Maslow Privacy policy

Maslow is designed to support structured interviews, evidence capture, and interview reporting. The Services help hiring teams prepare, run, and review interviews, including by enabling note-taking, scoring frameworks, interview summaries, transcripts, and analytics. Some features use automated and AI-assisted processing.

This Privacy policy is written for three audiences:

• Website visitors and prospective customers.
• Customer users (interviewers, recruiters, hiring managers, administrators).
• Candidates and other interview participants whose personal data may be processed within a customer's Maslow workspace.

"Customer" means the organisation that purchases or uses the Services for its hiring or interviewing processes.

"User" means an individual authorised by a Customer to access and use the Services.

"Candidate" means an individual interviewed or assessed using the Services.

"Customer Content" means information submitted to or generated through the Services within a Customer workspace, including recordings, transcripts, notes, feedback, and reports.

"Personal data" has the meaning given under applicable data protection law and generally means information relating to an identified or identifiable person.

Maslow can act in different "roles" under data protection law depending on the context:

(a) Maslow as controller

Maslow acts as a controller for personal data we process for our own business purposes, such as: Operating our websites and marketing pages. Managing sales, demos, and customer relationships. Billing, subscriptions, and account administration. Providing security, fraud prevention, and abuse detection. Providing customer support, handling enquiries, and managing our internal operations.

(b) Maslow as processor

For most Customer Content (for example candidate interview recordings, transcripts, interview notes, and reports stored in a Customer workspace), Maslow processes personal data on behalf of the Customer. In those contexts, the Customer is the controller (or equivalent) and Maslow is the processor (or equivalent). Where required, these obligations are further set out in the Data Processing Addendum.

This matters because Candidates typically have their relationship with the Customer as the hiring organisation. In many cases, the Customer is responsible for providing Candidate notices, selecting a lawful basis, and determining retention settings, while Maslow processes personal data under the Customer's documented instructions.

We process personal data in four main categories.

Website and marketing data

When you visit our website(s) or contact us, we may process:

• Contact details and professional information (such as name, email address, company, role).
• Communications (such as messages, enquiries, and attachments you send to us).
• Device and usage data (such as IP address, device identifiers, browser type, approximate location derived from IP, pages viewed, and interaction events).
• Cookie and similar technology data as described in our Cookie policy.

Account, workspace, and administration data

When a Customer creates and administers an account, we may process:

• User identity and authentication data (name, email address, user role, login events, multi-factor authentication status where implemented).
• Workspace configuration data (organisation name, permissions, integrations enabled, retention settings, consent settings, and audit logs).
• Billing and subscription data (billing contact details, invoices, plan selection, payment status). Payment card details are typically handled by payment providers and not stored directly by Maslow, where this is how the Service is configured.

Interview and hiring workflow data (Customer Content)

Depending on the Customer's configuration, the Services may process:

• Candidate identifying and contact data (name, email, role applied for, and related application identifiers).
• CVs, resumes, job descriptions, and role planning documents uploaded to the Services or synced from an applicant tracking system.
• Interview scheduling data (interview event metadata, time and date, participant list, meeting link identifiers, calendar event identifiers).
• Interview evidence and feedback, including interviewer notes, structured scorecards, qualitative feedback, and hiring process status markers.
• Candidate feedback, where the Customer chooses to collect it (for example experience ratings or written feedback via secure links).
• Interview recordings and transcripts where enabled, including audio and video content, speaker attribution, and derived outputs such as summaries, key topics, and structured reports.

Technical, security, and operational data

To operate securely and reliably, we may process:

• System logs, audit logs, and security logs (including access events and administrative actions).
• Diagnostic data, performance metrics, error reports, and crash logs.
• Integration metadata and tokens where integrations are enabled (for example calendar and ATS connection metadata), subject to the Customer's configuration.

Data minimisation note: Maslow is designed to process interview-related data within the Customer's hiring workflow. We do not intentionally collect general web browsing history or capture content from websites unrelated to Maslow-enabled workflows. The Services are not intended to be used to collect personal data unrelated to legitimate hiring and interview processes.

We collect personal data:

• Directly from you (for example when you create an account, use the Services, or contact us).
• From the Customer (for example when the Customer uploads Candidate information, schedules interviews, or configures integrations).
• From connected systems the Customer authorises (for example an ATS, calendar system, or video conferencing workflow, depending on configuration).
• From service providers that support security, hosting, and operational tooling (for example for fraud prevention, logging, and support).

For Candidates, much of the personal data we process may be provided by the Customer rather than directly by the Candidate.

We process personal data for the following purposes:

Service delivery and operations: To provide and operate the Services, including interview preparation workflows, live interview support, and post-interview reporting. To authenticate Users and enforce role-based access controls and workspace permissions. To provide transcripts, summaries, and other requested outputs where enabled by the Customer.

