Sherman Staffing · SherStaff

Privacy Policy

Effective: 2026-09-01

Who we are

Sherman Staffing LLC operates the SherStaff platform, a multi-tenant recruiting workspace used by healthcare staffing agencies and the facilities they serve.

We act in two distinct roles. For the account data of agency and facility users, we are the data controller: we decide how that data is used and we are responsible for it. For candidate data uploaded by our agency customers, we act as a processor on their behalf — the agency remains responsible for that data, decides what is collected, and instructs us on how it is used. Questions about either role can be sent to info@shermanstaffing.com.

What data we collect

Account data (agency and facility users)

When a workspace is created for you, we collect and store:

• your email address, name, phone number, job title and role in the workspace;
• your locale, timezone and profile picture, which control how the product is presented to you;
• sign-in and activity records — when you last signed in and what actions you took — which we keep for security and accountability.

Candidate data (uploaded by our customers)

Our agency customers upload candidate information to run their recruiting pipeline. That includes:

• name, email address and phone number, and an approximate location derived from the address supplied, used to match candidates to nearby roles;
• resume files and supporting documents, certifications and licenses, and recruiter notes;
• the source of an application and its import provenance — where the record came from and which system it was imported from;
• evidence of the lawful basis for contacting a candidate, such as a recorded opt-in or an existing business relationship;
• communications: the content of emails and text messages sent and received, together with delivery, reply and opt-out events.

Calendar data (when you connect a calendar)

Connecting a personal calendar is optional. If you connect one, we receive the email address of the connected account, authorization tokens for that account, the identifiers of the calendars you select, free/busy windows, and the interview events we create.

We use this data for one purpose only: to compute when an interviewer is available and to write interview events onto the selected calendar. We do not use it for advertising, we do not use it to train machine-learning models, and we do not sell it or transfer it to anyone for their own purposes. It is deleted when you disconnect the calendar, and when the workspace it belongs to is purged.

How we use it

• operating your workspace and giving each user the access their role allows;
• matching candidates to open roles, and screening and ranking applications;
• scheduling interviews and sending the reminders that go with them;
• sending outreach to candidates where there is a recorded lawful basis to contact them;
• providing support, and keeping security and audit records.

Applications and resumes are read and scored by an automated tool that uses artificial intelligence. We say plainly what that tool does, and what a candidate can ask for instead, under Automated decision-making below.

Who we share it with

We use a small number of named service providers to deliver the product:

• Supabase — database, authentication and file storage;
• Vercel — application hosting;
• Resend — email delivery;
• Anthropic — resume extraction and application scoring;
• Sentry — error monitoring, with payloads scrubbed of personal data before they leave the application;
• Twilio — text-message delivery, where a workspace has it enabled;
• Google — calendar availability and interview events, only when a user connects a Google calendar;
• Microsoft — calendar availability and interview events, only when a user connects a Microsoft 365 calendar.

These providers process data on our instructions in order to deliver the service. They are contractually bound and may not use the data for their own purposes. None of them is a lead generator or a data broker, and no mobile information or messaging consent is shared with any of them for marketing or promotional purposes.

Mobile information and SMS consent

We do not share, sell, rent, or provide your mobile phone number, your text-message opt-in data, or your messaging consent to third parties, affiliates, or lead generators for marketing or promotional purposes at any time.

Mobile information and messaging consent are never sold, and consent given to one sender is never transferred to another. Message providers act only on our instructions and may not use the information for their own purposes.

Reply STOP to any message to opt out, and Reply HELP for help. Message and data rates may apply.

How we protect it

• Each workspace is isolated from every other workspace in the database itself, using Postgres row-level security. That isolation is exercised by an automated test that must pass before any change is committed and again before it can be merged.
• Calendar authorization tokens are encrypted at rest with AES-256-GCM and cryptographically bound to the row that holds them. The key is held outside the database, so a database dump yields no usable token.
• Error-reporting payloads are scrubbed of personal data before they leave the application, rather than at the vendor after the fact.
• Data is encrypted in transit over HTTPS.

How long we keep it, and how to delete it

We keep data for as long as the workspace it belongs to is active. When a customer leaves, they receive a full export of their data, and all of it is deleted within seven days of exit. The deletion is verified by a purge that produces a manifest confirming no residue remains.

An individual may request deletion of their personal data by writing to info@shermanstaffing.com. Opt-out requests are honoured at the moment of sending: outreach is blocked unless an affirmative lawful basis is recorded, and a recorded opt-out blocks it outright.

What we never do

• We do not use personal data for targeted advertising.
• We do not sell or rent personal information to data brokers.
• We do not use personal data for credit assessment or lending decisions.
• We do not use customer or candidate data to train general-purpose machine-learning models unrelated to delivering this service.
• The product runs no analytics, no session-recording and no advertising trackers today, and sets no tracking cookies. If that ever changes, this policy changes with it and the effective date above is bumped.

Automated decision-making

The platform uses an automated employment decision tool to help screen and rank applications for open roles. The tool evaluates the information in an application against the qualifications and characteristics described in each job posting — such as credentials, licensure and relevant experience.

A candidate may request a reasonable accommodation, or an alternative selection process that does not use the automated tool. Requests can be sent to info@shermanstaffing.com, or to the employer directly.

The tool assesses only the qualifications described above. It is instructed never to use a name, gender, age, race, ethnicity, photo or address in a score or in the reasoning it records, and those characteristics are omitted when an application is read. Every score is stored with a written rationale, and a person makes the final decision on every application — the tool does not advance or reject an application on its own.

Each employer that uses the platform publishes its own candidate-facing notice for this tool on its application pages.

Contact

Write to info@shermanstaffing.com with any question about this policy, about the data we hold, or to request deletion. When this policy changes, the effective date shown at the top of this page is bumped.