Privacy

How Open HR SASU collects and uses personal data in the RefScore closed alpha. This notice covers three groups of people: the employer who requests a reference check, the candidate it is about, and the referees who answer questions.

Effective 15 August 2026 · Version: alpha-4 · Applies to refscore.open-hr.work

In brief

What we collect. Names and email addresses of the employer, the candidate and the candidate’s referees; the referees’ answers about the candidate’s work behaviour; and a record of payment. Separately, if you asked to join the closed alpha, your contact details and what you told us about your hiring. Nothing else.

What we never do. We do not sell data, we do not advertise, and we run no analytics or tracking of any kind. The only cookie we set is a sign-in session for employers — referees and candidates are never given a cookie at all. We never ask referees about a candidate’s health, family, politics, union membership or beliefs.

Nothing happens without the candidate’s agreement. No referee is contacted until the candidate has agreed and has chosen who to approach. The candidate picks the people, but not the shape: a check needs two people from each of three different kinds of working relationship, and it cannot go ahead without them. A candidate can decline, or withdraw afterwards, and collection stops.

If you are a referee, read section 2.3. Your answers are combined with the one other person who worked with the candidate as you did, and where the two of you agree the report can say that both of you said it. We never show anyone your questionnaire or name you as the source of a rating — but two people is not a crowd, and you should know that before you answer rather than after.

Your rights. You can ask for a copy of your data, correct it, delete it, or object — including if you are a referee rather than the candidate. Contact privacy@open-hr.work. You may complain to the CNIL.

1. Who we are

The data controller is Open HR SASU, a société par actions simplifiée à associé unique registered in France.

We have not designated a Data Protection Officer. At our current scale we are not required to under Article 37, and we would rather tell you that plainly than name a role nobody holds. Privacy questions go to the address above and reach a person.

2. What we collect

2.1 If you are the employer

We never see or store your card details. Card data is entered on Stripe’s own checkout page and never reaches our servers.

2.2 If you are the candidate

You choose the people, within a fixed shape: two referees from each of three different kinds of working relationship — two managers, two colleagues and two clients, say, or two people who reported to you if that fits your work better. The form will not accept a list that is not in that shape, so if you cannot field two of a kind the check cannot proceed. We tell you this here because it is a real constraint on you and you should meet it before you agree, not at the form.

2.3 If you are a referee

Your name and email address reach us from the candidate, not from you. This section is your notice under Article 14.

Saying you could not observe something is a real answer and is stored as one. It is not counted as a low rating, and it is not held against the candidate — a behaviour nobody could speak to is reported as not assessed. It is recorded against you rather than against them, because it describes the limits of what you saw.

Where your account of the relationship differs from the candidate’s, yours is what we use — and the report notes that a correction occurred. That account does three things: it decides which questions you are asked, which side of the report your answers speak for, and — since the employer is refunded for any side of the panel that does not arrive complete — it forms part of what the employer is ultimately charged.

What the employer sees, and what this means for you. You are not the only person answering from your kind of working relationship. Every check asks two people from each of three kinds, and your answers are combined with those of the other person who worked with the candidate as you did.

We do not hand the employer your questionnaire, and we never name you as the source of a particular rating. But you should understand what combining two people produces: where the two of you gave the same answer, the report can say that both of you gave it — it may read “both clients said seldom” about a specific behaviour — and the employer knows who their candidate’s referees are, because the candidate named them. On a question where you and the other person agree, the employer can therefore work out what you each said.

We tell you this rather than let you discover it, because the alternative is a promise we cannot keep. Two people is the smallest number that lets the report tell a genuine difference in vantage point from one person’s opinion, and it is what makes the check worth buying; it is also small enough that agreement between you is not anonymous. If that is not acceptable to you, do not answer, and ask us to erase your details — how to do that is in section 9, and we act on it whether or not the check is finished.

2.4 If you asked to join the closed alpha

The intake form at /alpha collects your name, work email, organisation and job title, together with your answers about how and where you hire and how you check references today. Only the first few are required; the rest are optional and you can skip any of them.

We use it to decide who to invite and to shape what we build. It is not used for anything else: no newsletter, no advertising, no profiling, and it is never shared or sold. The form posts to our own server — no third-party form service is involved.

We rely on your consent here, which is why the form asks for it explicitly rather than assuming it. We record when you gave it and which wording you were shown, so that if you ever ask what you agreed to we can tell you exactly.

Ask at privacy@open-hr.work and we will take you off the list and delete the record — you do not have to give a reason, and withdrawing does not affect anything already done. We keep it for 24 months from signup, or until you ask, whichever comes first.

2.5 Collected automatically

Standard server logs: IP address, timestamp, requested page. We run no analytics and no tracking, and we store nothing in your browser beyond what is described next.

Cookies. One, and only for employers: a session cookie set by Clerk when an employer signs in, so they stay signed in between pages. It is strictly necessary to provide a service you asked for, which is why there is no consent banner — under the ePrivacy rules a cookie of that kind does not require consent, and we would rather not pretend otherwise with a pop-up. If you are a referee or a candidate you never sign in, so you are never given a cookie.

A saved draft, for referees. While you are answering a questionnaire, your answers so far are kept in your own browser’s local storage so that closing the tab does not lose ten minutes of your time. It holds the ratings you have given, and any you have marked as not observed, against question codes — not the questions themselves, not the candidate’s name, and nothing identifying you. It never leaves your device, we cannot read it, and it is deleted the moment you submit. Like the cookie above it is strictly necessary for something you are already doing, so it needs no consent — but it is storage on your device, so we tell you about it. Clearing your browser data removes it, at the cost of your unsaved answers.

