Privacy Policy

This Privacy Policy explains how MIRACHAEL SHINES PTE. LTD. (“Mirachael Shines”, “we”, “us” or “our”), as the operator of Hiro, collects, uses, discloses, stores, protects and otherwise handles personal data.

This Policy applies when you:

• visit hiro.sg or a related Hiro domain;
• submit a Candidate or Employer Interest Form;
• create or use a future Hiro account or profile;
• participate in matching, shortlisting or interviews;
• use recruitment, employment-agency, work-pass or placement services;
• communicate with Hiro or Mirachael Shines; or
• otherwise provide personal data to us.

This Policy should be read together with any additional notice, consent statement, declaration or Terms and Conditions presented when particular personal data is collected or used.

The information collected depends on how you interact with Hiro. We do not necessarily collect every category below from every person or at every stage.

2.1 Candidate Interest Form

During early interest registration, we may collect:

• name;
• nationality and current country;
• telephone number, email address and messaging contact details;
• preferred job categories;
• employment experience and skills;
• English-language ability;
• availability and expected timing;
• preferred communication language;
• interest in working in Singapore; and
• remarks or other information voluntarily provided.

The temporary Candidate Interest Form does not require a passport, FIN, medical record or full work-pass documentation.

2.2 Employer Interest Form

During early employer interest registration, we may collect:

• name and designation of the employer representative;
• business contact and messaging details;
• employer name and business information;
• industry, hiring needs and job categories;
• expected hiring timeframe; and
• enquiries, remarks or other information provided.

2.3 Future candidate account and profile

When Candidate Registration becomes available, we may collect or generate:

• legal name, approved profile name, date of birth or age, gender, nationality, citizenship and current country;
• address and emergency contact information where reasonably necessary;
• photograph and introductory video;
• telephone number, email address and messaging-application details;
• languages and communication ability;
• employment history, previous employers and Singapore work experience;
• education, training, skills, licences, certificates and references;
• preferred roles, sectors, locations, salary expectations and availability;
• current Singapore work-pass status and interest in Work Permit, S Pass or Employment Pass opportunities;
• English speaking and understanding levels and other job-relevant assessments;
• profile-completeness, verification and improvement information;
• candidate fee-readiness or employer-support information where relevant to the proposed placement; and
• an automatically generated Hiro candidate reference.

Where operationally necessary, we may later collect passport, FIN, identity, qualification, medical, employment, travel, work-pass, In-Principle Approval, issuance and placement documents. Such information should not be requested merely for early interest registration.

2.4 Future employer account and hiring requests

When Employer Access becomes available, we may collect or generate:

• legal and trading names, UEN, industry and business activities;
• business address, website and business contact information;
• company logo and authorised branding material;
• employer representative names, designations and authority to act for the employer;
• account login and verification information;
• job descriptions, work locations, salaries, employment terms, schedules and workforce requirements;
• intended Work Permit, S Pass or Employment Pass type for each hiring request;
• quota, eligibility or work-pass information provided by the employer;
• candidate searches, views, passes and shortlists;
• interview requests, feedback and hiring decisions;
• job offers and proposed employment terms;
• accepted Terms and Conditions, accepted version, representative identity, authority declaration, date and time; and
• fee arrangements, invoices, payments, refunds, complaints and dispute records.

Some employer information, such as a company name, UEN or logo, may not by itself be personal data. We may nevertheless protect it together with personal and confidential information.

2.5 Recruitment, interview, work-pass and placement records

We may collect or generate:

• profile review, approval and verification status;
• employer profile views, passes and shortlists;
• interview requests, schedules, attendees and outcomes;
• candidate and employer feedback;
• candidate-specific introduction records;
• dates on which masked or identifying information was disclosed;
• job offers and employment terms;
• work-pass authorisations, applications and status;
• IPA, issuance, arrival and placement status;
• agency-fee arrangements and payment records;
• mandatory or operational placement reports;
• complaints, disputes, withdrawals and cancellations; and
• document access, viewing and download records.

