes the stored tokens and requires you to set a Yardstick password before your next login.

Independent controllers

Google and Microsoft act as independent data controllers for their own processing.

For details, see:

Google Privacy Policy – https://policies.google.com/privacy
Microsoft Privacy Statement – https://privacy.microsoft.com

Why We Collect Your Information

Yardstick may use your Information in a variety of ways for the operation of the Sites and its Services, including:

To operate, maintain, enhance, and provide all of the features and services found on the Sites and Services, to personalize the Sites and Services for your preferences and interests.
To contact you for administrative purposes regarding the Services, for customer service purposes, or regarding content that you have posted to the Services.
To understand and analyze the usage trends, interests, and preferences of our users, to improve the way the Sites and Services work and look, and to create new features and functionality.
Yardstick may now or in the future use Collected Information and “cookies” information to: (a) personalize our services, such as remembering your information so that you will not have to re-enter it during your visit or the next time you visit the Sites or Services; (b) monitor and analyze the effectiveness of the application and evaluation activities; (c) monitor aggregate usage metrics such as total number of users, pages and media and features of the Sites or Services accessed, etc.; and (d) track your entries, submissions, and status, including the ways in which you may interact with the Services.
Yardstick may share information you submit into the app with our generative AI sub-processors (Google Gemini for AI-assisted evaluation and content generation; Anthropic and OpenAI for content drafting) to provide AI-assisted functionality in the app.
Where it is in accordance with your preferences, to send e-mails related to the products and services we think you may be interested in. You will have the ability to opt-out of receiving any such communications, either through links provided in the messages, or by updating your account preferences through the Services.

How We Keep Your Personal Information Secure

We use appropriate technical and organizational measures to protect the Personal Information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your Personal Information, and include the following:

Encryption. Personal Information is encrypted in transit using TLS/HTTPS and at rest using AES-256. At-rest encryption is provided by default through our database provider, Supabase.
Access controls. We apply role-based, least-privilege access to the systems that hold Personal Information, limited to personnel who need it. Multi-factor authentication is required for our staff to access those systems. (This is separate from the optional multi-factor authentication feature available to end users of the Services, and from the single sign-on we offer end users through Google and Microsoft.)
Backups and recovery. We keep automated, encrypted database backups with point-in-time recovery, provided through our database provider, to help us restore data after a loss.
Logging. We log access to the systems that process Personal Information and review those logs as appropriate.
Secure development. We use automated database security linting and AI-assisted review of code changes as part of our development process.
Established infrastructure providers. We host the Services on established infrastructure providers with independently certified security programs whose controls we rely on — Supabase (SOC 2 Type 2 and ISO 27001) for our database, authentication, and file storage, and Vercel (SOC 2 Type 2, ISO 27001:2022, and certification under the EU-U.S. Data Privacy Framework) for hosting and content delivery.

We do not currently hold our own SOC 2 or equivalent certification; for the controls described above we rely on the certified infrastructure providers named here. Please be aware that no physical or technical system is completely secure or immune from outages, losses, attacks, circumvention, design or implementation flaws, and human error. Therefore, we cannot and do not ensure or warrant that information you transmit to Yardstick will not be lost or compromised, either during or after transmission.

AI-Assisted Evaluation and Automated Decision-Making

Some features of the Services use artificial intelligence to help an employer’s hiring team work through applications more efficiently — for example, by evaluating or ranking applications against the job-related criteria the employer defines, so that recruiters can prioritize and manage large volumes of applicants. These features are designed as decision support: they produce suggestions, scores, or rankings that assist the hiring team, and a member of that team reviews the results and makes the actual hiring decisions. The Services do not automatically reject, screen out, or disqualify candidates without human review, and Yardstick does not use these features to make hiring decisions on its own.

How it works. The evaluation compares an application against the job-related criteria the employer defines, taking the content of the application as its input, and produces suggested scores or a ranking to help the hiring team prioritize; it is not designed to use special-category information as an input, and a human reviewer makes the actual decisions. These suggested scores and rankings are decision-support only: they do not by themselves determine any hiring outcome, and every hiring decision remains with a human member of the hiring team.

Because the employer determines which roles to recruit for, which criteria to apply, and how to use these outputs, the employer is the controller of this processing and Yardstick acts as its processor. The employer is responsible for using these features lawfully, fairly, and without unlawful discrimination, and for meeting any obligations that apply to its use of automated or AI-assisted tools in hiring — including, where applicable, requirements to conduct bias audits, to give notice to candidates, and to provide accommodations or an alternative process under laws governing automated employment decision tools and the use of AI in employment. Yardstick provides functionality and information intended to help employers meet these obligations.

If you are a candidate and want to know whether, and how, a particular employer uses these features — or you wish to exercise any rights you may have in relation to automated processing of your information — please contact the employer that is recruiting you, which controls your Candidate Data; Yardstick will assist that employer as described in “If You Are a Job Candidate or Applicant” above. These features are intended to provide decision support to a human reviewer, and Yardstick does not use them to make decisions that produce legal or similarly significant effects about you without human involvement.

Sensitive and Special-Category Data

The Services are not designed to collect special-category or sensitive data, and Yardstick does not request it. However, because resumes, applications, written interview responses, notes, and similar materials are free-form, they may at times reveal information that some laws treat as special-category or sensitive — for example, information relating to health, a disability or a request for accommodation, racial or ethnic origin, religion, criminal history, or voluntary diversity disclosures.

Yardstick does not ask candidates or Customers to provide this information. Yardstick’s AI-assisted evaluation features assess applications against the job-related criteria an employer defines; they are not designed to use special-category or sensitive information as an input or to base evaluations on it, and Yardstick’s interview features are text-based, so we do not record or analyze audio or video interviews. Where such information is present in Candidate Data, Yardstick processes it only as part of providing the Services to the employer-Customer that controls it, and that employer is responsible, as controller, for establishing a lawful basis for any special-category processing and for complying with applicable anti-discrimination and equal-opportunity laws. We ask that Customers and their users not enter sensitive information into free-text fields unless it is necessary for a lawful, job-related purpose.

Security Incidents and Breach Notification

We maintain administrative, technical, and physical safeguards designed to protect Personal Information, and we contract with our sub-processors to maintain protections consistent with this Policy. If we become aware of a security incident involving the unauthorized access to, or disclosure of, Personal Information, we will respond consistent with our obligations:

When Yardstick acts as a processor (Candidate Data and other Customer Data): we will notify the affected Customer (the controller) without undue delay after becoming aware of a personal data breach, and provide the information reasonably available to us to help that Customer meet its own notification obligations. It is generally the Customer-controller’s responsibility to notify affected individuals and regulators. This commitment is consistent with Section 13(f) of our Terms of Service, under which Yardstick notifies you without undue delay of any actual or suspected unauthorized access to or disclosure of your Confidential Information and takes steps to mitigate it.
When Yardstick acts as the controller (Site visitors, account holders, and billing contacts): we will notify affected individuals and the relevant supervisory authorities where, and within the timeframes, required by applicable law — for example, without undue delay and, under the GDPR, where feasible within 72 hours of becoming aware of a notifiable personal data breach, and within the periods required by applicable U.S. state breach-notification laws.

Who We Share Your Personal Information With

We share Personal Information only as described in this Privacy Policy or as we disclose to you at the time this information is collected. We do not sell Personal Information. As described in more detail below, we may share your Personal Information:

We rely on a limited set of sub-processors to host and operate our Services, including Vercel (hosting and content delivery), Supabase (database, authentication, and file storage), Google Gemini (generative AI assistance), Anthropic and OpenAI (additional generative AI assistance and AI-assisted development and support tooling), Resend (transactional email), and Stripe (payment processing). A current list, including the categories of data each processes and their processing regions, is available on our Sub-processors page, which we maintain and update as our sub-processors change.

