This Privacy Policy explains how Novatree.ai ("Novatree," "we," "us") collects, uses, and protects personal information. Because Novatree is a hiring and organizational-intelligence platform, we handle personal information in two very different roles. This policy is organized around that distinction.
The two roles in one sentence
When you visit our website, we decide how your information is used (we are the "controller"). When our customers use Novatree to manage candidates and employees, the customer decides how that information is used, and Novatree only acts on their instructions (we are the "processor").
Data-protection laws such as the EU GDPR, the UK GDPR, and the California Consumer Privacy Act (as amended by the CPRA) distinguish between the party that decides why and how personal information is processed (the controller) and the party that processes it on the controller's behalf (the processor).
If your questions relate to how a specific employer uses your information inside Novatree, please contact that employer directly — they control that information, not us.
This part covers personal information we collect from visitors to novatree.ai — for example, when you request access, contact us, or browse the site.
We rely on your consent (where required), our legitimate interests in operating and growing our business, and compliance with legal obligations. Where we rely on legitimate interests, we balance them against your rights.
We use a minimal set of cookies and similar technologies necessary to run the site and understand aggregate usage. We do not sell personal information and do not use third-party advertising cookies. Where required, we ask for your consent before setting non-essential cookies.
This part covers personal information processed inside the Novatree platform — the candidate, applicant, and employee data our customers put into, or connect to, the Services.
Novatree is the processor here
We process this information only on the documented instructions of the customer who controls it, as set out in our customer agreement and Data Processing Addendum. We do not have a direct relationship with the individuals whose information we process on a customer's behalf, and we do not use it for our own purposes.
Depending on how a customer configures Novatree, this may include: names and contact details; resume/CV content; work history and skills; application and interview records; organizational and reporting-structure data; role, level, and team information; and other information the customer chooses to manage in the platform. Customers are responsible for the information they choose to process and for having a lawful basis to do so.
Directly from the customer's users; from individuals interacting with the customer (for example, applicants); and through integrations the customer authorizes with their existing HR systems.
We do not sell this information, and we do not use it to build independent profiles of individuals outside the customer's instance.
Where Novatree provides scoring, ranking, matching, or other automated analysis, these features are tools to support human decision-making. The customer remains responsible for how they use outputs and for compliance with laws governing automated decision-making and fairness in employment (for example, the EU AI Act, and U.S. federal, state, and local requirements). Novatree supports customers in using these features responsibly, with human oversight.
We use a limited set of vetted service providers ("subprocessors") to deliver the Services. Each is bound by data-protection terms consistent with this policy and our customer agreements. Our current infrastructure and processing subprocessors are listed on our Sub-processors page, and the terms they are engaged under in our Data Processing Agreement.
We apply administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including encryption in transit and at rest, access controls on a least-privilege basis, logging and monitoring, and a formal vendor-risk process. Our infrastructure runs on Amazon Web Services (AWS). Details, including our compliance roadmap, are on our Security & Trust page.
Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing.
We will not discriminate against you for exercising your rights. You may also have the right to lodge a complaint with your local data-protection authority.
Website data: we keep it only as long as needed for the purposes above, then delete or anonymize it. Platform data: we retain it for as long as the customer's agreement requires, and we delete or return it on the customer's instruction or at the end of the relationship, subject to legal retention obligations.
We operate on AWS infrastructure and may process information in the United States and other countries where we or our subprocessors operate. Where personal information moves across borders, we rely on appropriate safeguards such as Standard Contractual Clauses (and the UK Addendum) where required.
We may update this policy from time to time. We will post the updated version here with a new effective date and, where appropriate, notify customers directly.
For any privacy question, or to exercise a right relating to website data, contact privacy@novatree.ai.
This page is provided for general information and to support customer due diligence. It is not legal advice. Novatree.ai should have this document reviewed by qualified privacy counsel before it is relied upon, particularly regarding GDPR/UK GDPR, CCPA/CPRA, and jurisdiction-specific employment-data obligations.