Privacy Policy

1. Scope and Roles

Depending on the context, STRACT may act as an independent business or controller of Personal Information, or as a service provider or processor acting on documented instructions from a client. Where STRACT processes Personal Information solely on behalf of a client, the applicable client agreement and Data Processing Addendum govern that processing.

2. Information We Collect

• Identity and contact information, including name, business email, telephone number, employer, title, and professional identifiers.
• Candidate and professional information, including resumes, work history, education, certifications, skills, compensation expectations, work authorization information where appropriate, availability, interview information, references, submissions, and placement information.
• Client and workforce information, including requisitions, departments, hiring managers, budgets, approvals, rates, statements of work, workforce plans, supplier information, and performance records.
• Supplier information, including company details, contacts, agreements, insurance documents, compliance materials, rate cards, diversity classifications, candidate submissions, and performance information.
• Consultant and engagement information, including assignments, rates, managers, dates, timesheets, expenses, onboarding information, deliverables, compliance status, and engagement performance.
• Financial and transaction information, including invoices, billing records, payment status, fees, purchase orders, markups, and budgets. Payment credentials may be handled by third-party payment providers.
• Account, authentication, device, log, cookie, session, IP address, browser, operating system, security-event, and platform-usage information.
• Communications, support requests, feedback, meeting notes, and other information submitted to STRACT.

3. Sources of Information

We may collect information directly from individuals and organizations, and may receive information from clients, approved suppliers, candidates, consultants, service providers, integration partners, professional networks, public professional sources, and other lawful sources.

4. How We Use Information

• Operate, maintain, secure, support, and improve the Services.
• Create and administer accounts, authenticate users, and manage permissions.
• Manage requisitions, candidate sourcing and submissions, interviews, offers, onboarding, engagements, suppliers, offboarding, and related workforce processes.
• Manage contracts, rates, budgets, invoices, payments, reporting, forecasting, analytics, and audit trails.
• Communicate with users, provide support, prevent fraud and misuse, investigate security events, enforce agreements, and comply with law.
• Develop and improve products, workflows, analytics, and services using information in a manner permitted by applicable agreements and law.

5. Client Data

As between STRACT and a client, the client retains its rights in Client Data. Clients authorize STRACT to process Client Data as reasonably necessary to provide, secure, maintain, support, and improve the contracted Services, subject to the applicable agreement and law. Clients are responsible for having appropriate rights, notices, permissions, and lawful bases for data they provide.

6. Candidate Information

Candidate information may be shared with authorized prospective employers, client users, hiring managers, approved suppliers, and service providers where reasonably necessary to provide recruiting and workforce services. STRACT will not knowingly submit a confidential candidate profile to an unrelated prospective employer without authorization or another lawful basis.

7. Disclosure of Information

• Authorized client users, candidates, consultants, suppliers, and staffing partners as appropriate to the applicable workflow.
• Cloud, hosting, authentication, communications, analytics, security, CRM, payment, and other service providers supporting the Services.
• Professional advisers, auditors, insurers, financing or transaction counterparties subject to appropriate obligations.
• Government authorities, regulators, courts, or law enforcement where required or permitted by law.
• A successor or acquiring entity in connection with a merger, acquisition, financing, restructuring, or sale.

8. Sale, Sharing, and Advertising

STRACT does not sell Personal Information for money. If STRACT engages in conduct that constitutes a "sale," "sharing," targeted advertising, or similar regulated activity under applicable law, STRACT will provide disclosures and opt-out mechanisms required by that law.

9. AI and Automated Technologies

STRACT may use artificial intelligence, machine learning, and automation to assist with matching, search, summarization, recommendations, analytics, workflow automation, forecasting, and risk identification. Unless expressly disclosed otherwise, these technologies are intended to assist human decision-making rather than serve as the sole basis for decisions producing significant legal or similarly significant effects. Users remain responsible for reviewing AI-generated outputs before relying on them.

10. Security

STRACT maintains administrative, technical, organizational, and physical safeguards designed to protect information, which may include encryption in transit and at rest, role-based access, least privilege, multi-factor authentication, logging and monitoring, secure development practices, backups, vulnerability management, vendor controls, and incident-response procedures. No system can guarantee absolute security.

11. Retention and Deletion

STRACT retains information only as long as reasonably necessary for the purposes described in this Policy, including service delivery, business records, dispute resolution, contractual enforcement, legal obligations, fraud prevention, security, and audit requirements. When information is no longer reasonably required, STRACT may delete, anonymize, or securely dispose of it, subject to backup cycles and legal requirements.

12. Privacy Rights

Depending on applicable law, individuals may have rights to access, correct, delete, obtain a portable copy of, restrict, or object to certain processing of Personal Information; withdraw consent where processing relies on consent; or opt out of certain sale, sharing, targeted advertising, or profiling. Requests may be submitted to privacy@stract.us. STRACT may verify identity and may deny or limit requests where permitted by law.

13. Cookies and Similar Technologies

STRACT may use cookies, local storage, pixels, session technologies, and similar technologies for authentication, security, preferences, functionality, analytics, and performance. Where required, STRACT will obtain consent or provide applicable opt-out controls.

14. Children

The Services are intended for business and professional users and are not directed to children under 13. STRACT does not knowingly collect Personal Information from children through the Services except where legally permitted and appropriately authorized.

15. International Processing

Information may be processed in the United States and other jurisdictions in which STRACT or its providers operate. Where required, STRACT will implement recognized mechanisms governing international transfers.

16. Changes to this Policy

STRACT may update this Policy periodically. The current version will be identified by the Last Updated date. Material changes will be communicated where required by law.

17. Contact

Privacy inquiries and data-rights requests may be directed to STRACT, Inc., Attn: Privacy, at privacy@stract.us.