With our third-party service providers. We authorize these service providers to use or disclose the information only as necessary to perform services on behalf of Yardstick (for example, to support the delivery of, provide functionality on, or help to enhance the security of our Sites). We require these service providers by contract to safeguard the privacy and security of Personal Information that they process on our behalf;
Authentication data is exchanged with Google LLC and Microsoft Corporation solely to verify identity; see the Social-Login section above for details.
To any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;
To an acquirer, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, or in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets, provided that we inform such third parties that they must use your Personal Information only for the purposes disclosed in this Privacy Policy; and
To any other person with your consent to the disclosure.

How Long Your Personal Information Will Be Kept

Personal Information we control. For the Personal Information for which Yardstick is the controller (Site visitors, account holders, and billing contacts), we retain it for as long as your account is active or as needed to provide the Services, and thereafter only for as long as necessary to satisfy our legal, tax, accounting, and similar obligations and to establish, exercise, or defend legal claims. In practice, account and profile records are kept while your account is open and for a reasonable period afterward; billing and tax records are kept for the period required by applicable tax and limitations law; and Site analytics and cookie data are kept for the shorter periods described in our Cookie Notice. When we no longer have a basis to retain it, we delete or anonymize it or, where that is not immediately possible (for example, because it resides in backup archives), we securely store and isolate it from further processing until deletion is possible.

Candidate Data and other Customer Data (data we process for employers). For Candidate Data and other Customer Data, the Customer (the employer) controls retention. By default, Yardstick retains that data for the duration of our agreement with the Customer and until the Customer (or its authorized users) deletes it; we do not automatically delete Candidate Data on a fixed schedule. Customers and their authorized users can generally access, export, correct, and delete Candidate Data within the platform, and can configure retention to meet their own legal obligations — including any anti-discrimination or equal-employment recordkeeping requirements that apply to them as the employer. When a Customer or candidate deletes a record through the available controls, we delete it from active systems and remove it from backups on our standard backup-expiry cycle.

When you delete your account, or an enterprise Customer’s agreement ends. Cancelling a paid subscription does not delete your data — your account continues (for example, on our free tier) and your data remains until you delete it. You can delete your account and the data in it at any time through your account settings or by contacting us at privacy@yardstick.team. When you delete your account, or when an enterprise Customer’s agreement terminates, Customer Data (including Candidate Data) remains available on a read-only basis for at least 30 days so that you can export it. Yardstick then retains the data for at least an additional 30 days before permanently deleting it from active systems; during that additional period, you (or the Customer) may contact us if you need more time to export, and we may, at our discretion, restore temporary access to assist. After deletion from active systems, residual copies in routine backups are removed on our standard backup cycle, except as required by applicable law. An enterprise Customer may instead elect return and/or deletion on the timeline set in our agreement.

What Your Rights Are With Respect to My Personal Information

Under applicable data protection laws, you have the following data protection rights in respect of your Personal Information collected through the Website:

If you wish to access, correct, update or request deletion of your Personal Information, you can do so at any time by contacting us using the contact details provided under the “How to contact us” heading below.
In addition, if you are a resident of the European Economic Area, you can object to processing of your personal information, ask us to restrict processing of your Personal Information or request portability of your Personal Information. Again, you can exercise these rights by contacting us using the contact details provided below.
You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us using the contact details below.
Similarly, if we have collected and process your Personal Information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Information conducted in reliance on lawful processing grounds other than consent.
You have the right to complain to a data protection authority about our collection and use of your Personal Information. For more information, please contact your local data protection authority.
We respond to all requests we receive from individuals whose information was collected through using this Website wishing to exercise their data protection rights in accordance with applicable data protection laws. To protect your privacy and security, we take reasonable steps to verify your identity before granting you account access or making corrections to your information.

Your U.S. State Privacy Rights

This section provides disclosures and rights for residents of U.S. states that have comprehensive consumer privacy laws, including California (the CCPA, as amended by the CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and other states with comparable laws. These rights apply to the extent the relevant law applies to Yardstick; several of these laws apply only to businesses that meet certain revenue or data-volume thresholds, and where a law does not apply to us we may still honor these requests as a matter of good practice.

