Privacy policy

Who we are

Source ATS (“Source”, “we”) is an applicant tracking system operated by Academy UX LLC. This policy covers the hosted service. The open-source edition runs entirely on the installer’s own infrastructure, where this policy doesn’t apply — their deployment, their data.

What we collect

• Account information — your name, work email, and workspace settings.
• Recruiting data your team puts in Source — candidate profiles, resumes, notes, scorecards, interview transcripts, job postings, and the rest of the hiring record. Your workspace controls this data; candidates can request access or erasure through the workspace that holds their record, and erasure removes them from everything Source derived from their data.
• Gmail, when a recruiter connects their own inbox — Source searches only for messages exchanged with the email addresses of candidates already in your workspace, and stores only those matched messages. Unrelated inbox content is never stored, displayed, or processed. If sending is enabled, Source sends only messages a recruiter wrote or explicitly approved, from their own mailbox.
• Google Calendar, when enabled — Source creates and updates the calendar events for interviews scheduled in Source, and reads nothing else from the calendar.
• Slack, when an admin connects it — Source reads only the channels an admin explicitly links, plus direct messages people send to the Source bot. Unlinking a channel deletes the messages Source kept and everything it learned from them.
• Usage and log data — the operational basics needed to run and secure the service.

How we use it

To provide the product: recovering candidate conversations, scheduling, outreach, and the AI features your workspace turns on — candidate evaluations, drafting, and what Source learns about how your team hires. AI features process your data to produce results for your workspace; your data is not used to train generative models, is never sold, and is never used for advertising. What Source learns in one workspace never informs another, and for agencies, what it learns about one client never informs another client.

AI features deliberately never consider protected characteristics — age, gender, race or ethnicity, religion, disability, family status, national origin, and stand-ins for them — and every AI output is advisory: no candidate is advanced or rejected by software.

Google user data — Limited Use

Source’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: Google data is used only to provide the features described above, is never sold or used for ads, is never used to train generalized AI models, and no human reads it except with your explicit consent for support, for security, or where the law requires.

Who else touches the data

The infrastructure the service runs on: hosting and databases (Vercel, Neon), the model providers behind the AI features, and Google and Slack for the integrations you connect. Each processes data only to provide their part of the service. We never sell personal data or share it for advertising.

Security, retention, deletion

• Everything travels over TLS; integration credentials are stored encrypted (AES-256-GCM) and are deleted the moment an integration is disconnected.
• Disconnecting Gmail stops all access immediately. Unlinking a Slack channel deletes its stored messages and what was learned from them.
• Erasing a candidate removes their record and everything derived from it, including quotes kept from connected sources.
• Workspaces can export their data and can end the service and request deletion of everything.

Questions

Ask your workspace admin, or email support@b150.ai. We’ll update this page as the product grows; material changes are dated above.