Maslow Privacy policy

Maslow is designed to support structured interviews, evidence capture, and interview reporting. The Services help hiring teams prepare, run, and review interviews, including by enabling note-taking, scoring frameworks, interview summaries, transcripts, and analytics. Some features use automated and AI-assisted processing.

This Privacy policy is written for three audiences:

• Website visitors and prospective customers.
• Customer users (interviewers, recruiters, hiring managers, administrators).
• Candidates and other interview participants whose personal data may be processed within a customer's Maslow workspace.

"Customer" means the organisation that purchases or uses the Services for its hiring or interviewing processes.

"User" means an individual authorised by a Customer to access and use the Services.

"Candidate" means an individual interviewed or assessed using the Services.

"Customer Content" means information submitted to or generated through the Services within a Customer workspace, including recordings, transcripts, notes, feedback, and reports.

"Personal data" has the meaning given under applicable data protection law and generally means information relating to an identified or identifiable person.

Maslow can act in different "roles" under data protection law depending on the context:

(a) Maslow as controller

Maslow acts as a controller for personal data we process for our own business purposes, such as: Operating our websites and marketing pages. Managing sales, demos, and customer relationships. Billing, subscriptions, and account administration. Providing security, fraud prevention, and abuse detection. Providing customer support, handling enquiries, and managing our internal operations.

(b) Maslow as processor

For most Customer Content (for example candidate interview recordings, transcripts, interview notes, and reports stored in a Customer workspace), Maslow processes personal data on behalf of the Customer. In those contexts, the Customer is the controller (or equivalent) and Maslow is the processor (or equivalent). Where required, these obligations are further set out in the Data Processing Addendum.

This matters because Candidates typically have their relationship with the Customer as the hiring organisation. In many cases, the Customer is responsible for providing Candidate notices, selecting a lawful basis, and determining retention settings, while Maslow processes personal data under the Customer's documented instructions.

We process personal data in four main categories.

Website and marketing data

When you visit our website(s) or contact us, we may process:

• Contact details and professional information (such as name, email address, company, role).
• Communications (such as messages, enquiries, and attachments you send to us).
• Device and usage data (such as IP address, device identifiers, browser type, approximate location derived from IP, pages viewed, and interaction events).
• Cookie and similar technology data as described in our Cookie policy.

Account, workspace, and administration data

When a Customer creates and administers an account, we may process:

• User identity and authentication data (name, email address, user role, login events, multi-factor authentication status where implemented).
• Workspace configuration data (organisation name, permissions, integrations enabled, retention settings, consent settings, and audit logs).
• Billing and subscription data (billing contact details, invoices, plan selection, payment status). Payment card details are typically handled by payment providers and not stored directly by Maslow, where this is how the Service is configured.

Interview and hiring workflow data (Customer Content)

Depending on the Customer's configuration, the Services may process:

• Candidate identifying and contact data (name, email, role applied for, and related application identifiers).
• CVs, resumes, job descriptions, and role planning documents uploaded to the Services or synced from an applicant tracking system.
• Interview scheduling data (interview event metadata, time and date, participant list, meeting link identifiers, calendar event identifiers).
• Interview evidence and feedback, including interviewer notes, structured scorecards, qualitative feedback, and hiring process status markers.
• Candidate feedback, where the Customer chooses to collect it (for example experience ratings or written feedback via secure links).
• Interview recordings and transcripts where enabled, including audio and video content, speaker attribution, and derived outputs such as summaries, key topics, and structured reports.

Technical, security, and operational data

To operate securely and reliably, we may process:

• System logs, audit logs, and security logs (including access events and administrative actions).
• Diagnostic data, performance metrics, error reports, and crash logs.
• Integration metadata and tokens where integrations are enabled (for example calendar and ATS connection metadata), subject to the Customer's configuration.

Data minimisation note: Maslow is designed to process interview-related data within the Customer's hiring workflow. We do not intentionally collect general web browsing history or capture content from websites unrelated to Maslow-enabled workflows. The Services are not intended to be used to collect personal data unrelated to legitimate hiring and interview processes.

We collect personal data:

• Directly from you (for example when you create an account, use the Services, or contact us).
• From the Customer (for example when the Customer uploads Candidate information, schedules interviews, or configures integrations).
• From connected systems the Customer authorises (for example an ATS, calendar system, or video conferencing workflow, depending on configuration).
• From service providers that support security, hosting, and operational tooling (for example for fraud prevention, logging, and support).

For Candidates, much of the personal data we process may be provided by the Customer rather than directly by the Candidate.

