Privacy notice
Last updated 1 November 2026.
This notice explains what personal data Hotintro uses, where it comes from, why, who sees it, how long we keep it and what you can do about it. It covers three groups of people: hiring managers we contact (in the UK, Ireland, the US and Canada), recruitment agencies, and visitors to this website.
Your right to object
You can object at any time to us using your data to contact you about agency introductions. Reply STOP (or "no") to any email or LinkedIn message from us, or write to [email protected]. We then stop at once, never contact you again, and keep only the minimum needed to make sure of that (see "How long we keep data"). Objecting is free and you do not need to give a reason.
Who we are
Hotintro is operated by SignalsAPI AS, org. no. 835 512 622, Stenhammerveien 30, 1604 Fredrikstad, Norway. SignalsAPI AS is the controller of the data described here.
- Privacy questions, requests and complaints: [email protected]. The person accountable for privacy at Hotintro is Mykola, who reads this mailbox.
- Everything else: [email protected].
SignalsAPI AS is established in Norway, in the European Economic Area, so we do not need an EU representative.
Our LinkedIn messages are sent by a person who is part of Hotintro, from their own LinkedIn profile, which shows that they are with Hotintro. They act for SignalsAPI AS, not for themselves or another company.
UK representative (UK GDPR Article 27): not yet appointed. We do not email anyone in the UK until we have appointed one and named them here.
Hiring managers
What we do
When a role has been advertised for 3 weeks or more, we may email the hiring manager who owns it once, plus at most one follow-up, to ask one question: would you like one specialist recruitment agency to help? We may instead ask the same question in a hand-written LinkedIn message, under the same rules and with the same information, sent by a member of the Hotintro team from their own LinkedIn profile. Across email and LinkedIn together, we contact you at most twice. Our first emails may come from tryhotintro.com, our outreach domain. Hotintro is a paid introduction service: agencies pay us, you never pay anything.
What data we use
- Your name, job title and employer, and your work email if we contact you by email. If we contact you only on LinkedIn, we do not need your email address.
- The role you are hiring for: the job ad, its web address and the date it was first seen.
- Where we found your work email, the date, and how we checked it.
- UK only: your employer's company number and legal form, to check it is a company or other corporate body.
- Canada only: a dated screenshot of the page where your work email was published.
- The emails we sent you, your replies, and whether an email bounced.
- If we contact you on LinkedIn: your LinkedIn profile address, the messages we exchanged there, and whether your profile can still be messaged after an agency pays.
- If you reply YES: which agency was introduced, when, and how (by email, or on LinkedIn).
We do not use phone numbers, home addresses, other social media profiles or any sensitive data about you.
Where the data comes from
- Public job ads and your employer's own website.
- LinkedIn: job posts, and your LinkedIn profile if we contact you there.
- For the UK, Ireland and the US: if a work email is not published, we may work it out from your company's email format (one guess, never many combinations), and we always check it with our own email verification tool before sending. We do not buy addresses or use third-party lookup services.
- For Canada: only a work email that you or your employer published (for example on a staff, team or careers page) with no "no solicitations" note next to it. We do not use lookup or verification tools, and we do not guess addresses.
- For the UK: Companies House, to confirm your employer's legal form.
- You, when you reply to us.
Who we contact, by country
- United Kingdom: only staff of companies, LLPs and other corporate bodies, never sole traders or ordinary partnerships, and only at a work address on the employer's domain.
- Ireland: only at an address that appears to be used mainly for your work, and only about your employer's open role.
- United States: only at a business address. We do not use addresses taken by automated harvesting or generated automatically by trying many name combinations.
- Canada: only at an address published as described above, and only about the role you own. We do not contact people in Quebec.
- Everywhere: no personal addresses (such as Gmail or Outlook.com), no one whose ad says "no agencies" or "no recruiters", and no one who has already told us to stop.
Why we use it and our legal basis
- To ask the one question (finding you, checking we may contact you, sending one email and at most one follow-up, or one LinkedIn connection note and one message): our legitimate interest in offering hiring managers with long-open roles an introduction to one specialist agency, and in earning a fee from that agency. We weighed this against your interests: we only write to work addresses or your LinkedIn profile, only about your own advertised role, at most twice, and you can stop it at any time. You can ask us for a summary of that assessment.
- To introduce you to an agency after you reply YES: your request. In Canada, your YES is your consent, which you can withdraw before the introduction is made.
- To respect your objection (the do-not-contact list) and to show we followed the rules (records of where we found your address and what we sent): our legal obligations and our legitimate interest in proving compliance.
We do not make decisions about you by automated means.