Scope and roles. Where Yardstick is the “business” or “controller” (Site visitors, account holders, and billing contacts), the rights below may be exercised with Yardstick directly. Where Yardstick is a “service provider” or “processor” acting for an employer Customer (Candidate Data), the employer is the “business” or “controller,” and candidate requests are handled as described in “If You Are a Job Candidate or Applicant” above; Yardstick will assist the Customer as required by law. Note that the CCPA exemption for job-applicant and employee data expired on January 1, 2023, so California job applicants now have full consumer rights in their Candidate Data — exercisable through the employer that controls it.

Notice at Collection — categories of Personal Information. We provide this notice at or before the point at which we collect your Personal Information. In the prior twelve (12) months, Yardstick has collected the following categories of Personal Information (as those categories are defined by the CCPA). The specific categories collected about you depend on how you interact with us, and we retain each category for the period described in “How Long Your Personal Information Will Be Kept” below:

Identifiers — for example, name, email address, postal address, phone number, unique identifiers, account login, IP address, and provider IDs from social login. Sources: you, your employer-Customer, your device, and identity providers. Purposes: to provide and secure the Services, account management, and communications. Disclosed to: sub-processors (hosting, database, email), as described below.
Customer records and contact information — for example, name, address, telephone number, and payment-card last four digits. Purposes: billing, account verification, and support.
Characteristics of protected classifications (only where a candidate or user voluntarily provides them, for example in a resume, or where an employer collects them) — for example, age, sex or gender, disability or accommodation status, or veteran status. Yardstick does not request these. See “Sensitive and Special-Category Data” above.
Professional or employment-related information — for example, resume content, work history, certifications, job preferences, interview questions, notes, scorecards, and evaluations. Sources: primarily the employer-Customer and, where applicable, the candidate. Purposes: to provide ATS functionality to the employer-Customer (as processor).
Internet or other electronic network activity — for example, browsing of and interaction with our Sites, pages viewed, clicks, device and session data, and cookie identifiers, plus the referring website, marketing-campaign parameters, and landing page through which you reached our Sites. Purposes: to operate, secure, analyze, and improve the Sites, and to understand which marketing channels lead visitors to sign up.
Geolocation data — for example, coarse (city- or country-level) location derived from IP address.
Audio, electronic, or similar information — for example, messages and other content you submit. Yardstick’s interview features are text-based; we do not record or collect audio or video interviews.
Inferences — for example, inferences that an employer-Customer’s users draw and record in scorecards or evaluations within the platform, and AI-assisted scores or rankings the Services generate as decision support to help the hiring team prioritize applications (which the hiring team reviews; see “AI-Assisted Evaluation and Automated Decision-Making” above).

We do not use or disclose these categories for purposes that are incompatible with those disclosed here.

Categories disclosed, and our “sale”/“share” practices. In the prior twelve (12) months, Yardstick has disclosed the categories above to our sub-processors and service providers for the business purposes described in “Who We Share Your Personal Information With.” Yardstick does not sell Personal Information for money, and we do not “sell” or “share” Personal Information as those terms are defined under the CCPA/CPRA (including sharing for cross-context behavioral advertising). If Yardstick begins to sell or share Personal Information, or to process it for targeted advertising, in the future, we will update this Privacy Policy and provide the opt-out rights and mechanisms required by applicable law — including a “Do Not Sell or Share My Personal Information” link and recognition of opt-out preference signals such as the Global Privacy Control (GPC) — before doing so. We also do not use or disclose sensitive Personal Information in a manner that would require us to offer a “Limit the Use of My Sensitive Personal Information” right.

Sensitive Personal Information. Some information that may appear in a resume, application, or interview content could constitute “sensitive personal information” (for example, certain government identifiers, or information revealing health, or racial or ethnic origin). Yardstick does not solicit sensitive Personal Information and uses any such information that an employer-Customer includes only as necessary to provide the Services to that Customer. See “Sensitive and Special-Category Data” above.

