This Privacy Policy explains what personal data SiftFirst collects, how we use it, and the choices you have. SiftFirst is a candidate-screening assistant: you paste a job description and applications, and we return a ranked, explainable shortlist.
1. Who we are
SiftFirst is operated by Jivaseva OU (registry code 12142627), Lootuse tn 1-6, Kiili alev, Kiili vald, 75401 Harju maakond, Estonia. For anything in this policy, contact us through the contact form at siftfirst.com/contact.
For data you provide about yourself (your account), we are the data controller. For the application materials you upload about other people (candidates), you are the controller and we act as your processor: we handle that data only to provide the screening you ask for. See section 9.
2. The data you put into SiftFirst
To screen candidates you give us:
- Job descriptions and the screening criteria (rubric) you set or edit.
- Candidate application materials: resumes and pasted text, uploaded files (PDF), ZIP archives, or CSV rows. These commonly contain personal data of third parties (names, contact details, work history).
- The screening results we generate (scores, evidence quotes, summaries), which we save to your account so you can view them later.
3. Account and technical data we collect
- Account data: your email address and a securely hashed password when you create an account.
- Usage and device data: analytics about how the site is used. We use PostHog, hosted in the European Union. It stores a random identifier in your browser's local storage so repeat visits can be counted as one person, and records only the events we have chosen to record, such as starting a screening or opening the pricing page. It does not set an analytics cookie, does not record your screen, and does not track you across other websites.
- Authentication: a sign-in token stored in your browser so you stay logged in. This is essential to the service.
- Ad attribution: if you reach us from one of our Google Ads links, the click identifier in that link (gclid) is stored in your browser for up to 30 days and, if you create an account, saved with it. We use it only to tell which ads lead to signups, and we may report that signup back to Google Ads as a conversion. We do not load Google's tracking script on this site.
4. How we use your information
- To run the screening you request and return your ranked shortlist with evidence.
- To save your screenings to your account history so you can revisit and re-weight them.
- To operate, secure, and improve the service, and to respond to your support messages.
- To meet legal obligations (for example, retaining limited billing records).
We do not sell your data, and we do not use the resumes or screening content you submit to train our own models or anyone else's.
5. AI processing of candidate data
Screening is performed by a large language model. To produce scores and evidence, the job description, your criteria, and each candidate's text are sent to our AI provider OpenRouter, which routes the request to an underlying model provider (for example Anthropic). These providers process the data to return a result and are bound by their terms not to use it to train models. We send only what is needed to screen, and candidate text is truncated to a reasonable length.
6. SiftFirst does not make decisions about people
SiftFirst ranks and explains to assist a human reviewer. It does not make, and is not designed to make, a solely automated decision that produces legal or similarly significant effects about a candidate. You set the criteria, you review the evidence, and you make every hiring decision. You should not use SiftFirst to auto-reject applicants.
7. Who we share data with
We share data only with service providers (subprocessors) that help us run SiftFirst, under contracts that require them to protect it:
- OpenRouter and the underlying model providers it routes to (for example Anthropic), to generate screening results.
- Our hosting and database provider (Railway), to run the application and store your account and saved screenings.
- Brevo (France), to send transactional email such as sign-in, password reset, and billing notices.
- PostHog (European Union region), for product and website analytics.
We may also disclose data if required by law, or to protect our rights, users, or the public.
8. Cookies and analytics
SiftFirst does not use advertising or cross-site tracking cookies. We use only what is strictly necessary to run the service (your sign-in token), and PostHog analytics, which sets no cookie and instead keeps a random identifier in your browser's local storage. You can turn analytics off any time in Cookie Preferences, linked in the footer, which stops collection immediately. You can also clear site storage in your browser at any time, though doing so will sign you out.
9. Data retention
- Saved screenings (including the candidate text and results) are kept in your account until you delete them or delete your account.
- Account data is kept while your account is active. When you delete your account, we delete your account and all your saved screenings, normally immediately and at the latest within 30 days.
- Limited records we are legally required to keep (for example billing records) are retained for the period the law requires.
Because you are the controller of candidate data, you decide how long to keep each screening; we provide the tools to delete it.
10. Your rights
If you are in the EU or EEA, the GDPR gives you the right to access, correct, delete, export, restrict, or object to the processing of your personal data, and to withdraw consent. You can:
- Delete your account and all saved screenings yourself, from your account settings (Erase, GDPR right to erasure).
- Request a copy of your personal data (data portability) through the contact form at siftfirst.com/contact.
- Contact us through the contact form at siftfirst.com/contact for any other request.
You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or your local supervisory authority.
11. Your responsibilities for candidate data
When you upload application materials about other people, you confirm that you have a lawful basis to process that data and to share it with us for screening, and that you will inform candidates and honor their rights as the law where you hire requires. You remain responsible for using SiftFirst fairly and in line with anti-discrimination and data-protection law.
12. International transfers
SiftFirst is hosted in the United States. Our application servers and our database run in Railway's US West region, so your account, your saved screenings and the application materials you upload are stored there, and our AI provider processes screening requests in the United States as well. Jivaseva OU remains the controller in Estonia and this policy governs that data wherever it sits.
For transfers out of the EU/EEA we rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where a provider is certified under it, and on the European Commission's Standard Contractual Clauses otherwise.
13. Security
We use industry-standard measures (encryption in transit, hashed passwords, access controls) to protect data. No system is perfectly secure, but we work to keep your data safe and to limit what we collect and retain.
14. Children
SiftFirst is a business tool and is not intended for anyone under 16. We do not knowingly collect personal data from children through account sign-up.
15. Changes to this policy
We may update this policy as the service evolves. We will change the date above and, for material changes, give notice in the app or by email. Continuing to use SiftFirst after a change means you accept the updated policy.
16. Contact
Questions or requests: the contact form at siftfirst.com/contact, or Jivaseva OU, Lootuse tn 1-6, Kiili alev, Kiili vald, 75401 Harju maakond, Estonia.