Privacy Policy

Tick Up (“we”, “us”, or “our”) operates the recruitment management platform available at tickup.vn (the “Service”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using Tick Up, you agree to the terms of this Privacy Policy. If you do not agree, please discontinue use of the Service immediately.

2.1 Account Information

When you register for an account, we collect your full name, email address, and authentication credentials. If you sign in via Google OAuth, we receive your name, email, and profile picture from Google. If you connect Google Calendar, we access your calendar events data (via the calendar.events scope) solely to create and manage interview events on your behalf.

2.2 Organization Data

As a multi-tenant platform, each workspace (tenant) stores its own organizational data including company name, company page content, subdomain preferences, and team member information. This data is strictly isolated between tenants.

2.3 Candidate Data

You may upload candidate information including resumes/CVs, contact details, skills, experience, and assessment scores. This data is uploaded and managed solely by your organization. Tick Up processes this data on your behalf as a data processor.

2.4 Usage & Technical Data

We automatically collect technical information such as IP address, browser type, device information, pages visited, and access timestamps. We use cookies and similar technologies to maintain sessions and improve the Service.

For account security and accountability, we also keep two kinds of security logs: (a) sign-in records (IP address and browser information for each login or session refresh), and (b) a workspace action audit trail that records high-impact actions performed by your team members (for example closing or deleting a job posting, bulk-rejecting applicants, sending recruitment emails, or changing a member's role) together with the acting user, their IP address, and browser information. The audit trail is visible only to your workspace administrators and exists so that your organization can answer “who did this action?” questions. See Section 9 for how long these logs are kept.

2.5 Uploaded Files

Files such as CVs, company logos, and career page images are stored securely on Cloudflare R2 object storage. Production and development environments use separate, isolated storage buckets with scoped access tokens.

• Provide, operate, and maintain the Service
• Authenticate users and manage access control
• Process and store candidate data on behalf of your organization
• Generate recruitment reports and analytics for your workspace
• Enable AI-powered features such as JD-CV matching and CV parsing
• Send transactional emails (account verification, password reset, recruitment notifications)
• Monitor and improve platform performance, security, and reliability
• Comply with legal obligations

Tick Up uses AI features to assist with candidate screening, JD-CV fit scoring, and CV information extraction. These features process candidate data within your workspace to provide suggestions and scores.

Important: We do not use your candidate data or organizational data to train external AI/ML models. AI processing is performed solely to deliver the Service to you.

Tick Up is built with a strict multi-tenant architecture. Every database query is scoped to your organization's tenant ID. This means:

• Your data is logically isolated from all other organizations
• No cross-tenant data access is possible through the application
• Each workspace operates independently with its own candidates, jobs, and reports
• Deleted data is soft-deleted (marked as inactive) and excluded from all queries

We implement industry-standard security measures to protect your data:

• Database: Hosted on Neon.tech (PostgreSQL) in the Asia-Pacific (Singapore) region with SSL-encrypted connections
• File Storage: Cloudflare R2 with separate production and development buckets, each with scoped API tokens
• Authentication: Passwords are hashed using bcrypt. Sessions are managed via JWT tokens with configurable expiration
• Bot Protection: Cloudflare Turnstile CAPTCHA on authentication endpoints
• Transport: All traffic is encrypted via HTTPS/TLS
• Rate Limiting: API endpoints are rate-limited to prevent abuse

We use the following third-party services to operate the platform:

Each third-party provider is subject to their own privacy policy. We select providers that maintain appropriate security standards.

Tick Up's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We request the following Google OAuth scopes:

• https://www.googleapis.com/auth/gmail.send — Send email on the user's behalf. Used only to send recruitment-related emails (interview invitations, application confirmations, follow-ups, offer letters, rejections) that the user has explicitly composed inside Tick Up.
• https://www.googleapis.com/auth/calendar.events — Create, view, and manage interview events the user schedules through Tick Up. Used only when the user opts in by connecting Google Calendar.

We do not read, modify, label, archive, or delete any messages in the user's mailbox. We do not transfer this data to any third party for advertising, ad serving, or any purpose unrelated to providing or improving the user-facing features of Tick Up. We do not use this data to train AI or machine-learning models.

Connecting a Google mailbox or calendar is strictly opt-in. Users can revoke access at any time from Google Account Permissions or from the Tick Up Settings page. Upon revocation, the stored OAuth refresh token is deleted immediately.

We retain your account and organizational data for as long as your account is active. When you delete records within the platform, they are soft-deleted (marked as inactive) and excluded from all application queries.

Security logs containing IP addresses are retained for limited periods and then deleted automatically:

• Workspace action audit trail: entries (including the acting user's IP address and browser information) are automatically deleted after 180 days.
• Sign-in records: stored alongside each session token and automatically deleted when the token expires or is revoked.

If you wish to permanently delete your account and all associated data, please contact us at the email below. We will process the request within 30 business days.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Export your data in a portable format
• Withdraw consent for optional data processing
• Lodge a complaint with a data protection authority

To exercise any of these rights, please contact us using the information in Section 13.

Tick Up uses essential cookies to maintain your authentication session and language preferences. We do not use third-party advertising or tracking cookies.

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review this page periodically. Continued use of the Service after changes constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy, please contact us: