Laatst bijgewerkt: oktober 2026
De Engelse versie is bindend.
Hirō is a recruitment CRM platform operated by Operanex SRL, Rue de Bordeaux 38, 1060 Brussels, Belgium. This privacy policy explains how we collect, use, and protect information when you visit our marketing website (hiro.ninja) and when you use the Hirō application, including when you connect a Google or Microsoft mailbox to it.
For the candidate and client data our customers store in the application, our customer is the data controller and Operanex acts as their processor (see our Terms & Conditions). For the data of the people who sign in to Hirō, including the mailboxes they connect, Operanex is the data controller.
When you submit a demo request or contact form, we collect the information you provide: name, email address, company name, job title, and your message. This data is used solely to respond to your enquiry.
We use Plausible Analytics, a privacy-friendly analytics tool hosted in the European Union. Plausible does not use cookies, does not store your IP address and does not collect personal data: it only produces aggregate statistics such as page views, referral sources, countries and device types. Because it cannot identify you, it runs for every visitor without asking for consent. Legal basis: our legitimate interest in knowing how our website is used.
If you accept analytics cookies in our consent banner, we load PostHog (PostHog EU cloud, hosted in Germany). PostHog records how you navigate the website: pages viewed, clicks, conversion funnels such as pricing page to trial sign-up, and session recordings that replay your visit. In session recordings, everything you type is masked before it leaves your browser. PostHog assigns you a random identifier, stored in a cookie shared with our application, so that a trial started after a visit can be linked to that visit. It is never loaded if you decline or do not answer the banner. Legal basis: your consent, which you can withdraw at any time (see "Cookies" below).
If you accept marketing cookies, we load Google Tag Manager, which in turn loads the advertising tags we use to measure conversions and to show you relevant ads on other platforms (retargeting): Google Ads, LinkedIn Insight Tag and Meta Pixel. We run Google Tag Manager with Google Consent Mode v2: all advertising signals default to "denied" and only switch to "granted" once you accept marketing cookies. Google Tag Manager is not even downloaded before you accept analytics or marketing cookies, so no data is sent to Google, LinkedIn or Meta without an opt-in. These providers may transfer data outside the European Economic Area (see "Sub-processors" below). Legal basis: your consent.
Hirō users can connect their Gmail or Microsoft Outlook mailbox to the application. This is optional, is done by the user through Google's or Microsoft's own consent screen, and can be revoked at any time.
userinfo.email, Microsoft User.Read) — to identify which mailbox
is connected.Mail.Read only) — to keep the replies of your candidates and clients next to their record in Hirō.
When a new message arrives, we check its sender and recipients. Only messages exchanged
with contacts that already exist in your Hirō workspace are retrieved and stored; all
other messages are ignored and never stored. Hirō does not request access to read Gmail
messages.gmail.send,
Microsoft Mail.Send) — for Gmail, the permission you grant when connecting
the mailbox; for Outlook, only if you separately click "Allow sending" in your mailbox
settings. Hirō then sends, from your address, the emails you write and confirm in
Hirō, and nothing else. This permission does not let Hirō read, modify or delete your
messages.The OAuth tokens that give access to your mailbox, encrypted at rest. For synced messages with your contacts: sender, recipients, subject, date, a short preview and a copy of the message, so you can read it in Hirō. For emails sent through your mailbox: the recipient, subject, content and delivery status, so the campaign history is complete. This data is only visible to you and to the members of your Hirō workspace who are allowed to see it.
Hirō's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can disconnect a mailbox at any time from My preferences › My Mailboxes in Hirō. We then revoke our access with Google or Microsoft, delete the stored tokens and remove the synced messages of that mailbox from the application. You can also revoke access from your Google Account or your Microsoft account. To have every remaining copy deleted, including emails already sent through your mailbox, contact us at the address below; we complete such requests within 30 days.
Legal basis: the performance of our contract with you (providing the features you enable), and our customer's legitimate interest in managing its recruitment communications.
Our website sets the following first-party cookies on the hiro.ninja domain:
hiro_consent — remembers the choice you
made in the consent banner (analytics: yes/no, marketing: yes/no). 12 months. Strictly
necessary, no consent required.hiro_attr and hiro_attr_last — the acquisition source of your visit: campaign parameters in the URL (UTM, ad click
identifiers), the referring website and the page you landed on. They contain no
personal data and are only written once you have accepted analytics cookies. 90 days.
If you start a trial or request a demo, this source is attached to your account or
request so that we know which channels bring us customers. Legal basis: our legitimate
interest in measuring our marketing.ph_*) — the random
visitor identifier and session state described above. Only set after you accept
analytics cookies. Up to 12 months.You can change or withdraw your choice at any time via the "Cookie settings" link in the footer of every page. Withdrawing analytics consent stops PostHog and deletes the attribution cookies; withdrawing marketing consent switches all advertising signals back to "denied". Cookies already set by third parties can be removed from your browser settings.
We do not sell, rent, or share your personal data with third parties.
If you are located in the European Economic Area, you have the following rights regarding your personal data:
To exercise any of these rights, please contact us using the details below.
Contact form submissions are retained for as long as necessary to respond to your enquiry and for legitimate business purposes. Plausible data is stored in aggregate form and cannot be linked to individual visitors. PostHog events and session recordings are kept for a limited period that we are currently confirming with our provider; this policy will be updated with the exact duration.
Mailbox tokens are deleted as soon as you disconnect the mailbox. Synced and sent emails are kept while the Hirō account that holds them is active, and are deleted with the rest of the account data when the account is closed (see our Terms & Conditions), or earlier on request.
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction.
The following providers process data on our behalf when you use this website or the Hirō application. Providers marked "with consent" only receive data after you accept the matching cookie category.
In addition, for the Hirō application:
For any questions about this privacy policy or to exercise your data rights, please contact us at privacy@hiro.ninja.
Jouw privacy
We meten ons verkeer met privacyvriendelijke statistieken zonder cookies. Met jouw toestemming gebruiken we ook cookies om het gebruik van de site te analyseren en onze advertenties te meten. Je kunt je keuze op elk moment aanpassen via de voettekst. Privacybeleid