Safety, security, and abuse prevention: To protect the Services, Customer workspaces, Candidates, and Users from fraud, misuse, unauthorised access, and security threats. To maintain audit logs and investigate suspicious activity.

Support and customer relationship management: To respond to support requests and provide customer assistance. To communicate about Service changes, operational notices, and important updates.

Product improvement: To maintain, debug, and improve the Services, including improving reliability and developing new features. Where we use usage data for product improvement, we aim to minimise personal data and, where feasible, use aggregated or de-identified data.

Legal and compliance: To comply with applicable law, lawful requests, and to establish, exercise, or defend legal claims.

Where Maslow acts as controller, we rely on the following legal bases (where applicable under UK GDPR and similar frameworks):

• Performance of a contract (for example providing the Services to a Customer, administering accounts, and providing support).
• Legitimate interests (for example securing our Services, preventing fraud, improving our Services, and managing our business), balanced against individual rights.
• Consent (for example for non-essential cookies, and for specific optional features where we present a choice).
• Compliance with legal obligations.

Where Maslow acts as processor on behalf of a Customer, the Customer is responsible for selecting and documenting the lawful basis for processing Candidate and User personal data, and Maslow processes personal data under the Customer's instructions and the applicable data protection agreement.

Recording and transcription features are configured and controlled within the Customer's workspace.

Customer responsibilities

Customers are responsible for: Informing Candidates and other interview participants about recording, transcription, and analysis where enabled. Obtaining any required consents under applicable law. Ensuring their use of the Services complies with employment, privacy, and labour laws, including any rules relating to workplace monitoring and recording.

Maslow's operational approach

Where recording is enabled, interview audio and (where applicable) video may be captured to create a transcript and generate related outputs. Where recording is disabled, or where required consent is not obtained or is withdrawn, features dependent on recording and transcription may be unavailable for that session. Customers can configure workflows so that certain outputs are suppressed when consent is not available.

Some features produce automated or AI-assisted outputs such as summaries, insights, structured reports, scores, or recommendations.

How Maslow uses AI-assisted processing

AI-assisted processing can analyse Customer Content to generate interview summaries, structured notes, interview prompts, candidate reports, and other outputs requested through the Services. AI outputs can be probabilistic, contextual, and may be incomplete or inaccurate. They are intended to support human review rather than replace it.

No solely automated hiring decisions

Maslow is designed to support structured interviewing and evidence capture. The Services are not intended to make hiring decisions. Customers remain responsible for deciding how to use outputs in their hiring workflows, including ensuring appropriate human review.

Biometric identification statement

Maslow is not designed to create or use voiceprints or other biometric identifiers for the purpose of uniquely identifying individuals. If a Customer enables audio recording for transcription, audio is processed to produce transcripts and related outputs, not to identify people via biometrics.

We do not sell personal data. We may share personal data in the following scenarios:

Within a Customer workspace: Customer administrators and authorised Users can access Customer Content according to role-based permissions configured by the Customer. The Customer may export or share reports within its organisation. The Customer controls these activities.

Service providers and subprocessors: We use service providers (subprocessors) to host, process, and support the Services (for example cloud hosting, monitoring, customer support tooling, transcription, and AI processing providers where enabled). Subprocessors act under contractual obligations to protect personal data and use it only to provide services to Maslow (and ultimately to the Customer).

Integrations and third-party platforms: The Services may integrate with third-party platforms (for example ATS, calendar, and video conferencing platforms) that the Customer chooses to connect. Data exchanged with those platforms is governed by the Customer's configuration and the third party's own terms and privacy practices.

Legal and corporate disclosures: We may disclose personal data if required by law, court order, or lawful request, or to protect rights, safety, and security. If we undergo a merger, acquisition, financing, reorganisation, or sale of assets, personal data may be disclosed as part of due diligence and transferred as part of the transaction, subject to appropriate protections.

Aggregated and de-identified data: We may create aggregated and de-identified data derived from use of the Services to understand product performance, improve the Services, and produce statistical reports, provided such data does not identify a Candidate, User, or Customer.

Maslow operates globally, and personal data may be processed in countries outside the United Kingdom or European Economic Area depending on Customer configuration and the location of service providers.

Where applicable law requires safeguards for international transfers, we use appropriate mechanisms such as: Standard Contractual Clauses (SCCs). The UK International Data Transfer Addendum (UK Addendum) to the SCCs. Other lawful transfer mechanisms recognised under applicable law. Details are typically set out in the Data Processing Addendum and related transfer documentation.

We retain personal data only for as long as necessary for the purposes described in this Privacy policy, subject to legal obligations and the Customer's configuration.

