The Endorsed FraudShield Extension ("the Extension") is designed to help recruiters and hiring teams identify potentially fraudulent job candidates by analyzing candidate information from Applicant Tracking Systems. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your data.

When you use the Extension on a supported Applicant Tracking System (ATS) platform, we collect and process the following information:

• Candidate Contact Information: Email addresses, phone numbers, addresses, and social profile URLs extracted from candidate resumes
• Candidate Identifiers: Unique candidate IDs from your ATS platform
• Resume Data: Resume files uploaded to your ATS for the purpose of extracting contact information and employment history
• Company Information: Names of employers listed on candidate resumes
• Page URLs: URLs of candidate profile pages you visit on supported ATS platforms

• Platform Information: Which ATS platform you're using
• Extension Usage: When you activate the fraud detection analysis by clicking the extension icon

We use the collected data solely for the following purposes:

1. Fraud Detection Analysis: To analyze candidate information and identify potential fraud signals
2. Risk Assessment: To provide you with fraud risk levels and detailed fraud signals
3. Fraud Detection Improvement: To improve the accuracy and effectiveness of fraud detection algorithms by analyzing detection patterns. This may include producing anonymized, aggregated reports on fraud trends and patterns in the hiring industry. All data used for this purpose is anonymized (contains no personally identifiable information) and remains strictly limited to improving fraud detection capabilities. These insights are not used for advertising, marketing, or any purpose other than fraud detection.

• Processing Location: All data is processed solely within the United States. Data is sent to Endorsed's secure API servers located in the US for real-time fraud detection analysis. No data is transferred to or processed in other countries without appropriate safeguards.
• Limited Use Commitment: All data collected through this Extension is used solely for fraud detection and service improvement purposes as disclosed in this policy. We do not use this data for advertising, marketing, or any purpose other than providing and improving fraud detection capabilities.
• Zero Candidate PII Retention in Primary Databases: We retain 0 user personally identifiable information (PII) of candidates in our primary databases. Candidate information analyzed for fraud detection is processed in real-time and not retained beyond the immediate analysis, except as part of anonymized fraud patterns for service improvement.
• System Logs Containing PII: See disclosure below. Retained for 90 days in logs only, then securely deleted or anonymized.
• User Data Retention: We retain user activity data and fraud detection results as specified in our Data Retention section. All data is automatically deleted within 90 days of contract termination.
• Security: We use industry-standard security measures including:
  • End-to-end encryption for data in transit
  • Regular security audits and penetration testing
  • SOC 2 Type II compliance
• No Sale of Data: We do not and will never sell user or candidate data to third parties

We work with carefully selected service providers to deliver our fraud detection capabilities. We do not share collected data with third parties except in the following limited circumstances:

• Contact Validation Services: To verify the validity of email addresses and phone numbers
• Fraud Risk Assessment Providers: To analyze candidate risk attributes including identity verification, contact information validation, and fraud signal detection
• Company Data Providers: To enrich and verify employer information listed on resumes
• Infrastructure Providers: Cloud hosting and security services necessary for service operation
• Analytics Processors: To process anonymized usage data for service improvement

• Legal Requirements: We may disclose data if required by law, regulation, legal process, or governmental request
• Business Transfers: In the event of a merger, acquisition, or sale of assets, user data may be transferred to the acquiring entity with appropriate protections

We do not share data for:

• Advertising or marketing purposes unrelated to fraud detection
• Sale to data brokers or third-party marketers
• Purposes unrelated to the Extension's fraud detection functionality

The Extension requires the following Chrome permissions:

The Endorsed FraudShield Extension is programmatically restricted to operate only within a very limited scope:

We retain different types of data for different periods based on legitimate business needs:

• User Activity Data: 90 days after contract termination (for usage analytics and support)
• Fraud Detection Results: 90 days in logs only (for audit trails and pattern analysis)
• Zero Candidate PII Retention in Primary Databases: We retain 0 user personally identifiable information (PII) of candidates in our primary databases. Candidate information analyzed for fraud detection is processed in real-time and not retained beyond the immediate analysis, except as part of anonymized fraud patterns for service improvement.
• System Logs Containing PII: See System Logs Disclosure above. Retained for 90 days in logs only, then securely deleted or anonymized.
• Audit Logs: 24 months (available for Enterprise customers only)
• Anonymized Fraud Patterns: Retained indefinitely for industry fraud prevention purposes

