MetaDay AI Ltd — Privacy Policy

Last Updated: 8 November 2026

1. Who We Are

MetaDay AI Ltd

Registered in England & Wales, Company No. 17076816

128 City Road, London, EC1V 2NX, United Kingdom

Contact: info@metaday.ai

2. Scope

This Privacy Policy applies to:

• Website usage
• Platform usage
• AI features and interviews
• Communications with MetaDay
• People we find through sourcing (section 6F)

How MetaDay treats candidates, in plain words: https://app.metaday.ai/candidates-promise

3. Data We Collect

We may collect:

3.1 Account Data

• Name, email, phone
• Login credentials

3.2 Professional Data

• CV, experience, skills
• Portfolio and career data

3.3 Verification Data

• Identity documents
• Employment and education records

3.4 Recruitment Data

• Interview recordings (text/voice)
• Candidate responses and evaluations

3.5 Company Data

• Job postings
• Hiring workflows

3.6 Technical Data

• IP address
• Device/browser data
• Usage logs

3.7 AI Interaction Data

• Prompts
• Outputs
• Interaction logs

4. How We Use Data

We process data to:

• Provide and operate the Services
• Match candidates and companies
• Conduct AI interviews
• Improve platform performance
• Ensure security and fraud prevention
• Comply with legal obligations

5. Legal Basis

We process data under:

• Contractual necessity
• Consent
• Legitimate interests
• Legal obligations

6. Data Sharing

We do not sell personal data. We may share data with:

• Infrastructure providers (hosting, cloud)
• Analytics providers
• Payment processors
• Security providers

All partners operate under strict contractual safeguards.

6A. Google API Services and Connected Accounts

MetaDay may allow users to connect Google services, including Gmail and Google Calendar, using Google-authorized APIs. Access to Google data occurs only with the user's explicit authorization and solely to provide functionality requested by the user. For Gmail integrations, MetaDay may assist users in preparing, drafting, reviewing, and sending email communications. Emails are sent only following user action, approval, or authorization as required by the applicable workflow. MetaDay does not access, read, monitor, analyze, or process the contents of a user's Gmail inbox as part of its standard functionality. For Google Calendar integrations, MetaDay may create, view, update, and manage calendar events, assist with scheduling workflows, coordinate meetings, and support calendar-related functionality requested by the user. MetaDay does not sell Google user data. MetaDay does not use Google user data for advertising purposes. MetaDay does not use Google user data to build advertising profiles or for unrelated commercial purposes. MetaDay's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Users may revoke MetaDay's access to their Google Account at any time through their Google Account settings. Users may request deletion of data associated with connected Google services by contacting MetaDay using the contact details provided in this Privacy Policy.

6B. Microsoft Services and Connected Accounts

MetaDay may allow users to connect Microsoft services, including Outlook and Microsoft 365 services. Access occurs only with user authorization and solely for providing requested platform functionality. MetaDay may use authorized Microsoft integrations to support communication workflows, scheduling workflows, calendar coordination, and related platform services. MetaDay does not sell Microsoft user data. MetaDay does not use Microsoft user data for advertising purposes or unrelated profiling activities. Users may revoke access at any time through their Microsoft account settings and may request deletion of associated data through MetaDay.

6C. Third-Party Data Sources and Service Providers

MetaDay may utilize authorized third-party service providers, infrastructure providers, artificial intelligence providers, communication providers, analytics providers, data enrichment providers, verification providers, and publicly available information sources to support the operation of the Services. Such providers may assist MetaDay in delivering recruitment workflows, hiring functionality, candidate discovery, candidate enrichment, scheduling services, communications, verification processes, analytics, security measures, AI-assisted functionality, and other platform features. MetaDay shares only the information reasonably necessary to provide requested Services and requires service providers to maintain appropriate security and confidentiality safeguards.

For AI-assisted features, MetaDay uses these third-party AI providers: OpenAI (text, and the voice in AI calls and interviews), Anthropic (text) and ElevenLabs (voice). They are used solely to generate content or perform user-requested AI functions. These providers do not access, retrieve, or manage users' Google accounts or Google Workspace services on MetaDay's behalf. All Google Workspace interactions are performed exclusively by MetaDay through Google's official APIs using only the permissions explicitly authorized by the user.

