Your data is yours.
We keep it that way.

Last updated October 2026

TL;DR

One cookie (sidebar preference)
No ad tech or session recording
Cookieless visit counts on public pages only
AI is opt-in and BYOK only
Candidate names never go to AI, shares or downloads
Row-level security on all data

What we collect

PlatoVue is a recruiting analytics tool. We store only what you explicitly upload or configure:

Recruiting data: Requisitions, candidates, and pipeline events from your CSV uploads or ATS sync. Stored in your organization's database with row-level security.
Candidate names: Kept apart from the rest of your data in a separate encrypted store. Shown only to accounts an organization admin has explicitly granted, and every view of a name is recorded. Email addresses and phone numbers are not ingested.
Account information: Email address and organization membership, managed through secure authentication.
Product analytics: Lightweight usage counts — which tabs you visit, when you generate a brief. No candidate names, no PII, no browsing history.

Cookies and local storage

sidebar:state: A UI preference cookie that remembers whether your sidebar is open or closed.
Auth session: Your login token is stored in local storage so you stay signed in. Never sent to third parties.
Display preferences: Choices like data masking live in your browser's local storage. Candidate names are never written to it.

No advertising cookies. No fingerprinting. The one outside script is Vercel's cookieless visit counter, on the public pages only.

Third-party services

Supabase

Database, auth, and server functions. Row-level security on all tables.

Vercel

Hosts the PlatoVue website, and counts visits to the public pages and the sign-in page (Vercel Web Analytics): the page, the site you came from, country and device type. No cookies, and nothing from inside the app. Vercel may log standard request data per their policy.

Google sign-in

Only if you sign in with Google. Google shares your email address and basic profile (name and picture) with us.

Google Fonts

Typography only. Google may log standard request data per their policy.

Greenhouse and Juicebox

Only if your organization connects them. PlatoVue reads your recruiting data from them with the key you give it.

That's the complete list, apart from the AI provider you choose to connect (below). No ad networks, no session recording, and no outside analytics inside the app.

AI features (bring your own key)

The AI copilot is entirely opt-in. You provide your own API key.

Key storage: Kept for this browser session only, or saved to your account. A saved key is encrypted on PlatoVue’s server (AES-256-GCM) with a key PlatoVue holds. A key an admin adds for the organization is shared with every member, encrypted the same way.
Candidate names: Never included in AI requests: they are not in the data the app sends to a model. Recruiter and hiring manager names, emails and phone numbers in that data are redacted when redaction is on. The text you type in a question is sent as typed.
Routing: AI requests go through a server-side proxy. No data goes directly from your browser to AI providers. Your key travels with each request to that proxy, which passes it to the provider.

Data security

All data transmitted over HTTPS.

Database access controlled by row-level security — users only see their organization’s data.

Candidate names are stored only in a separate encrypted store, apart from your recruiting data.

Names are shown only to accounts an organization admin has explicitly granted, and every view of a name is recorded.

Candidate names are never included in AI requests, shares, downloads or logs.

An admin can also allow someone to see only a candidate's initials, such as "J…S", instead of the full name.

The data masking toggle is a display setting for your own screen; it does not change who can see names.

If an admin turns on benchmark sharing, only aggregates (a median and a count across customers) are computed from your data, shown only when at least five organizations contribute, and never names, roles or candidates.

To run the service, PlatoVue staff can see aggregate metrics per organization (such as a median time to fill and the count behind it), never names, roles or candidates, and every such view is logged.

The nightly benchmark job runs on Vercel, where PlatoVue is hosted: it reads your recruiting records (ids and dates, never names) for the seconds a run takes, writes only the aggregates, and stores nothing else there.

If you connect PlatoVue to an AI assistant such as Claude, it receives the numbers your dashboard shows and, for people allowed to see pay, req pay bands and offer pay (base, sign-on, equity), scoped to the organizations you choose, never candidate names, and every request is logged for your admins.

When an AI assistant is connected, PlatoVue keeps a prepared copy of your recruiting records (ids, dates and stages, never candidate names) inside your own database so answers come back in seconds; it is rebuilt after each sync and visible only to members of your organization.

Retention and deletion

Data is retained while your organization is active. Records of who viewed candidate names are kept for 365 days.

Deleted in your ATS: If your organization syncs from Greenhouse and a person is deleted or anonymized there, PlatoVue removes their name too. Their application records stay, without the name. Data you imported from a file does not change when you delete someone in your ATS.
Deleting an organization: An admin can delete an organization in Settings. That removes its requisitions, candidates, pipeline events, data snapshots, people, settings, invites and shared AI keys. It does not yet remove everything: candidate names, share links (they keep working until you turn them off), the Greenhouse and Juicebox connections and their keys, and saved history such as open-role status snapshots, sourcing counts and goals stay, with a record that the organization existed. Turn off share links before you delete, and remove PlatoVue’s key in Greenhouse to stop its access.
Your account: Accounts cannot be deleted from inside PlatoVue yet. An admin can remove you from an organization; your account stays. A record of each organization you created is kept, because the limit of 3 per account counts it.

Policy changes

Material changes update the date at the top of this page. Continued use after changes constitutes acceptance.