In plain words. Ornelle is hiring software. For the people who use Ornelle, and for visitors to our website, we decide how personal data is used, and this policy explains it. For candidates, the company that uses Ornelle decides, and we only handle the data on its behalf. We do not sell personal data, we do not show ads, and we do not use customer or candidate data to train our own AI models. Our servers are in France; a few of the services we rely on are in the United States, and section 9 says which.
1. Who we are and our two roles
Ornelle is operated by Briph Inc, a Delaware corporation (“Ornelle”, “we”, “us”). You can reach us at privacy@ornelle.co or support@ornelle.co.
We handle personal data in two different roles, and the difference matters:
- Account and website data. This is about the people who sign up for Ornelle, use the app, visit ornelle.co or write to us. For this data we are the controller: we decide why and how it is used. This policy describes it.
- Candidate data. This is about the people who apply to, or are tracked by, a company that uses Ornelle (our customer). For this data the customer is the controller and we are its processor (a “service provider” under California law): we handle the data only on the customer’s instructions and to provide the service.
If you applied for a job through Ornelle, the company you applied to is responsible for your data, and its privacy notice applies. Send requests about your application to that company. If you write to us instead, we will tell you that we act for the company and pass your request to it, and we will help it respond.
2. Information we collect
| Whose data | What | Where it comes from |
|---|---|---|
| People who use Ornelle | Name, work email, password (stored scrambled, so we cannot read it), profile details such as working hours and time zone, workspace name and settings | You and your teammates |
| Content in a workspace | Openings, forms, email templates, notes, messages, saved views, settings, and what you send us as support messages or feedback | You and your teammates |
| Billing | Plan, subscription status, number of seats and billing contact. We never receive or store full card numbers: payments are handled by our payment provider | You and our payment provider |
| Usage and device | Pages and features used, approximate location from your IP address, browser and device type, and errors | Collected automatically in the app |
| Website visitors and people who write to us | Email address and the content of your message | You |
| Candidates, on behalf of our customers | Whatever the customer collects: name, email, phone, links (for example LinkedIn or a portfolio), CV or resume files and the text taken from them, cover letters, answers to application questions, interview notes, reviews and scores, messages and emails exchanged, meeting details, and the history of an application | The candidate, the customer and services the customer connects |
| Visitors to a careers page | Technical signals such as IP address and browser details, used by the spam and bot checks | Collected automatically |
We do not ask for or need special categories of data (such as health, ethnicity or religion). Customers decide what to collect through their forms, and they must not collect special-category data unless the law allows it.
3. How we use information, and why
Where GDPR or UK GDPR applies, we need a legal basis for each use. This table gives ours for the data we control.
| Purpose | Data | Basis |
|---|---|---|
| Provide, secure and support the service, and take payment | Account, content, billing, usage | Contract |
| Prevent fraud, abuse and spam; keep records; defend legal claims | Account, usage, technical | Legitimate interests; legal obligation |
| Understand and improve the product, and find and fix errors | Usage, device, errors | Legitimate interests |
| Send service messages (receipts, security notices, changes to the service) | Account | Contract; legitimate interests |
| Reply to messages and requests | Contact details, message | Legitimate interests |
| Comply with the law and respond to lawful requests | Any | Legal obligation |
We do not sell personal data, and we do not share it for third-party advertising. We do not run advertising on Ornelle.
4. AI features
Some Ornelle features use AI models:
- reading an uploaded resume to pull out contact details, experience and skills, and its text;
- creating a numerical representation of a resume (an “embedding”) that can be used for search, and answering plain-language searches;
- helping a customer set up a workspace, for example drafting opening descriptions and email templates, or reading an existing careers page to create openings.
When one of these features runs, the content it needs, such as the text of a resume, is sent to our AI providers (listed on the sub-processors page) and the result comes back to the customer’s workspace. We use it only to produce that result. We do not use customer or candidate data to train our own AI models.
Ornelle does not make hiring decisions. It does not score, rank or reject candidates using AI. Customers can set up their own rules, for example to send an email when a status changes, and are responsible for how they use them.
5. Who we share information with
- Service providers (sub-processors). We use a small number of companies to run Ornelle: hosting, file storage, email delivery, payments, analytics and AI. They may handle data only to provide their service to us, under contract. The current list, with what each does and where, is on the sub-processors page. We update it before we add or change one that handles customer data.