Customer Content retention

Customers typically control retention periods for interview data within their workspace, including retention of transcripts, reports, and related artefacts. The Services may offer configurable retention settings (for example candidate data deletion windows and transcript retention periods), which may vary by plan and feature configuration. When a Customer ends its use of the Services, return or deletion of Customer Content is handled according to the applicable contract terms and data protection agreement, subject to limited retention required for legal compliance and the integrity of backups for a limited period.

Website and business records

We retain website inquiry records, contract records, billing records, and support records for as long as necessary for business operations, accounting and tax obligations, and legal defence.

We implement technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

Security measures may include: Encryption in transit and at rest where supported by the relevant storage systems. Role-based access controls and least-privilege access. Audit logging of key workspace and administrative actions. Segregation of Customer workspaces to prevent cross-customer access. No system can be guaranteed 100 percent secure. Customers are responsible for maintaining secure access to their accounts and ensuring Users follow appropriate security practices.

We use cookies and similar technologies on our websites and online services. For detailed information, including categories of cookies, consent controls, and how to change preferences, read our Cookie policy.

Rights vary by jurisdiction, but may include the right to: Access your personal data. Correct inaccurate personal data. Delete personal data or request deletion. Object to or restrict processing in certain circumstances. Withdraw consent where processing is based on consent. Receive a copy of personal data you provided to us in a portable format (where applicable). Lodge a complaint with a relevant supervisory authority.

Candidate rights requests

If you are a Candidate, the Customer is typically the controller of your personal data for hiring activities and may be best placed to address your request. If you contact Maslow directly, we may redirect you to the Customer or assist the Customer in responding, consistent with applicable data protection agreements and law.

How to exercise rights

Send requests to privacy@maslowhq.com. We may need to verify identity and request additional information to process a request securely. We may refuse requests where permitted by law, for example where fulfilling the request would adversely affect the rights of others or where we must retain data for legal reasons.

The Services are intended for business use in hiring and interviewing contexts and are not directed to children. We do not knowingly collect personal data from children.

We may update this Privacy policy from time to time to reflect changes in technology, law, or our practices. We will update the "Last updated" date and, where appropriate, provide additional notice through the Services or by email.

This section applies to Maslow browser extension(s), including the Maslow Chrome Extension (the "Extension").

Chrome Extension specific privacy disclosures

This section applies to the Maslow Chrome Extension and any related Maslow browser extension used to support live interview workflows.

The Extension is designed for one purpose: to help authorised interviewers prepare for, run, and complete structured interviews inside supported video meeting environments such as Google Meet. It is not designed for general browsing, website monitoring, advertising, behavioural profiling, or activity tracking outside Maslow-enabled interview workflows.

When the Extension operates

The Extension operates only in connection with a supported interview workflow, such as when an authorised user is preparing for, joining, conducting, or completing an interview through Maslow.

The Extension may activate when it detects or receives a meeting link associated with a Maslow interview event. It uses that meeting link to match the interview to the correct Maslow interview record, candidate, role, agenda, questions, prompts, notes, scoring workflow, and reporting workflow.

The Extension is not intended to run continuously in the background outside Maslow-enabled interview activity.

Data the Extension may access or process

Depending on the customer’s configuration, the user’s permissions, and the interview settings, the Extension may access or process the following categories of data:

1. Interview context data

   This may include:

   • interview event identifiers
   • meeting link identifiers
   • candidate name and interview details
   • role title and role context
   • interview stage, date, time, duration, and participant information
   • saved interview agenda, questions, and prompts
   • competency framework and scoring criteria

   This information is used to show the right interview content to the right authorised user at the right time.

2. Interviewer-entered data

   This may include:

   • notes entered during the interview
   • positive or negative signals marked during the interview
   • structured scores submitted after the interview
   • strengths, concerns, and qualitative feedback
   • post-interview assessment data

   This data is stored in the customer’s Maslow workspace and is linked to the relevant interview event, candidate, role, and authorised interviewer.

3. Recording and transcript data, where enabled

   Where recording and transcription are enabled, legally permitted, and not disabled by the customer or candidate preference, the Extension and related Maslow systems may support the capture or processing of:

   • interview audio
   • interview video, where applicable
   • speaker attribution, where available
   • interview transcripts
   • AI-assisted summaries
   • structured interview insights
   • competency-based analysis
   • Maslow Match Rate and Confidence Level outputs
   • candidate and hiring team reports

   Recording and transcript-dependent processing only happen where the relevant settings and lawful basis allow it.

4. Technical and operational data

   To keep the Extension secure and reliable, Maslow may process limited technical data, such as:

   • extension activation events
   • feature usage events
   • authentication and access events
   • error logs
   • crash logs
   • diagnostic data
   • performance data
   • security and audit logs

   This data is used to operate, secure, debug, and improve the Extension and related Maslow services.