Who sees your data
- Before anyone pays: if you reply YES, agencies in our vetted pool for your field see a short summary written in our words: field, seniority, region and salary band. It is a paraphrase, not your own words, and it does not include your name, employer, the posting date or anything unique to you.
- After payment, if you replied YES by email: the first agency to pay us €99 gets your name and work email straight away, in an introduction email sent to you both.
- After payment, if you replied YES on LinkedIn: the first agency to pay us €99 gets your name, your LinkedIn profile link and your YES reply, in your own words. No agency sees your own words before paying. We then introduce you on LinkedIn: in a group message with you and the agency's consultant, or, if we are not connected with the consultant, by telling you the agency's name and the consultant who will contact you.
- From the introduction on, the paying agency is responsible for your details as a separate controller. It must use them only for this introduction, stop contacting you when you ask, and delete them on request.
- If you do not reply YES, no agency ever sees anything about you.
- Our service providers, listed below.
The agency may be based outside your country. If you are in the UK or the EEA, we only pass your details to an agency in a country the UK or EU recognises as giving adequate protection, or under standard contractual clauses signed with that agency.
Agencies
- Data: your agency's name, your name, work email, specialist field, the introductions you bought, and payment and refund records. Card details are handled by Stripe; we do not see your full card number.
- Sources: you, Stripe, and your agency's published contact details when we first invite you to the pool.
- Purposes and legal basis: sending you summaries and introductions you signed up for (our contract with you); inviting your agency to the pool (our legitimate interest in growing the pool, and you can object at any time); keeping payment records (legal obligation under Norwegian bookkeeping law).
- Recipients: the hiring manager you are introduced to gets your agency's name and your contact details in the introduction email, or, on LinkedIn, your agency's name and your name; our service providers below.
Website visitors
This site sets no cookies and runs no analytics or advertising trackers. Cloudflare, which delivers the site, processes your IP address and browser details to serve pages and block abuse (our legitimate interest in running a secure website). If you email us, we use your message and address to answer you.
Service providers
These companies process data for us under data processing terms and only on our instructions:
- Stripe — card payments and refunds.
- Mailgun — sending introduction emails and receiving mail to hotintro.cc addresses.
- Winnr — the mailbox our first emails and follow-ups to hiring managers are sent from.
- Cloudflare — delivering this website and DNS.
- WholeSale Internet, Inc. (USA) — the server our systems run on.
- An email verification tool — checking that a work email exists before we send to it (UK, Ireland and US only, never Canada). We run it on our own server; it does not share addresses with a third party.
International transfers
We are based in Norway. Some of the providers above are in the US or process data there, so your data may be transferred to the US. For these transfers we rely on the EU-US Data Privacy Framework (and its UK Extension) where the provider is certified under it, and otherwise on the European Commission's standard contractual clauses, with the UK Addendum for UK data. If you are in Canada, your data is processed in Norway and the US, and the laws there may let authorities access it.
How long we keep data
| Data | How long |
|---|---|
| Hiring managers who do not reply: name, job title, work email or LinkedIn profile address, employer | Deleted 60 days after our last message to you. |
| Do-not-contact list: your email or LinkedIn profile address (or a scrambled form of it), employer domain if the whole company objected, date, reason | Kept permanently, with only these fields, so we never contact you again. |
| Records of where we found each address and of each email and LinkedIn message we sent and received, including YES replies and how each introduction was made | 3 years after our last message to you. |
| Payment and refund records | As long as Norwegian bookkeeping law requires. Hiring manager data in them is cut down to what the record needs. |
| Complaints and our answers | 3 years. |
| Agency contact details | While your agency is in the pool. Deleted when you leave, except payment records. |
Your rights
Write to [email protected] to:
- get a copy of your data and know where we got it;
- correct it;
- have it deleted;
- restrict how we use it;
- object to our use of it (see the top of this page);
- withdraw a YES or consent before the introduction is made;
- receive data you gave us in a portable format (agencies).
We answer within one month, or 30 days in Canada. We will not treat you differently for using any of these rights.
California residents have the right to know what personal information we collect, use and disclose, to delete it, to correct it, and not to be discriminated against for asking. Send requests to the same address. We disclose your name and contact details (work email, or LinkedIn profile link and YES reply) to one agency only, and only after you reply YES and that agency pays.
Complaints
Please write to us first at [email protected]. We acknowledge every complaint within 30 days. You can also complain to a regulator:
- Norway (our lead authority): Datatilsynet, datatilsynet.no.
- United Kingdom: the Information Commissioner, ico.org.uk.
- Ireland: the Data Protection Commission, dataprotection.ie.
- United States: your state attorney general; in California, also the California Privacy Protection Agency, cppa.ca.gov.
- Canada: the Office of the Privacy Commissioner of Canada, priv.gc.ca.