- Services a customer connects. If a customer switches on a connection to a service such as Google Calendar, Zoom or Zoho, data flows to that service as the customer authorises. That service has its own privacy policy and acts for itself.
- Legal and safety. We may disclose data if the law requires it, or to protect the rights, safety or security of people or the service.
- Business changes. If Ornelle is involved in a merger, acquisition or sale, personal data may transfer to the new owner, and we will tell you first.
6. Cookies and similar technologies
| Name or kind | What it does | Where | How long |
|---|---|---|---|
Sign-in cookie (ats_token) | Keeps you signed in | App | Up to 14 days |
File access cookies (CloudFront-…) | Lets your browser load files stored for your workspace, such as logos and CVs | App and careers pages | About a day and a half |
| Preferences in local storage | Remembers settings such as the theme | App | Until you clear it |
| Product analytics identifier (PostHog) | Tells us how the app is used and where it fails; linked to your user ID once you sign in | App, not careers pages | Up to one year |
| Cloudflare performance measurement | Measures page speed without cookies or tracking across sites | App and website | Not stored in your browser |
The first three are necessary to provide the service. We do not use analytics on careers pages, and we do not use advertising cookies anywhere. The analytics in the app measure page views, clicks and errors. You can ask us to switch analytics off for your account by writing to privacy@ornelle.co, and you can block storage in your browser settings, although parts of the app may then stop working.
7. How long we keep data
- Customer and candidate data is kept for as long as the customer’s workspace exists, and the customer controls what is kept: it can delete records at any time. When a workspace is closed or a customer asks us to delete it, we delete its data from our systems within 30 days.
- Account data is kept while your account is active and removed within 30 days of closure, except what we must keep, such as invoices and security logs.
- Backups are encrypted and kept for about two weeks, then expire. Deleted data can remain in backups until then.
- Analytics and error data is kept for up to 12 months.
8. Security
We take security seriously and we describe it plainly. Connections to Ornelle are encrypted. Passwords are stored scrambled. Our database runs on servers we manage ourselves, behind a firewall, with access limited to the people who need it and key-based sign-in. Backups are encrypted. We monitor the service and are alerted when something looks wrong. We keep software up to date, and we investigate incidents and tell affected customers without undue delay, and within 72 hours where the law requires.
No system is perfectly secure, and we do not hold a security certification. If you find a vulnerability, please write to support@ornelle.co and we will look into it.
9. Where data is processed
Ornelle’s application and database run on servers we operate in France (OVHcloud). Encrypted backups are stored with Cloudflare in the European Union. Some services we rely on are based in the United States: file storage and delivery (Amazon Web Services, in its US West region), email delivery (Twilio SendGrid), product analytics (PostHog’s US cloud), AI providers and Cloudflare’s global network.
When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the EU-US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses otherwise.
10. Your rights
Depending on where you live (for example under GDPR, UK GDPR or the California Consumer Privacy Act), you may have the right to access, correct, delete or export your data, to object to or restrict some uses, to withdraw consent you gave, and to complain to your data protection authority.
- Account and website data: write to privacy@ornelle.co. We reply within one month.
- Candidate data: contact the company you applied to. If you write to us, we will pass your request to that company and help it respond.
We do not treat you differently for exercising your rights. We may need to confirm who you are before we act on a request.
11. Residents of the EU, the UK and Switzerland
For the data we control, our legal bases are in section 3. You have the right to complain to your local supervisory authority, for example the Information Commissioner’s Office in the UK, or the data protection authority of your EU country. We have not appointed an EU or UK representative; you can reach us at privacy@ornelle.co.
12. California residents
In California we act as a “service provider” for candidate data, and as a “business” for account and website data. We do not sell or share personal information as those terms are defined in California law. You can ask to know what we hold about you, or to correct or delete it, as described in section 10.
13. Google user data
If a customer connects a Google account, for example Google Calendar for interview scheduling, Ornelle’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use that information only to provide the connection the customer asked for.
14. Children
Ornelle is for businesses and is not directed to anyone under 16. We do not knowingly collect personal data from children. If you believe we have, write to privacy@ornelle.co and we will delete it.
15. Changes to this policy
We will post any change here and update the effective date. If a change materially affects customers, we will email account owners at least 30 days before it takes effect.
16. Contact
Briph Inc, operating as Ornelle. Privacy requests: privacy@ornelle.co. Everything else: support@ornelle.co.
Questions about this document? Write to support@ornelle.co. For privacy requests, write to privacy@ornelle.co.