HRAIT IQ+ | Privacy Notice

1 | Scope and Responsible Entity

aiTWorks, Inc. (operator of HRAIT and HRAIT IQ+; “we,” “us,” or “our”) handles personal information collected in connection with job search, recruiting and placement, candidate matching, interviews, account management, and related websites in the United States in accordance with this Notice. This Notice applies to candidates, applicants, website visitors, representatives of hiring companies, and anyone who contacts us.

Where we process personal information solely on the instructions of a hiring company, the data processing agreement with that company may also apply. Additional notices may apply to employee payroll and HR records and to other services. Where this Notice differs from applicable federal, state, or local law, we follow the stricter requirement.

2 | Categories and Sources of Personal Information

The table below describes the categories of personal information we may handle in providing our services. We do not collect every item at all times; the information actually collected depends on the services and processes you use.

3 | Purposes of Use and Data Minimization

• Registration, identity verification, maintaining candidate profiles, and providing the job referrals and career support you request.
• Matching job-related skills and experience to job requirements, managing applications, organizing interview information, and introducing you to hiring companies you have approved.
• Responding to inquiries, scheduling, improving our services, preventing fraud, maintaining information security, and complying with legal and contractual obligations.
• Service analytics based on the minimum necessary usage data. Advertising measurement and promotional communications are conducted in accordance with applicable law and your choices.

If we intend to use personal information for purposes materially different from those stated, we will provide notice and obtain any required consent in accordance with applicable law. As a rule, we do not use Social Security numbers, health information, biometric information, or similar data to create routine hiring scores; any exception requires an independent legal basis and internal approval.

4 | AI-Assisted Recruiting and Human Review

HRAIT IQ+ may use AI for résumé parsing, organizing job requirements, matching job-related skills, summarizing interviews, and presenting recommendation rankings and fit indicators. Because AI can make errors or reflect bias, scores do not determine a candidate’s ability, character, or hiring outcome.

We do not automatically reject or permanently exclude candidates, or deprive them of a reasonable opportunity for consideration, based solely on AI scores. AI evaluation results are meaningfully reviewed by a recruiter, and candidates may request correction, re-evaluation, or appeal of an evaluation (see Section 8 for how to submit a request). Final hiring decisions are made by the hiring company.

Where a tool qualifies as an automated employment decision tool or similar technology under applicable law, we provide advance notice, audit information, required explanations, opt-out options, and methods for requesting reasonable accommodation. Where interviews are recorded or analyzed by AI, we provide advance notice and obtain consent as required by the laws of the applicable state.

5 | Disclosure and Sharing of Information

We share necessary information only with hiring companies based on your authorization of an application or referral; with service providers (cloud hosting, communications, scheduling, technical maintenance, approved AI processing, etc.) to the minimum extent necessary; with legal, audit, and government authorities as lawfully required; and in corporate transactions subject to appropriate safeguards. We do not provide other candidates’ résumés, applications, compensation, or selection status to referrers or unrelated third parties.

We do not sell personal information in exchange for monetary consideration. If our use of analytics or advertising technologies on our websites constitutes a “sale” or “sharing” of personal information, or targeted advertising, under applicable state law, we provide the opt-out methods described in Section 9.

6 | Security Safeguards and Service Providers

We maintain a written information security program covering access control, authentication, encryption, activity logging, training, vulnerability management, vendor review, backups, incident response, and secure deletion, and we implement reasonable safeguards based on that program. However, no system can guarantee absolute security.

Before engaging an external AI provider to process candidate information, we review the data elements transmitted, processing locations, subcontracting, retention and deletion, confidentiality, and terms governing reuse and model training, and we manage these matters by contract. We do not use candidate information to train external general-purpose AI models without written review and approval and any required consent from the individual.

7 | Retention, Deletion, and Legal Holds

We retain information only for as long as necessary for the purposes of use, a candidate’s continued use of our services, required contractual, litigation, and accounting records, and federal and state recordkeeping obligations. After the retention period ends, we securely delete or de-identify the information. If a legal hold applies, we suspend deletion only to the extent necessary.

8 | Your Rights and How to Exercise Them

Subject to applicable law, identity verification, and exceptions, we respond to requests to know and access, correct, delete, and port personal information; to limit certain processing of sensitive information; to opt out of regulated sales, sharing, targeted advertising, and automated processing; and to appeal. The rights available to you vary depending on your state of residence.

Please submit requests to info@aitworks.com (with “Personal Information Request” in the subject line). Where permitted by applicable law, we also accept requests submitted by an authorized agent. We record the details of each request, identity verification, the applicable state law, deadlines, our response, and the status of deletion or correction by service providers, and we respond within the applicable legal deadline. We do not discriminate or retaliate against anyone for lawfully exercising their rights.

9 | Cookies and Advertising Measurement

In addition to technologies strictly necessary for session management and security, we may use technologies for analytics, functionality, and advertising. For non-essential cookies, SDKs, advertising pixels, and similar technologies, we provide choice and consent mechanisms in accordance with applicable law, and we honor browser-based opt-out signals such as Global Privacy Control (GPC) as valid requests as required by applicable law. Requests to stop job-referral communications are handled separately from requests to stop advertising.

10 | Sensitive Information, Reasonable Accommodation, and Minors

We do not use sensitive information or protected characteristics that are not directly related to job qualifications in evaluation scores, and we handle accommodation information required by law in a separate, restricted environment. Where an AI evaluation could disadvantage an applicant with a disability, we provide alternative assessments and reasonable accommodations as required by law. Our services are not directed to children under 13, and we do not knowingly collect personal information from children under 13. Before providing services to minors, we determine on a case-by-case basis whether age verification, parental consent, or advertising restrictions are required.

11 | Interstate and International Processing

Our approved service providers or internal teams may process personal information in multiple U.S. states or outside the United States. In such cases, we provide any notice required by applicable law and implement data protection agreements and other appropriate safeguards.

12 | Changes, Contact Information, and Relationship to Other Legal Documents

We may update this Notice from time to time. If we make material changes, we will notify you by posting the updated Notice on our website or by other appropriate means. This Notice does not replace notices at collection, consents for AI interviews, written consents for biometric information, disclosures and authorizations under the FCRA, service provider agreements, or similar documents.

This Notice is provided in English and Japanese. The English version is the authoritative version, and the Japanese version is provided as a reference translation. In the event of any discrepancy, the English version prevails.

Contact: aiTWorks, Inc. / HRAIT   Email: info@aitworks.com

Appendix A | Additional Information for California Residents

Where we are subject to the CCPA, covered candidates, applicants, employees, and others have rights including the right to know and access, correct, and delete personal information; to limit certain uses of sensitive personal information; to opt out of sales and sharing; and to be free from discrimination. We provide a notice at collection that describes, for each category, the purposes of collection, sources, recipients, handling over the past 12 months, the retention period or the criteria used to determine it, and how to submit a request.

Where we use automated decision-making technology (ADMT) for significant decisions, we comply with the specific requirements applicable from January 1, 2027. We also comply with California regulations prohibiting discrimination in the use of AI in employment.

Appendix B | Other States and Localities

The applicability of state laws is determined based on residence, the individual’s status as a job seeker, website visitor, employee, or otherwise, business size, the data handled, and the processing performed. Where applicable, we comply with New York City AEDT audit and notice requirements, Illinois requirements for AI video interviews and biometric information, the Massachusetts WISP requirements, the New York SHIELD Act, Colorado ADMT regulations scheduled to take effect on January 1, 2027, Washington health data requirements, data breach notification laws in all 50 states and other jurisdictions, and the federal FCRA.