Privacy Policy

Last updated: 2 August 2026

This policy explains what Paco collects, why, and who else sees it. It covers the Paco browser extension for Chrome and Firefox, our backend at server.askpa.co, and this website at paco.ooo.

Paco is an AI assistant for recruiters using Bullhorn. It is not affiliated with, endorsed by, or sponsored by Bullhorn, Inc.

If you use Paco through your employer, your employer's own privacy policy also applies to the Bullhorn records you work with. We process those records on your behalf so you can get an answer about them.

Who we are

Paco is operated by the team behind paco.ooo. For any privacy question, or to exercise any right described below, email support@paco.ooo.

What the extension reads

The extension only runs on app.bullhornstaffing.com and on our own demo sandbox at demo.askpa.co. It does nothing on any other website.

When you ask a question, Paco reads:

• The record on screen. Text from the Bullhorn candidate, contact, job order or placement you are currently looking at, so "this candidate" resolves to the right person.
• Related records you ask about. Lookups run through Bullhorn's own REST API from inside your own logged-in session, using your own permissions. Paco cannot see anything you could not already open yourself.
• Your question. The text you type, or the audio you dictate.
• Your clipboard — only when you ask. If you ask Paco to work with something you have just copied, it reads the clipboard once for that turn and shows you what it read. It is never read in the background.
• A screenshot of the tab — only when you ask. If your question is about something visible on the page, Paco captures the visible Bullhorn tab for that turn.
• Your Bullhorn identity. Your name, email and REST endpoint, read from the page's own session object, so answers and history are scoped to you.
• Your settings. Model choice, voice options and custom prompts, plus short-lived state such as which tab the panel is open on.

Depending on the records involved, this can include personal details of candidates and contacts, notes and emails stored on records, resume content, and pay or salary figures on job orders and placements.

What never leaves your browser

Your Bullhorn password and session token stay in the page. Record lookups are issued from inside the Bullhorn tab itself, which is precisely why your Bullhorn credentials never reach our server or any third party.

We do not collect your browsing history, your location, or health data. We do not track you across websites.

What this website collects

If you submit your email address to the waitlist or the newsletter form, we store that address to send you product updates. You can unsubscribe from any email we send. Nothing else on this site requires you to identify yourself.

Where your data goes

To answer a question, the extension sends your question and the record data needed to answer it to our backend at server.askpa.co, which adds the system prompt and relays it to the AI provider that generates the answer.

These are the third parties we rely on, and what each one receives:

• Anthropic and OpenAI — generate the answer. They receive your question and the record data needed to answer it, under agreements that prohibit training on it.
• Exa — web search and page fetch. Receives only your search terms, and only when you turn web search on.
• AssemblyAI — dictation. Receives your audio when you dictate a question.
• Inworld — text to speech. Receives the answer text when you have spoken replies enabled.
• LiveKit — real-time audio transport, only while you have a voice call open.
• Assistant Cloud — stores your conversation history so your threads are still there next session. Access is scoped by a short-lived token minted for your Bullhorn user.
• Vercel — hosting for server.askpa.co and this website.
• Loops — sends the product emails you signed up for, and stores the address you gave us.

Because these providers operate globally, your data may be processed outside Australia, including in the United States and the European Union.

We do not sell your data. We do not share it for advertising. We do not use it to determine creditworthiness or for lending purposes. We use it for one purpose: answering your questions about your own Bullhorn records.

How long we keep it

• Conversation history is kept until you delete it, so your threads are there next time you open the panel.
• Questions and record data sent to answer them are not retained by us beyond what is needed to produce and store that conversation.
• Settings stay in your browser's extension storage until you clear them or uninstall.
• Email addresses given to the waitlist are kept until you unsubscribe or ask us to delete them.

Uninstalling the extension removes its local storage. To delete your conversation history and any email address on file, email support@paco.ooo.

Security

Traffic between the extension, our backend and every provider above is encrypted in transit. Tokens for dictation, voice and thread history are short-lived and minted per user. The extension bundles all of its code at build time — it loads no remote scripts and calls no eval.

No system is perfectly secure, and we cannot guarantee absolute security, but we protect your data using measures appropriate to its sensitivity.

Your rights

Under the Australian Privacy Principles you can ask us for access to the personal information we hold about you, ask us to correct it, and complain about how we have handled it. Email support@paco.ooo and we will respond within a reasonable period. If our response does not satisfy you, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If you are in the European Economic Area or the United Kingdom, you also have the rights to access, rectification, erasure, restriction, portability, and to object to processing, under the GDPR and UK GDPR. Where we handle Bullhorn records, we generally act as a processor on behalf of the Bullhorn customer who employs you.

If you are a California resident, you have the rights to know, delete, correct and opt out under the CCPA. We do not sell or share personal information as those terms are defined by the CCPA, so there is nothing to opt out of.

Children

Paco is a professional tool for recruiters. It is not directed at anyone under 16 and we do not knowingly collect their personal information.

Changes to this policy

We may update this policy as Paco changes. The date at the top always reflects the current version. If a change materially affects how we handle your data, we will say so on this page before it takes effect.

Contact us

Questions about this policy, or about the data we hold: support@paco.ooo.