Privacy policy

RekPal and the RekPal Recruitment Sidekick Chrome extension. Last updated 7 October 2026.

RekPal is a tool for recruiting teams that use Ashby. This policy says what it handles, where that goes and what it does not do. It is written to match the code: if you find a difference, it is a bug, and we want to hear about it.

Who this is for

RekPal is used by a recruiting team on its own Ashby account. The recruiting data it shows already belongs to that employer.

What we handle

• Your RekPal account: your email address, a salted hash of your password (never the password itself), and sign-in activity such as when and from which network you signed in.
• Recruiting data from your Ashby account, which your team connects: candidate names and roles, interview schedules, interviewers, scorecards and their scores and comments, and notes. It is used to show the boards, draft reminders and decision emails, and compare candidates.
• Messages you choose to send, such as a reminder to an interviewer through Slack, and a record that it was sent. It also keeps what an interviewer replies in Slack: typed replies, and voice messages as audio together with their text.
• AI processing: text from scorecards and notes is sent to an AI model provider to write summaries and drafts, and a voice reply's audio is sent to a speech-to-text service to be turned into text. It is used only to produce that output for your team.

The Chrome extension

The extension runs only on *.ashbyhq.com and on app.rekpal.com. It has no access to any other website.

• Reads the recruiting details already on your Ashby page, to show them in the side panel, and creates a feedback form in Ashby when you ask it to.
• Stores on your device, in the browser's session storage only (cleared when Chrome closes): its sign-in tokens for your RekPal connection and an in-progress feedback form.
• Cookies: it watches for changes to the single RekPal session cookie on app.rekpal.com, only to notice that you signed in or out. It never reads the cookie's value and never touches any other site's cookies.
• There is no analytics, telemetry, advertising or crash reporting in the extension.

Where data goes

To the RekPal server, which we operate, and to the services it needs to do the job you asked for: Ashby (to read your data and, if you turn it on, to add an interviewer's Slack reply to the candidate as a note), Slack (to deliver messages you send and receive the replies), and the AI model provider named above. We do not sell or rent data, share it with advertisers, or use it for profiling, credit or lending decisions.

Because we operate the server, we can technically access the data on it. We separate each organisation's data at the database level, limit staff access, and record support access. Staff do not look at your candidate data except to fix a problem you raised, and only through access your admin grants.

Remote code

The extension runs no remotely hosted code. All of its code ships inside the extension package. Pages from app.rekpal.com are displayed in a frame; they are not executed as extension code.

Retention and deletion

Your organisation's data stays while your account is active. Email us from an admin's address to have it deleted. Sign-in tokens held by the extension disappear when the browser closes.

Security

All traffic uses HTTPS. Passwords are stored only as salted scrypt hashes, repeated wrong passwords lock an account for a while, and sensitive actions ask for your password again. Sessions can be ended from your Account page.

Children

RekPal is a workplace tool and is not directed at anyone under 18.

Changes

Material changes will be published here with a new date.

Contact

Questions, or requests to see, correct or delete data: rekpal@pbalabsca.com.