Your rights. Subject to verification and to legal exceptions, residents of covered states have some or all of the following rights with respect to the Personal Information for which Yardstick is the business or controller:

Right to know or access the categories and specific pieces of Personal Information we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it.
Right to delete Personal Information we have collected, subject to exceptions.
Right to correct inaccurate Personal Information.
Right to opt out of the “sale” or “share” of Personal Information and of processing for targeted advertising or certain profiling. (As stated above, we do not sell or share Personal Information.)
Right to limit the use of sensitive Personal Information (California), where applicable.
Right to data portability.
Right to appeal a denial of your request (Virginia, Colorado, Connecticut, and similar states). We will respond to an appeal within the time required by applicable law and, if we deny it, tell you how to submit a complaint to the relevant state Attorney General.
Right to non-discrimination for exercising your rights. We will not deny services, charge different prices, or provide a different level of service because you exercised your privacy rights.

How to exercise your rights. You may submit a request by emailing privacy@yardstick.team. We will confirm receipt and respond within the timeframes required by applicable law (generally 45 days, extendable as permitted). To protect your privacy, we will take steps to verify your identity before acting on a request, and we may need to request additional information for verification. If Yardstick is acting as a service provider or processor for an employer with respect to the data in your request, we will refer or forward the request to that employer as described above.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of your written permission to act on your behalf, and we may require you to verify your own identity directly with us, as permitted by applicable law.

California “Shine the Light.” California Civil Code § 1798.83 permits California residents to request information about a business’s disclosure of Personal Information to third parties for those third parties’ direct marketing purposes. Yardstick does not disclose Personal Information to third parties for their own direct marketing.

International Data Transfer

Your Personal Information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country (and, in some cases, may not be as protective).

Specifically, our Sites and Services are hosted in the United States, and we and our sub-processors process Personal Information in the United States. Where a sub-processor processes data in another country, that is described on our Sub-processors page, which lists each sub-processor and its processing region. This means that if you are located outside the United States, your Personal Information will be transferred to and processed in the United States.

However, we take appropriate safeguards to require that your Personal Information remains protected in accordance with this Privacy Policy and applicable law. If you are in the EEA, the UK, or Switzerland, these safeguards include entering into the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum) with the sub-processors that process your Personal Information, or relying on another lawful transfer mechanism. These clauses require the recipient to protect EEA and UK Personal Information in accordance with European data protection law. To request a copy of the relevant safeguards (for example, the Standard Contractual Clauses), contact privacy@yardstick.team.

Legal Basis For Processing Personal Information (EEA and UK Individuals)

The lawful basis on which Personal Information is processed depends on Yardstick’s role. For Candidate Data and other Personal Information that Yardstick processes on behalf of an employer-Customer, the employer is the controller and is responsible for establishing and maintaining a lawful basis — and, where applicable, a valid condition for processing any special-category data — for that processing; Yardstick processes such data only on the employer’s documented instructions. For the Personal Information for which Yardstick is itself the controller — Site visitors, account holders and authorized users, and billing contacts — the following applies.

We will normally collect Personal Information from you only where we have your consent to do so, where we need the Personal Information to perform a contract with you, to perform a contract with the Organization, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect Personal Information from you or may otherwise need the Personal Information to protect your vital interests or those of another person.

If we ask you to provide Personal Information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

For the Personal Information for which Yardstick is the controller, the legal basis we rely on for each main purpose is as follows:

Providing your account and the Services — performance of a contract (our Terms of Service or other agreement) with you or your Organization.
Securing the Services, preventing fraud, and product analytics — our legitimate interests in operating and securing the Services and in improving their quality and reliability, where those interests are not overridden by your data protection interests or fundamental rights and freedoms.
Understanding how visitors find us (marketing measurement and attribution) — our legitimate interests in measuring the effectiveness of our marketing and understanding which channels and campaigns lead people to sign up, where those interests are not overridden by your data protection interests or fundamental rights and freedoms.
Marketing email — your consent or our legitimate interests, depending on the requirements of your jurisdiction.
Legal, tax, and accounting retention — compliance with a legal obligation.

