Privacy Policy
Demure is applicant tracking and recruiting CRM software sold to recruiting and staffing firms. This policy explains what we collect, why, how long we keep it, and how to get it deleted.
Who we are
Demure ("we", "us") is operated by Demure Inc. and provides the software at demure.ai and app.demure.ai. Contact us at hello@demure.ai.
Our customers are recruiting firms. When a firm uses Demure to manage candidate and client records, the firm is the controller of that data and Demure is the processor. This policy covers our own processing. A firm's own privacy notice governs how it handles the people in its records.
What we collect
Account information
Name, work email address, firm name, and role. Collected when an account is created and used to authenticate the user and administer the subscription.
Billing information
Payment is processed by Stripe. We never see or store full card numbers. We retain the billing contact, subscription status, seat count, and invoice history.
Data a firm puts into the product
Candidate and client records, notes, resumes, job descriptions, messages, and scheduling details, entered by the firm or imported by it.
Usage and technical data
Log data including IP address, browser type, pages requested, and timestamps, used to operate the service, investigate faults, and detect abuse.
Google user data
Connecting a Google account is optional. The product works without it. If a user connects one, we request only the scopes below and use them only for the stated purpose.
| Scope | What we do with it |
|---|---|
gmail.send | Send email that the user composes or approves inside Demure, from their own address, so recipients see it as coming from them. We cannot read, search, or list any message with this permission. |
calendar.readonly | Read busy and free times so the booking page only offers slots the user is actually available for. We read availability, not event content. |
calendar.events | Create, update, and cancel calendar events for interviews and meetings booked through Demure, including adding attendees and a video link. |
Limited Use. Demure's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically, we do not transfer Google user data to third parties except as necessary to provide or improve the features the user connected the account for, to comply with applicable law, or as part of a merger or acquisition with notice. We do not use Google user data for advertising. We do not sell it. We do not use it to train generalized artificial intelligence or machine learning models. Humans do not read it, except with the user's explicit permission for a specific support issue, where required by law, or where necessary for security purposes such as investigating abuse.
What we store from Google, and for how long
We store the OAuth tokens needed to keep the connection working, the connected account's email address, and the scopes granted. We store the metadata needed to link a sent message or a created event back to the correct record: message identifiers, timestamps, recipients, and event identifiers.
We do not store the contents of the user's mailbox, because we never have access to it.
Tokens are deleted immediately when a user disconnects their Google account in settings or revokes access at myaccount.google.com/permissions, and within 30 days of an account closing.
Artificial intelligence
Demure uses AI to assist with administrative work: parsing an uploaded resume into profile fields, summarizing call notes a user pastes in, and drafting text a user reviews before sending. Nothing is sent without a person approving it, and it does not score or rank candidates.
Content sent to our AI provider for these features is not used by them to train their models. We do not send Google user data to AI providers.
How we share data
We use service providers to operate the product: hosting and database infrastructure, transactional email delivery, payment processing, and error monitoring. Each receives only what it needs and is bound by contract to protect it.
We do not sell personal information. We do not share it for advertising.
We may disclose information where legally required, or to protect the rights and safety of our users and the public.
Where data is stored
Data is stored in the United States, in AWS us-west-2 (Oregon). Access is restricted to personnel who need it to operate the service, protected by row level isolation between firms, encryption in transit, and encryption at rest.
How long we keep it
- Account and firm data: for the life of the subscription, then 30 days after closure, then permanent deletion.
- Google tokens: until disconnected or revoked, then immediately.
- Billing records: as long as tax and accounting law requires.
- Logs: up to 90 days.
Your choices
Users can export all firm data to CSV at any time from inside the product, disconnect a Google account without affecting anything else, and close an account, which starts the deletion window.
Depending on where you live you may have rights to access, correct, delete, or port your personal information, and to object to certain processing. Write to hello@demure.ai and we will respond within the period the applicable law requires.
If you are a candidate or client contact in a recruiting firm's records, that firm controls your data. Contact the firm directly, or write to us and we will route the request.
Security
Each firm's data is isolated at the database level rather than only in the interface. Credentials for connected services are held server side and never sent to a browser. Access to production is limited and logged.
No system is perfectly secure. If a breach affects your data we will notify you as the law requires.
Children
Demure is business software and is not directed at anyone under 16. We do not knowingly collect their information.
Changes
We will update this page and change the date above. For changes that materially affect how we handle personal information, we will notify account administrators by email before the change takes effect.