3. Why, and on what legal basis

Where we rely on legitimate interests, you may object at any time and we will stop unless we have compelling grounds not to. Where we rely on consent, you may withdraw it at any time; withdrawal does not affect processing already carried out.

4. Referees: specific safeguards

Approaching someone’s former colleagues is a sensitive act, so it carries specific limits.

• No referee is contacted before the candidate agrees and names that person. This is enforced by the software, not merely by policy.
• Referees are told who we are and why they were contacted, and that the candidate authorised it.
• Questions cover work behaviour only — the kind of thing a manager would observe on the job. Referees are never asked about health, family circumstances, political or religious views, union membership, or anything else without a direct and necessary link to occupational competence (Art. L.1221-6, French Labour Code).
• Referees have their own rights. A referee is a data subject in their own right and may exercise every right in section 9 over the data we hold about them.
• Withdrawal stops collection immediately. If the candidate withdraws, no further referee is contacted and no score is produced.
• A referee may say they could not see something, question by question, and that is treated as an answer rather than as a gap. Nobody has to guess at behaviour they were not positioned to observe, and doing the careful thing cannot produce a worse result for the candidate than doing the confident thing.
• Referees are approached in pairs, not singly. Two people from each of three kinds of working relationship. It is a measurement decision rather than a privacy one — a single referee of a kind cannot be told apart from their own opinion — but it means one more person is asked about a candidate than a check of three would need, and the candidate should know that before agreeing rather than after.
• A pair is not anonymity, and we say so rather than implying otherwise. We never hand over a referee’s questionnaire and never name one as the source of a rating, but two people is a small enough group that agreement between them is identifiable: a report saying “both clients said seldom” tells the employer what each of two named people answered. Every referee is told this in their invitation, before they answer, and again on the questionnaire itself. The alternative — leaving them to work it out from the report — is a promise we would not be keeping.

5. How long we keep it

Deleted data may persist in backups for up to 30 days, after which it is overwritten. Aggregated statistics that cannot identify anyone may be kept indefinitely.

6. Who else is involved

We use a small number of processors. Each is bound by a data processing agreement and acts only on our instructions.

Cloudflare resolves our domain name but does not sit in front of the service — proxying is disabled, so no page you request and no answer you give ever passes through it. Where a processor is established outside the EEA, transfers rely on the EU–US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses otherwise. We do not sell data, and we share it with no one else except where a court or authority compels us by law.

The report is available to the employer who paid for it. It is never published, never shared with other employers, and never used to build a profile that follows a candidate between applications.

7. How we protect it

• All traffic is encrypted in transit. Your browser is told to refuse an unencrypted connection to this service from its first visit onwards, so there is no plain request left to intercept.
• The database sits on a single server in Paris, readable only by the service account that runs the application.
• Reports are behind an employer account. Being signed in is not enough on its own — a report opens only for the account that created that particular check, and one employer cannot reach another’s.
• Consent and referee links use long random tokens that cannot practically be guessed, and the pages they open are excluded from search engines.

8. Automated processing and the RefScore

RefScore turns referees’ answers into scores. This is profiling within the meaning of Article 4(4).

It is not a decision based solely on automated processing under Article 22(1). We produce a report; the employer reads it and decides. We never make, and never automate, a hiring decision.

How it works, in outline:

• Referees rate described work behaviours. Answers are grouped into up to 21 work styles drawn from the O*NET occupational taxonomy published by the US Department of Labor.
• A work style is only scored where at least two referees were able to speak to it, and no score at all is shown until at least three referees have answered. A referee may record that they were not in a position to observe something; work styles nobody was asked about, or that nobody could speak to, are listed as not assessed rather than guessed at.
• Each referee is scored on their own answers before those are combined. Answers are weighted by how long the referee worked with the candidate and how recently. Work relationships count equally regardless of seniority; a personal, non-work referee counts for less, because they are positioned to observe less work behaviour. The relationship also decides which questions that referee is asked.
• The overall grade is weighted towards the occupation. O*NET publishes, for each occupation, how important each work style is to that kind of work. Those importance ratings are what the single headline grade is weighted by — so for a role where attention to detail matters more than leadership, attention to detail moves the grade more. The same answers about the same person therefore produce a different overall grade for a different occupation, and this is the largest single factor in how that grade is arrived at.
• The report shows what each kind of referee concluded separately, and identifies work styles where they differed markedly. A difference is presented as a matter to enquire about, not as a finding.
• Results are expressed as letter grades, banded by how often referees reported seeing each behaviour, not as a pass or fail. There is no failing grade.
• The questionnaire is tailored to the occupation the employer is recruiting for.

Whoever you are, in relation to this scoring you may:

• ask how a score about you was arrived at;
• ask a person to review it;
• contest it and have your point of view recorded.

9. Your rights

Write to privacy@open-hr.work. We reply within one month. If we cannot do what you asked, we will explain why. You can complain to the CNIL at cnil.fr at any time, and you do not have to raise it with us first.

10. Changes

This service is in active development and this notice will change with it. The effective date at the top always reflects the current version. If a change materially affects how we use data about you, we will contact you directly rather than relying on you re-reading this page.

Contact

Open HR SASU · 60 rue François Ier, 75008 Paris, France · privacy@open-hr.work