6D. Data Ownership and Commercial Use

MetaDay does not sell personal data, customer data, candidate data, Google user data, Microsoft user data, or connected account data. MetaDay operates as a subscription-based software platform. Customers pay for access to MetaDay's software, workflows, automation capabilities, recruitment functionality, and platform features. Where permitted by applicable law and user authorization, MetaDay may obtain, process, organize, enrich, analyze, and present information from customer-provided data, publicly available information, authorized third-party providers, and connected services in order to provide the requested Services. Access to information through the Services is provided solely as part of the MetaDay platform and does not constitute the sale of personal data.

6E. Candidates Who Apply Through a Job Board

When you apply for a role on a job board (for example Indeed) and the employer uses MetaDay, the job board sends your application to the employer's MetaDay inbox.

• Who is responsible: the employer is the controller of your application data. MetaDay processes it on the employer's behalf as its hiring platform (processor).
• Source: the application the job board sent when you applied, including the CV you attached.
• Purpose and basis: only to assess you for that role, as a step you asked for by applying (GDPR Art. 6(1)(b) and the employer's legitimate interest, Art. 6(1)(f)).
• Contact: we write to you only if a person on the team moves you forward, to invite you to the next step, at the email address from your own CV or the one the team has for you. We never write to the job board's relay address and we do not send an acknowledgement of your application.
• AI and people: some steps use an AI interviewer, and you are told before any AI step starts. A person on the employer's team sets the rules and makes the hiring decision; no one is rejected automatically.
• No sharing: we don't share your details with other employers. Only the employer you applied to sees your application. MetaDay is not a talent pool. If you later apply to another role yourself, that employer receives the new application you choose to send.
• Retention: the employer keeps your application. No application is deleted automatically: every 24 months the employer reviews applications that have gone quiet, and a person decides what stays. You can ask for removal at any time.
• Your rights: you can ask the employer to see, correct or delete your application at any time by replying to its email, and you can unsubscribe from emails about the role with one click. You can also contact your data protection authority about how your data is handled (for example the ICO in the UK, or the authority in your EU country).
• Your own account: if you set a password for the next step, your account is yours: you can delete it at any time, and it is subject to these Terms and this Privacy Policy.

6F. People We Find Through Sourcing

You may hear from a company that uses MetaDay even if you never applied to it. This section explains why, and what you can do.

• Who is responsible: MetaDay AI Ltd (details in section 1) is the controller of our sourcing database. We decide what goes in it, why, and how long it stays. Contact details are different: they are looked up only when a hiring company asks, with the settings it chose, for its own workspace. That company is the controller of those details, and we carry out the lookup for it. It is also the controller once it contacts you or works with your details for one of its roles. It answers for its own messages and hiring decisions. You can write to either of us.
• What we collect: your public professional profile, such as your name, work history, skills and location, and contact details such as a personal or work email, which we get from contact data providers.
• Sources: this data did not come from you. If you ask, we tell you which of these sources yours came from.
• Profile data: Bright Data, for public professional profile data, including LinkedIn profiles.
• Contact details: People Data Labs and FullEnrich. Hunter checks that an email works, and can find a work email. Older records may come from ContactOut, which we stopped using on 24 October 2026.
• Public pages: your public work, such as GitHub or a portfolio, and published pages such as press or talks, when a hiring company turns this on or asks for a briefing.
• The hiring company: its own talent pool, its applicant tracking system, a LinkedIn connections file it uploads, or a LinkedIn profile its recruiter opens.
• Purpose: to tell you about specific work that may fit you.
• Legal basis: legitimate interest (GDPR Art. 6(1)(f)): a company reaching people for its work, and you hearing about work that may fit.
• Who sees it: the hiring company the search was for, and the service providers in sections 6 and 6C. We do not sell personal data. Section 8 covers transfers outside the UK/EEA.
• How long we keep it: until the hiring company deletes the search or the person from it, you object, or you ask us to remove it, whichever comes first.
• Your rights: you can ask to see, correct or delete your data, and you can object to this use at any time. If you object, we stop contacting you about work. You can also contact your data protection authority (for example the ICO in the UK, or the authority in your EU country).
• Remove your data: use the removal page at https://app.metaday.ai/remove-my-data or write to info@metaday.ai. You don't need an account. With your email it runs automatically after you confirm by email. We answer within one month: anything our team must handle is done within that time, and we may ask you to confirm the request is yours. We keep a minimal record of it, so we don't contact you again.

