These Terms govern use of the Hyroo applicant tracking service by the organisation that subscribes ("Customer") and its authorised users. The Data Processing Agreement governs personal data and forms part of these Terms.
Provider is to be completed — legal entity, registered number and address, and these Terms are accepted to be completed — acceptance mechanism, and order of precedence with any order form.
A multi-tenant, hosted applicant tracking system: job and candidate management, pipeline progression, interview scheduling, communication, reporting, and AI-assisted matching, scoring and drafting.
Feature availability varies by plan and by pilot enrolment. A substantial part of the service is released as per-workspace pilots that are off by default and enabled per customer. Nothing in marketing material entitles a Customer to a capability that is not enabled on its workspace, and Customer should confirm what is enabled before relying on it.
Customer is responsible for the accuracy of its registration details, for its users' compliance with these Terms, and for the confidentiality of credentials. Customer must notify Provider promptly of any suspected unauthorised access.
Subscription fees are charged in advance for each billing period through our payment processor. Except where the law requires otherwise, or where these Terms say otherwise, fees are non-refundable.
Currency and tax treatment are to be completed — currency, VAT or GST treatment, and sales-tax position. Charges for additional seats, changes part-way through a term, renewal and price-change notice, cancellation, and refunds are to be completed — each must match what the service can actually do before it is stated here.
Whether an evaluation period is offered, its duration, whether payment details are required, and what becomes of Customer data at the end of it, are to be completed. Until this section is settled, section 2 governs: what a Customer is entitled to is what is enabled on its workspace.
Customer must not use the service to break the law; upload malicious code; infringe intellectual property; harass anyone; attempt to breach the service's security or reach another customer's data; or reverse engineer the service except as the law permits.
Recruitment-specific. Customer must not use the service to discriminate unlawfully. Customer must comply with employment, equal-opportunity and data-protection law in every jurisdiction it recruits in, must have a lawful basis for every candidate record it uploads or sources, and must honour candidate opt-outs.
The service produces AI-generated match scores and summaries. These are decision support, not decisions. Customer remains the decision-maker for every hiring outcome and is responsible for meaningful human review.
Where Customer enables sourcing or automated scoring, Customer is responsible for any notice, consent, bias-audit or explanation obligation that applies to it — including the EU AI Act's requirements for employment-related systems, and municipal automated-employment-decision-tool rules such as New York City Local Law 144. Provider supplies supporting material — a model card, adverse-impact statistics and a per-decision log — but does not perform Customer's bias audit and does not issue Customer's candidate notices.
How these responsibilities divide between Provider and Customer under the EU AI Act's provider and deployer roles is to be completed — some obligations may fall on Provider regardless of this clause.
Where Customer enables sourcing, Customer is responsible for its own compliance with the terms of the source platforms, and for the lawful basis for processing the profiles of people who have not applied to it.
Customer owns its data. Customer grants Provider a licence to host, process and transmit it solely to provide the service, and as the Data Processing Agreement permits.
Provider owns the service and the intellectual property in it. No rights are granted other than the right to use the service during the term.
Training. Provider does not use Customer data, and does not use candidate personal data, to train any machine-learning model. Candidate text is sent to a third-party model provider for inference only, in order to produce the output Customer asked for. Whether Provider may use aggregated, de-identified usage data to improve the service is to be completed.
Availability commitments, service credits, support channels, response targets and maintenance windows are to be completed — no availability or recovery target will be committed to here that the operation cannot meet.
Provider maintains the technical and organisational measures described in Annex A of the Data Processing Agreement, and notifies Customer of personal-data breaches as set out there.
Provider holds no SOC 2 or ISO 27001 certification and does not claim one. Annex A describes controls that exist in the software; it is not an audit result.
Each party protects the other's confidential information with at least reasonable care, and uses it only to perform these Terms.
These Terms run for the subscription term and renew unless cancelled. Provider may suspend the service for non-payment, for a material breach of section 6, or for a security risk. Notice and cure periods are to be completed — and must match how the software actually behaves on a lapsed payment.
On termination Customer may export its data. Deletion follows section 9 of the Data Processing Agreement.
Each party warrants that it has authority to enter these Terms. Provider warrants that it will provide the service with reasonable skill and care.
Except as expressly stated, the service is provided "as is". Provider does not warrant that AI-generated scores, summaries or drafts are accurate, complete or free from bias, nor that profile data retrieved from third-party sources is accurate or current.
Consumer-protection carve-outs that apply in a particular jurisdiction are to be completed.
Liability caps, exclusions and carve-outs — and whether either party indemnifies the other, and on what procedure — are to be completed, and must align with the Data Processing Agreement.
Provider may update these Terms on notice, and material changes take effect at the next renewal. The notice period and channel, and what counts as material, are to be completed.
Assignment, subcontracting, force majeure, severability, entire agreement and notices apply on conventional terms. Governing law, venue, whether arbitration applies, and the address for notices are to be completed.