Legal

Privacy policy

How Kermit Tech AS handles personal data about the people who use HireOSS: account holders, their colleagues and visitors to this site.

Last updated: 28 October 2026

If you applied for a job and want to know how your application was assessed, read the candidate privacy notice instead.

01Who is responsible

Kermit Tech AS (organisation number 927 441 217), L. P. Wettres vei 5, 1392 Vettre, Norway, is the controller for the data described here.
Send privacy questions and requests to contactus@hireoss.io.
We have not appointed a data protection officer, because the law does not require one for our kind of processing. The address above reaches the people responsible for privacy.

People who create an account, and the colleagues they invite.
Billing contacts, and people who contact us.
Visitors to the public parts of this site.
It does not cover candidate data. We process that only on our customers’ instructions, as described in the candidate privacy notice and the data processing agreement.

Account details: name, work email, organisation and department membership, and role.
Sign-in data: a hash of your password if you use one, two-factor secrets, and an account identifier from Google or Microsoft if you sign in with them.
Security and usage records: sign-in times, IP addresses, and a log of significant actions in an organisation.
Technical details of errors you run into.
Billing contact details and invoices. Card details go straight to our payment provider and never reach us.
What you tell us when you contact us.
Your name and email are needed to create an account. Without them we cannot provide the service. Everything else is optional or created as you use the service.

To provide the service you or your organisation signed up for. The basis is our contract (GDPR Article 6(1)(b)). For colleagues invited by a customer, it is our and the customer’s legitimate interest in giving them access (Article 6(1)(f)).
To keep accounts secure, prevent abuse and fix errors. The basis is our legitimate interest in running a safe and reliable service (Article 6(1)(f)).
To keep accounting records. The basis is our legal obligation under the Norwegian Bookkeeping Act (Article 6(1)(c)).
To send service email, such as verification, invitations, password resets and notifications. The basis is our contract.
To send news and product updates, only if you have opted in. The basis is your consent (Article 6(1)(a)).
To answer you when you contact us. The basis is our legitimate interest.
Where we rely on legitimate interest, you can object at any time, as explained under “Your rights”.

We receive your name, email address and an account identifier. We do not receive your password, contacts or files.
Signing in this way links to your existing account rather than creating a second one.
The provider applies its own privacy terms to the sign-in itself.

The assistant in HireOSS is an AI. You are not talking to a person, and its answers can be wrong.
Your questions are sent to the AI service listed on the sub-processors page, and are not used to train AI models.

We do not run product analytics, and we do not record sessions.
When something breaks, technical details of the error are sent to PostHog, hosted in the EU. Nothing is stored in your browser for this.
The cookie policy lists everything we store in your browser.

Service email is sent to every account. It covers verification, invitations, password resets and notifications you can turn off in your settings.
Marketing email is sent only if you opt in. Every message has an unsubscribe link, and opting out does not affect service email.
Delivery and bounce records are kept only as long as needed to fix delivery problems.

Hosting, storage, email delivery, payments, AI services, error monitoring and bot protection are provided by other companies acting on our instructions.
The sub-processors page names each one, what it does and where. We never sell personal data.

Our servers and document storage are in the EEA, in France and Sweden.
Some providers are in the United States, as the sub-processors page shows. For those transfers we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses.
You can ask us for a copy of the safeguards that apply.

Account data, for as long as the account exists. When an organisation closes its account, it has 30 days to export its data, and we delete it after that.
Security and audit records, for as long as the organisation’s account exists, so its administrators can review them.
Error records, for 30 days.
Accounting records, for 5 years, as the Bookkeeping Act requires.
Backups are deleted on a rolling cycle of up to 90 days.

A small number of authorised people can access customer data to operate and support the platform.
That access requires two factors, is granted outside the application rather than through it, and is recorded.

You can ask to see, correct, delete or receive a copy of your data, and ask us to restrict how we use it.
You can object to processing based on legitimate interest, and you can always opt out of marketing.
Where you have given consent, you can withdraw it at any time. This does not affect what was done before.
Email contactus@hireoss.io. We answer within one month. For complex requests this can be extended by two further months, and we will tell you why.
You can complain to Datatilsynet, the Norwegian Data Protection Authority.

We publish every change on this page and update the date at the top.
If a change materially affects how we use your data, we email account administrators at least 30 days before it takes effect.