We process personal data for the following purposes:

Service delivery and operations: To provide and operate the Services, including interview preparation workflows, live interview support, and post-interview reporting. To authenticate Users and enforce role-based access controls and workspace permissions. To provide transcripts, summaries, and other requested outputs where enabled by the Customer.

Safety, security, and abuse prevention: To protect the Services, Customer workspaces, Candidates, and Users from fraud, misuse, unauthorised access, and security threats. To maintain audit logs and investigate suspicious activity.

Support and customer relationship management: To respond to support requests and provide customer assistance. To communicate about Service changes, operational notices, and important updates.

Product improvement: To maintain, debug, and improve the Services, including improving reliability and developing new features. Where we use usage data for product improvement, we aim to minimise personal data and, where feasible, use aggregated or de-identified data.

Legal and compliance: To comply with applicable law, lawful requests, and to establish, exercise, or defend legal claims.

Where Maslow acts as controller, we rely on the following legal bases (where applicable under UK GDPR and similar frameworks):

• Performance of a contract (for example providing the Services to a Customer, administering accounts, and providing support).
• Legitimate interests (for example securing our Services, preventing fraud, improving our Services, and managing our business), balanced against individual rights.
• Consent (for example for non-essential cookies, and for specific optional features where we present a choice).
• Compliance with legal obligations.

Where Maslow acts as processor on behalf of a Customer, the Customer is responsible for selecting and documenting the lawful basis for processing Candidate and User personal data, and Maslow processes personal data under the Customer's instructions and the applicable data protection agreement.

Recording and transcription features are configured and controlled within the Customer's workspace.

Customer responsibilities

Customers are responsible for: Informing Candidates and other interview participants about recording, transcription, and analysis where enabled. Obtaining any required consents under applicable law. Ensuring their use of the Services complies with employment, privacy, and labour laws, including any rules relating to workplace monitoring and recording.

Maslow's operational approach

Where recording is enabled, interview audio and (where applicable) video may be captured to create a transcript and generate related outputs. Where recording is disabled, or where required consent is not obtained or is withdrawn, features dependent on recording and transcription may be unavailable for that session. Customers can configure workflows so that certain outputs are suppressed when consent is not available.

Some features produce automated or AI-assisted outputs such as summaries, insights, structured reports, scores, or recommendations.

How Maslow uses AI-assisted processing

AI-assisted processing can analyse Customer Content to generate interview summaries, structured notes, interview prompts, candidate reports, and other outputs requested through the Services. AI outputs can be probabilistic, contextual, and may be incomplete or inaccurate. They are intended to support human review rather than replace it.

No solely automated hiring decisions

Maslow is designed to support structured interviewing and evidence capture. The Services are not intended to make hiring decisions. Customers remain responsible for deciding how to use outputs in their hiring workflows, including ensuring appropriate human review.

Biometric identification statement

Maslow is not designed to create or use voiceprints or other biometric identifiers for the purpose of uniquely identifying individuals. If a Customer enables audio recording for transcription, audio is processed to produce transcripts and related outputs, not to identify people via biometrics.

We do not sell personal data. We may share personal data in the following scenarios:

Within a Customer workspace: Customer administrators and authorised Users can access Customer Content according to role-based permissions configured by the Customer. The Customer may export or share reports within its organisation. The Customer controls these activities.

Service providers and subprocessors: We use service providers (subprocessors) to host, process, and support the Services (for example cloud hosting, monitoring, customer support tooling, transcription, and AI processing providers where enabled). Subprocessors act under contractual obligations to protect personal data and use it only to provide services to Maslow (and ultimately to the Customer).

Integrations and third-party platforms: The Services may integrate with third-party platforms (for example ATS, calendar, and video conferencing platforms) that the Customer chooses to connect. Data exchanged with those platforms is governed by the Customer's configuration and the third party's own terms and privacy practices.

Legal and corporate disclosures: We may disclose personal data if required by law, court order, or lawful request, or to protect rights, safety, and security. If we undergo a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be disclosed as part of due diligence and transferred as part of the transaction, subject to appropriate protections.

Aggregated and de-identified data: We may create aggregated and de-identified data derived from use of the Services to understand product performance, improve the Services, and produce statistical reports, provided such data does not identify a Candidate, User, or Customer.

Maslow operates globally, and personal data may be processed in countries outside the United Kingdom or European Economic Area depending on Customer configuration and the location of service providers.

Where applicable law requires safeguards for international transfers, we use appropriate mechanisms such as: Standard Contractual Clauses (SCCs). The UK International Data Transfer Addendum (UK Addendum) to the SCCs. Other lawful transfer mechanisms recognised under applicable law. Details are typically set out in the Data Processing Addendum and related transfer documentation.

