Greenhouse Privacy Policy

This Privacy Policy, last updated May 28, 2026, governs Greenhouse Software, Inc.'s collection, use, and disclosure of Personal Information in four contexts: as a processor for customer recruiting workflows, as a controller in B2B commercial relationships, as a controller in its own employment context, and as a controller for the MyGreenhouse consumer job-search service. The policy states that Greenhouse does not sell Personal Information of job candidates or individuals with whom it has no direct relationship, and that data subjects may exercise access, correction, deletion, portability, and objection rights via a Data Subject Request Portal. A materially significant provision authorizes Greenhouse to use MyGreenhouse users' Personal Information to develop and train artificial intelligence models and automated systems, a disclosure that is operationally distinct from standard recruiting platform privacy terms and raises questions about the scope of AI training consent for individual job seekers. The policy engages GDPR, UK GDPR, CCPA as amended by CPRA, and the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF; Greenhouse states FTC investigatory and enforcement jurisdiction applies to its DPF compliance obligations. Compliance considerations include the adequacy of consent mechanisms for AI model training under GDPR and CPRA, the sufficiency of the MyGreenhouse opt-out mechanism for EEA and UK users as an alternative to account closure, and Greenhouse's stated responsibility for onward transfers to third parties under DPF Principles.