Hiring Desk: data processing terms

These terms apply between a Hiring Desk subscriber ("you") and ECOMFIRST VENTURES (trading as Monastic Media, "we") and form part of the Terms.

1. Roles

For applicant data you collect through Hiring Desk, you are the Data Fiduciary and we are your Data Processor under the Digital Personal Data Protection Act, 2023. We process applicant data only to provide Hiring Desk, on your instructions.

2. What we do with applicant data

Store applications and CVs, read CV text and public links the applicant gives, score them against the criteria you set using AI, and show you a ranked list with the evidence behind each score. A person at your company makes every decision. Hiring Desk never rejects anyone automatically and never emails a rejection. While AI screening is unavailable, applicants are scored by matching the keywords of your criteria instead, and every such result is labelled "keyword match". Applicant text is treated as data: instructions written into a CV or an answer are ignored and flagged to you. Scores never use age, gender, religion, caste, marital status, disability, appearance, nationality or ethnicity.

3. Notice and consent

Your apply form tells applicants that AI assists screening and that a person at your company decides, and asks for consent with an unticked box. The notice reads: “[Your company] uses Hiring Desk by Monastic Media to receive applications. AI helps compare your application with this role’s criteria; a person at [your company] reads the result and makes every decision. Nobody is rejected automatically. Your application and CV are deleted 30 days after the role closes and are never kept more than 90 days. Monastic Media processes them only for [your company] and never uses them to train AI.”

You must not upload CVs of people who have not agreed to be considered; bulk upload asks you to confirm this each time. Invites you choose to send through Hiring Desk go from hello@monasticmedia.co with your company name, only to your own applicants, with replies going to you.

4. Security and access

Data is stored in private storage, reachable only through your workspace link and our systems. Keep your workspace link private.

5. Sub-processors

Supabase (database and storage, Japan), Anthropic (AI screening, United States, not used for training), Google Workspace (email), Razorpay (your subscription payments). We will tell you before adding a new one.

6. Deletion

Applicant files and screening results are deleted 30 days after you close a role, and never kept more than 90 days after upload. "Delete everything" in your workspace deletes them at once. When your subscription ends you keep read-only access for 14 days, then everything is deleted.

7. Breaches

We tell you within 72 hours of becoming aware of a personal data breach that affects your applicants, with what we know and what we are doing.

Last updated 5 October 2026.