Recording, transcription, and candidate choice

Recording behaviour is controlled by the customer’s Maslow configuration and the applicable interview settings.

Where recording is enabled, candidates should be informed before the interview that Maslow may record and transcribe the interview to support structured interview evidence, reporting, and feedback. The customer is responsible for ensuring the correct notice, lawful basis, and consent or objection process is in place for its hiring process and jurisdiction.

Where a candidate objects to recording, withdraws consent where consent is required, or where recording is otherwise disabled:

• the Extension must not record the interview
• no transcript is created
• transcript-dependent AI analysis is not generated
• Maslow Match Rate and Confidence Level outputs dependent on that recording may be unavailable
• live AI support may be limited or disabled
• the interview may continue in Manual Mode, where authorised interviewers can still take notes and submit manual feedback

Manual Mode allows the hiring team to complete the interview without recording or transcript-based AI processing.

What the Extension does not do

• collect general web browsing history
• monitor websites unrelated to Maslow-enabled interviews
• read or capture unrelated page content
• capture background audio outside an active supported interview session
• capture background video outside an active supported interview session
• capture screen content outside supported interview functionality
• collect personal data for advertising
• sell personal data
• use interview content for behavioural advertising
• make hiring decisions automatically

Maslow’s AI-assisted outputs are designed to support human review and structured decision-making. They are not intended to replace human judgement or make solely automated hiring decisions.

Chrome Web Store Limited Use disclosure

The Extension uses personal data only to provide, secure, maintain, and improve Maslow’s interview workflow features.

Maslow does not use Extension data for purposes unrelated to the Extension’s single purpose. Maslow does not sell Extension data. Maslow does not use Extension data for advertising, cross-site tracking, credit decisions, or unrelated behavioural profiling.

Where Maslow transfers Extension data to service providers or subprocessors, this is done only where necessary to provide, secure, maintain, or improve the Services, or where required by law. These providers are required to protect personal data and use it only for the services they provide to Maslow.

Authentication and access controls

The Extension uses secure authentication and access controls to ensure only authorised users can access interview data.

Access may be provided through:

• an authenticated Maslow account
• a secure token passed from the Maslow web app to the Extension
• a secure guest interviewer invite linked to a specific interview event

Guest interviewer access is limited to the assigned interview. Guest interviewers do not receive general dashboard access and cannot browse unrelated candidates, roles, reports, or workspace data.

Access may be time-limited and may expire after the relevant interview session.

Storage and sharing of Extension data

Data submitted or generated through the Extension is stored in the relevant customer workspace within Maslow.

Access to that data is controlled by the customer’s workspace permissions and Maslow’s role-based access controls. Authorised users may include talent partners, hiring managers, interviewers, administrators, and other users permitted by the customer.

Maslow may process Extension data using service providers and subprocessors that support hosting, storage, transcription, AI processing, monitoring, security, diagnostics, support, and related infrastructure.

Maslow does not make raw recordings or transcripts publicly accessible.

Analytics and product improvement

Maslow may use limited analytics and diagnostic data to understand whether the Extension is working properly, improve reliability, fix bugs, secure the platform, and improve user-facing interview functionality.

Maslow does not use interview content, recordings, transcripts, notes, scores, or AI-generated interview insights for advertising or unrelated marketing profiling.

Where Maslow uses aggregated or de-identified data to understand product performance, it is designed so that it does not identify a candidate, interviewer, customer, or interview participant.

Retention and deletion

Extension data follows the retention rules described in this Privacy Policy, the customer’s workspace settings, and any applicable agreement between Maslow and the customer.

Customer content, including interview records, notes, transcripts, reports, and related artefacts, is retained only for as long as necessary for the relevant purposes, subject to customer configuration, legal requirements, backup integrity, audit requirements, and contractual obligations.

Uninstalling the Extension stops it from operating on the user’s device. It does not automatically delete data already submitted to Maslow. Deletion, access, correction, objection, restriction, and portability requests are handled under the rights and choices section of this Privacy Policy.

User controls

Users can uninstall the Extension at any time using Chrome’s extension management controls.

Customers can configure workspace settings, access permissions, retention settings, recording settings, and interview workflows within Maslow, where those controls are available.

Candidates can use the consent, objection, or opt-out process provided for the relevant interview workflow, where applicable.

Third-party platforms

The Extension may be used alongside third-party platforms such as Google Meet, Zoom, Microsoft Teams, calendar systems, applicant tracking systems, and other tools connected by the customer.

Those third-party platforms are governed by their own privacy notices, terms, and data handling practices. Maslow is not responsible for the privacy practices of third-party platforms that the customer chooses to use alongside Maslow.