Similarly, if we collect and use your Personal Information in reliance on our legitimate interests (or those of any third party), which are not already referred to above, we will make clear to you at the relevant time what those legitimate interests are.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the “How to contact us” heading below.

Additional Uses and Disclosures of Non-Personal Information

This policy also applies to our use of Non-Personal Information. We may use and disclose Non-Personal Information for any purpose, except where we are required to do otherwise under applicable law. If we combine any Non-Personal Information with Personal Information, then we will only use and disclose such combined information for the purposes described in this section of the Privacy Policy while it is so combined.

Cookies and Similar Tracking Technology

We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use Personal Information about you, including to help us understand how our Sites and Services are being used or to personalize our Sites and Services for you. For further information about the types of Cookies we use, why, and how you can control Cookies, please see our Cookie Notice at yardstick.team/cookies.

Third-Party Integrations

The Services let our Customers connect third-party services that the Customer uses and controls — for example, calendar, messaging, email, or other recruiting and HR systems. When a Customer enables an integration, it authorizes Yardstick to send data to, or receive data from, that third-party service on the Customer’s behalf and into accounts the Customer controls. Those third-party services are not Yardstick sub-processors; the Customer’s use of them, and the data shared with them, is governed by the Customer’s own agreement with the relevant provider, and the Customer is responsible for that processing as controller. We encourage Customers to review the privacy and security terms of any service they connect.

Third Party Services

The Sites and Services may contain references and links to other websites and services provided by third parties. Any Personal Information or communication you provide on third party sites or services is provided directly to that third party and is subject to that third party’s policies governing privacy and security. We are not responsible for the content or privacy and security practices and policies of third-party sites or services to which links are displayed on the Service. We encourage you to learn about third parties’ privacy and security policies before providing them with your Personal Information.

Intellectual Property

You acknowledge and agree that Yardstick owns all Intellectual Property rights in the Site and Services. Except as expressly stated herein, these terms do not grant you any rights to, under or in, any Intellectual Property or any other rights or licenses in respect of the tool. “Intellectual Property” means any patent, patent application, copyright (whether registered or unregistered), database right, trade secret, trade name, or trademark (whether registered or unregistered). In exchange for using the Site and the Services, you grant Yardstick the right, free of charge, to use such of your Intellectual Property rights as Yardstick may consider necessary to provide its Services. Yardstick will have a continuing right to use such rights for the purposes of promoting Yardstick and its Services. You will ensure that any Intellectual Property rights you use in connection with the Services do not infringe any third party rights and you will indemnify and hold harmless Yardstick, its agents and employees from any liability, cost, loss, damages, award, settlement or other expense of any kind (including legal and professional fees) arising from any claim, demand or action alleging that such Intellectual Property rights that you use in connection with the Services infringe any third party rights.

Children’s Privacy / Minors

The Services are a commercial product directed to adult business users and are not directed to children. In particular, the Services are not directed to children under the age of 13, and Yardstick does not knowingly collect personal information from children under 13; if we learn that we have collected such information, we will delete it. Where a Customer uses the Services to process information about job applicants or candidates who are minors (for example, older teenagers applying for employment), the Customer is solely responsible, as controller, for providing any notices and obtaining any parental or other consents required by applicable law.

Updates To The Privacy Policy

We may update this Privacy Policy from time to time in response to changing legal, technical, or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws.

How To Contact Us

If you have any questions or concerns about our use of your Personal Information, please contact us using the following details:

Yardstick, Inc.

720 Seneca St, Ste 107, #927

Seattle, WA 98101

Phone: (206) 426-2420

privacy@yardstick.team

If you are a Website visitor from the European Economic Area or the UK, our legal basis for collecting and using the personal information described above will depend on the Personal Information concerned and the specific context in which we collect it.