Privacy notice

NorthStackHub is a contract staffing firm with offices in New Jersey, USA and Hyderabad, India. We place contract professionals with client companies and act as the employer of the contractors we place.

For the personal data described in this notice, NorthStackHub is the data controller (sometimes called the data fiduciary). You can reach us about anything in it at info@northstackhub.com.

From companies requesting talent

When you submit a hiring request we receive:

• Your name and work email address.
• Your company name.
• The role title, the specialism it falls under and the engagement model you prefer.
• How many people you need and roughly when they should start.
• The description of the work you write, including anything you choose to put in it.

If we go on to work together we also hold the business contact details, role briefs, interview feedback, timesheet approvals and invoicing records that a staffing relationship involves.

From candidates and contractors

When you apply for a role or register your profile we receive:

• Your name, email address and, if you give it, your phone number.
• Your specialism, years of experience, availability, preferred working arrangement and location.
• A link to your CV or LinkedIn profile, and the CV or profile content behind that link.
• The role you applied for, if any, and any message you add.

As we work with you, we also create or receive:

• Notes from intro calls and technical screens, including our assessment and the feedback we give you.
• References, taken from referees you have agreed we may contact.
• A record of each role we discussed with you and whether you consented to be submitted.
• Interview feedback from client companies you were submitted to.
• Background-check results, only with your consent, only where the law allows the check, and only when a specific placement requires it.

If you are placed with a client, we additionally hold what an employer needs to engage and pay you: your contract, identity and right-to-work documents, tax and bank details, timesheets and pay records.

From everyone who uses the forms

With each form submission we record the date and time, the IP address the request came from, your browser’s user agent and the page that referred you. We use these to spot and remove spam and abuse, not to profile you. Our server also holds your IP address in memory for a few minutes to rate-limit repeated submissions.

Please do not send passwords, government ID numbers or bank details through the website forms. If we need documents like these for a placement, we will arrange a secure way to collect them.

• To reply to your hiring request or application, and to keep in touch about it.
• To match candidates with roles, run screens and take references.
• To submit a candidate's profile to a client company — only after the candidate has explicitly agreed to that specific submission.
• To arrange interviews and pass feedback between the company and the candidate.
• For placed contractors: to issue contracts, verify the right to work, run background checks where consented and lawful, process timesheets and payroll, and meet tax, employment and other legal obligations.
• For client companies: to agree terms, provide the service and invoice for it.
• To keep the website and its forms secure and free of spam.

We do not sell or rent personal data, we do not use it for advertising, and we do not add you to a marketing list without asking. Depending on where you live, we rely on your consent, on steps needed to enter into or perform a contract with you, on legal obligations we have as an employer, or on our legitimate interest in running a recruitment business.

Client companies. We share a candidate’s profile, screening summary and references with a client company only after telling the candidate who the company and role are and receiving their explicit yes. We never send speculative CVs without consent. We share a hiring company’s role details with candidates only as far as needed to discuss the role.

Service providers. A short list of providers processes data on our behalf, under their own data protection terms:

• Supabase — database hosting for form submissions and candidate records.
• Resend — delivery of form notifications and transactional email.
• Vercel — hosting for this website and its server functions, including standard access logs.
• Cal.com — scheduling, if you book a call through our booking page.
• Our business email and document providers, which hold the resulting correspondence.

Placement providers. For contractors we place, we use payroll, background-screening and similar providers where needed to employ and pay them, and share only what each one needs.

Authorities. We disclose data to tax authorities, regulators, courts or law enforcement where the law requires it.

We work across the United States and India, and some providers operate servers in other countries, so your data may be transferred internationally. Where that happens we rely on the safeguards the provider offers and that applicable law requires.

• Candidate profiles: kept while they remain useful for matching you with roles. We periodically ask registered candidates to confirm their details are current, and remove profiles that are out of date or no longer wanted.
• Hiring requests that do not lead to an engagement: kept for a limited period so we have context if you come back to us, then deleted.
• Placed contractors and client engagements: kept for the length of the engagement and afterwards for as long as tax, employment and contract records must legally be retained.
• Spam-triage data (IP address, user agent, referring page): kept with the submission it belongs to and removed when that submission is deleted.
• Rate-limiting records: held in server memory only and discarded within minutes.

You can ask us to delete your data at any time. Unless we are legally required to keep a record — for example payroll records for a contractor we have employed — we will do it.

The rights you have depend on where you live. Depending on your residence, US state privacy laws or India’s Digital Personal Data Protection Act may apply. Whatever applies, we will honour a reasonable request to:

• Tell you what personal data we hold about you and give you a copy.
• Correct anything that is wrong or incomplete.
• Delete your data where we have no ongoing legal or contractual reason to keep it.
• Withdraw your consent — including to being submitted for roles or being contacted — which does not affect anything done before you withdrew it.

Email info@northstackhub.com with the subject line “Data request”. We may need to confirm your identity before acting on it. We do not charge for requests, and we will not treat you differently for making one. If you are unhappy with our response, you may be able to complain to the data protection authority where you live.

Data reaches us over HTTPS and is kept in access-controlled accounts with two-factor authentication. Access to candidate records is limited to the people who need it to recruit for, place or pay someone. No system is perfect, but if a breach affected your data we would tell you and the relevant authority as the law requires.

This website sets no marketing cookies, no advertising pixels and no cross-site trackers. There is no cookie banner because there is nothing to consent to.

Your light or dark theme preference is saved in your browser’s local storage so the site does not flash the wrong theme on your next visit. That value never leaves your device and is never sent to our servers. Clearing your browser storage removes it.

Our services are for businesses and working professionals. This website is not directed at children and we do not knowingly collect data from anyone under 18. If you believe a child has sent us information, tell us and we will delete it.

When we change how we handle data we update this page and move the date at the top. Material changes affecting candidates, contractors or clients whose data we already hold are communicated by email.

Questions about this notice, requests about data we hold on you, or withdrawal of consent all go to info@northstackhub.com. New Jersey, USA · Hyderabad, India.