• Deletion Upon Request: Active customers may request deletion of specific user data at any time
• Contract Termination: All customer data is automatically deleted within 90 days of contract termination
• Expedited Deletion: Immediate deletion (within 72 hours) available upon request
• Deletion Certificate: Formal attestation of deletion provided upon request

To protect the entire hiring ecosystem from evolving fraud tactics, we maintain anonymized, aggregated fraud patterns that cannot be traced back to any specific organization. This industry-wide intelligence helps all customers detect new and emerging fraud methods. These aggregated patterns:

• Contain no identifiable information about organizations, users, or candidates
• Cannot be reverse-engineered to any specific company or individual
• Are essential for maintaining fraud detection effectiveness across the industry
• Benefit the entire hiring ecosystem by improving fraud detection capabilities
• Help identify emerging fraud trends that protect all users
• Are retained indefinitely to ensure ongoing protection for the industry

• Data Export: Export all your data in machine-readable format (JSON/CSV)
• Audit Trails: Detailed logs of all user activities and data access (Enterprise plan only)
• Deletion APIs: Programmatic deletion capabilities for automated compliance
• Compliance Reports: Regular reports on data handling and retention compliance

To improve the FraudShield Extension, we collect the following usage metrics from Enterprise customers:

• Performance Metrics: Average analysis completion time and system response rates
• Error Tracking: Anonymized error rates to identify and fix issues
• Platform Distribution: Aggregate usage by ATS platform to prioritize integration improvements
• User Flow Patterns: How users navigate between different analysis views
• Organization Usage Metrics: Aggregate usage statistics at the company level for billing and support

Depending on your location, you may have the following rights:

• Access: Request a copy of the data we've collected about candidates you've analyzed
• Deletion: Request deletion of specific candidate analysis data
• Correction: Request correction of inaccurate data
• Opt-Out: Uninstall the Extension at any time to stop all data collection

To exercise these rights, contact us at the address below.

The Extension is not intended for use by individuals under 18 years of age. We do not knowingly collect data from children.

We implement appropriate technical and organizational measures to protect collected data, including:

• Encrypted data transmission (HTTPS)
• Secure API authentication
• Regular security audits and updates
• Access controls and monitoring

We may update this Privacy Policy from time to time. We will notify users of material changes by:

• Updating the "Last Updated" date at the top of this policy
• Providing notice through the Extension or via email (if we have your contact information)
• Posting a prominent notice on our website

Continued use of the Extension after changes become effective constitutes acceptance of the updated Privacy Policy.

This Extension complies with:

• Chrome Web Store Developer Program Policies
• General Data Protection Regulation (GDPR) for EU users
• California Privacy Rights Act (CPRA) for California users
• Other applicable data protection laws

• Legitimate Interests: We process candidate data based on your organization's legitimate interest in preventing fraud in hiring processes
• Contract Performance: Processing necessary to fulfill our services contract with your organization
• Legal Compliance: Processing required to comply with legal obligations

• Right to access personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with supervisory authorities

Data is processed in the United States. We ensure appropriate safeguards through:

• Standard Contractual Clauses (SCCs) for EU-US transfers
• Data Processing Agreements available for Enterprise customers

• SOC 2 Type II certified
• Annual third-party penetration testing
• Annual vulnerability assessments
• Regular security audits and compliance reviews

Available for Enterprise customers with custom agreements:

• 99.9% uptime SLA
• 24/7 security incident response team
• 72-hour breach notification commitment
• Dedicated Enterprise support with 12-hour response time

Enterprise customers can request our standard Data Processing Agreement (DPA) which includes:

• EU Standard Contractual Clauses (Module 2: Controller to Processor)
• UK International Data Transfer Agreement
• Detailed security and compliance obligations
• Subprocessor list and change notification procedures

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

For data subject requests (access, deletion, correction), please include:

• Your name and contact information
• Description of your request
• Candidate IDs or timeframes for the data in question (if applicable)

We will respond to verified requests within 30 days.

• Developer: Endorsed.ai
• Extension Name: Endorsed FraudShield
• Version: 1.1.2
• Support: support@endorsed.ai