We retain personal data only for as long as necessary for the purposes described in this Privacy policy, subject to legal obligations and the Customer's configuration.

Customer Content retention

Customers typically control retention periods for interview data within their workspace, including retention of transcripts, reports, and related artefacts. The Services may offer configurable retention settings (for example candidate data deletion windows and transcript retention periods), which may vary by plan and feature configuration. When a Customer ends its use of the Services, return or deletion of Customer Content is handled according to the applicable contract terms and data protection agreement, subject to limited retention required for legal compliance and the integrity of backups for a limited period.

Website and business records

We retain website inquiry records, contract records, billing records, and support records for as long as necessary for business operations, accounting and tax obligations, and legal defence.

We implement technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

Security measures may include: Encryption in transit and at rest where supported by the relevant storage systems. Role-based access controls and least-privilege access. Audit logging of key workspace and administrative actions. Segregation of Customer workspaces to prevent cross-customer access. No system can be guaranteed 100 percent secure. Customers are responsible for maintaining secure access to their accounts and ensuring Users follow appropriate security practices.

We use cookies and similar technologies on our websites and online services. For detailed information, including categories of cookies, consent controls, and how to change preferences, read our Cookie policy.

Rights vary by jurisdiction, but may include the right to: Access your personal data. Correct inaccurate personal data. Delete personal data or request deletion. Object to or restrict processing in certain circumstances. Withdraw consent where processing is based on consent. Receive a copy of personal data you provided to us in a portable format (where applicable). Lodge a complaint with a relevant supervisory authority.

Candidate rights requests

If you are a Candidate, the Customer is typically the controller of your personal data for hiring activities and may be best placed to address your request. If you contact Maslow directly, we may redirect you to the Customer or assist the Customer in responding, consistent with applicable data protection agreements and law.

How to exercise rights

Send requests to privacy@maslowhq.com. We may need to verify identity and request additional information to process a request securely. We may refuse requests where permitted by law, for example where fulfilling the request would adversely affect the rights of others or where we must retain data for legal reasons.

The Services are intended for business use in hiring and interviewing contexts and are not directed to children. We do not knowingly collect personal data from children.

We may update this Privacy policy from time to time to reflect changes in technology, law, or our practices. We will update the "Last updated" date and, where appropriate, provide additional notice through the Services or by email.

This section applies to Maslow browser extension(s), including the Maslow Chrome Extension (the "Extension").

When the Extension operates

The Extension is designed to operate only in the context of supported interview workflows, such as when a User is preparing for, joining, or conducting a scheduled interview session through the Services. The Extension is not intended to run continuously in the background outside Maslow-enabled workflows.

What the Extension may access and process

Depending on Customer configuration and the permissions granted at installation, the Extension may access and process:

• Interview session context required to render Maslow features (for example interview event identifiers, role context, agenda and question prompts, and permitted on-screen interface overlays).
• User-generated content entered by the interviewer during an interview (for example notes, structured scores, and feedback submitted through the Extension).
• Meeting metadata needed to associate activity with the correct interview (for example meeting identifiers, timing, and participant context).
• Where enabled by the Customer, and where legally permitted, audio and video from an interview session for the purpose of recording and transcription, leading to generation of transcripts and outputs within the Customer workspace.

Consent and feature gating

If recording and transcription are disabled, or where required consent is not available, the Extension should not capture recording data for that session and features dependent on it may be suppressed. Customers control interview settings and are responsible for communicating with Candidates about recording and data use as required by law.

What the Extension does not do

• The Extension is not designed to collect general browsing history.
• The Extension is not designed to read or capture content from unrelated websites outside supported workflows.
• The Extension is not designed to capture background audio, background video, or screen content outside active interview sessions.

Authentication and access controls

The Extension uses authentication and session controls (including secure tokens where applicable) to ensure only authorised Users can access Customer workspaces and submit interview artefacts. Access may be time-limited (for example guest or candidate access links may expire) and subject to session timeouts.

Sharing and storage for Extension data

Data submitted through the Extension is stored within the Customer workspace in the Services and is subject to the sharing, retention, and security controls described in this Privacy policy. Extension data may be transmitted to Maslow infrastructure and subprocessors as needed to provide the Services (for example hosting, transcription and AI processing where enabled), under appropriate contractual protections.

Uninstall and controls

You can uninstall the Extension at any time using your browser's extension management controls. Uninstalling the Extension stops it from operating on your device. Uninstalling does not automatically delete data previously submitted to the Services; deletion requests are handled as described in the "Data retention" and "Your rights and choices" sections.