6G. WhatsApp

Hiring companies can use MetaDay to message you about jobs on WhatsApp. Some replies are automated and sent as Ryan, our AI recruiter assistant.

• How messages are written: some are written by AI and sent automatically, for example when arranging a meeting time. Others are fixed texts, approved message templates, or messages a person on the hiring team writes or approves.
• What we process: your phone number and WhatsApp profile name, the messages you exchange with the hiring company, a label and short summary of what you replied, and message details such as the time and delivery status. We don't process voice notes or other media you send, and they get no reply.
• Who decides: the hiring company decides why it contacts you. MetaDay processes this data for that company.
• Who handles it: messages pass through Twilio and Meta (WhatsApp Business). An AI provider processes message text to understand your reply, for example whether you are interested, to write automated replies, and to suggest replies to the hiring team (section 6C).
• How long we keep it: we remove the text of WhatsApp messages 180 days after they were sent or received. A few related texts, such as the values used to fill a message template, can stay longer. The record that a message was sent stays, including your number, the date, the delivery status and the label of how you replied.
• Stopping messages: reply "stop" or say you don't want more messages. We then mark your number as do-not-contact for WhatsApp messages and calls, and keep a short record of your request so we don't contact you again. You won't get a confirmation. If we may have missed it, write to info@metaday.ai.
• The number you see: messages usually come from a number MetaDay holds and show the name MetaDay. Where this option is available, a hiring company can connect its own WhatsApp Business number through Meta. We then receive that number, its display name and its account identifiers, and messages use that number and show that company's name. We don't keep the Meta sign-in token.
• Company staff who use Ryan: owners and admins who link their own phone to Ryan can send it voice notes. An AI provider turns them into text. We don't store the audio ourselves; the file stays with Twilio under its own terms.
• Your rights: you can ask to see, correct or delete your data (section 13). You can also use https://app.metaday.ai/remove-my-data, or write to info@metaday.ai with the phone number we messaged.

7. User Responsibility for Data

If you upload or process personal data, you confirm that:

• You have the legal right to use it
• You comply with applicable laws

You are responsible for lawful use of data.

8. International Transfers

Data may be transferred outside the UK/EEA. We use safeguards such as:

• Standard Contractual Clauses (SCCs)

9. Data Retention

We retain data only as necessary for:

• Service delivery
• Legal compliance

No application or profile is deleted automatically. Every 24 months, the company that holds candidate data reviews anything that has gone quiet, and a person decides what stays. A company deletes an application only after typing DELETE to confirm. A candidate who asks to be removed is removed right away, and the company that held the data is told. Recordings of AI video interviews are deleted after 30 days unless the hiring team keeps one.

Users may request deletion or anonymization.

10. Security

We implement:

• Encryption
• Access controls
• Monitoring systems

However, no system is completely secure.

11. Cookies

We use cookies to:

• Enable core functionality (Essential Cookies)
• Analyze usage (Analytics Cookies)
• Improve experience (Functional Cookies)

Users may manage cookies via browser settings.

12. AI Processing Transparency

MetaDay uses AI to:

• Conduct interviews
• Analyze candidate data
• Assist hiring workflows

AI systems:

• Do not make final decisions
• Operate under user control

13. Your Rights

You have the right to:

• Access your data
• Correct inaccuracies
• Request deletion
• Withdraw consent
• Object to processing

Request deletion of your personal data: use the removal page at https://app.metaday.ai/remove-my-data. You confirm your email with a code we send you. We then delete your data from MetaDay, including from the workspaces of companies that used MetaDay to hold it, and we tell each of those companies by email.

Contact: info@metaday.ai

14. Children

MetaDay is not intended for individuals under 18.

15. Updates

We may update this Privacy Policy at any time.

16. Contact

MetaDay AI Ltd

Registered in England & Wales, Company No. 17076816

128 City Road, London, EC1V 2NX, United Kingdom

info@metaday.ai