2.6 Communications and support

We may collect information contained in:

• emails, WhatsApp messages and telephone communications;
• Zoom, WhatsApp or other interview communications;
• forms, attachments and documents sent to us;
• feedback, support requests and complaints;
• access, correction, withdrawal, closure or human-review requests; and
• communications with authorised representatives.

2.7 Website, account and technical information

Hiro or authorised service providers may automatically collect:

• Internet Protocol address;
• browser, operating system and device information;
• login, authentication and account-security information;
• pages or features accessed;
• date, time and duration of access;
• referral, campaign and navigation information;
• error, performance and security logs;
• consent and Terms-acceptance records; and
• cookies or similar technologies used to operate, secure or improve Hiro.

Hiro does not intend to collect a user’s device-contact list, precise GPS location, passwords, recovery codes, secret keys or full payment-card credentials.

2.8 Information about another person

You should not provide another person’s personal data unless you are authorised to do so and have informed that person where required. This includes information about employer representatives, referees, previous employers and emergency contacts.

2.9 Persons below 18

Hiro candidate services are intended for persons aged 18 or above. We do not knowingly create candidate profiles for persons below 18. If we discover that information was submitted for a person below 18 without a lawful and approved basis, we may delete or restrict it.

We may collect personal data:

• directly from candidates and employer representatives;
• through Hiro forms, accounts and profile features;
• through email, WhatsApp, telephone, Zoom and other authorised communication channels;
• from authorised representatives, referees, overseas partners or introducers;
• from employers, candidates or persons involved in recruitment and placement;
• from publicly available business, professional or official records;
• from government-issued documents provided to us for a lawful employment-agency or work-pass purpose; and
• automatically through website, account, security and activity logs.

We may collect, use or disclose personal data with consent, or as otherwise permitted or required by law, for purposes including:

• operating, administering and securing Hiro;
• processing Candidate and Employer Interest Forms;
• creating and managing candidate and employer accounts;
• reviewing, verifying, masking and approving profiles;
• translating and standardising candidate information;
• assessing profile readiness and completeness;
• matching candidates with suitable hiring requests;
• supporting Swipe Search, passes and shortlists;
• arranging and administering interviews;
• recording introductions and controlling identity disclosure;
• preparing offers, work-pass applications, issuance and placement processes;
• providing licensed employment-agency services;
• issuing invoices and administering payments;
• communicating service and case-status information;
• responding to enquiries, complaints, disputes and data requests;
• preventing fraud, bypass, misuse and unauthorised access;
• maintaining compliance and evidential records;
• improving Hiro’s usability, matching quality and operational performance;
• complying with MOM, PDPC, IRAS and other legal duties; and
• establishing, exercising or defending legal or contractual rights.

Where the PDPA requires consent, we will notify you of the relevant purposes and obtain consent in an appropriate form. Singapore law may also permit processing without fresh consent in specified circumstances, including deemed consent or another statutory exception.

You may withdraw consent by contacting hello@hiro.sg. Withdrawal does not affect processing already lawfully carried out and may prevent us from continuing a service that depends on the information. We do not make promotional marketing consent a condition of necessary recruitment or account services.

Hiro does not sell candidate or employer personal data. The value of Hiro’s data is used to improve matching, operational intelligence, compliance and placement performance.

Where implemented and operationally approved, Hiro may use AI-assisted tools and structured rules to:

• translate and standardise candidate information;
• summarise experience and extract relevant skills;
• identify missing or inconsistent profile information;
• calculate or support the Singapore-Ready Score;
• support Hiro Smart Match and candidate ranking; and
• explain why a candidate appears to match or not match a hiring request.

Matching factors may include role and sector fit, relevant experience, skills, certificates, English communication, availability, salary expectations, profile completeness, verification status, current work-pass status, pass preference and lawful work-pass or source-country requirements.

Candidates may see their full Singapore-Ready Score, breakdown and improvement checklist. Employers will generally see only an approved readiness band and appropriate match explanation, not the candidate’s exact score.

AI-assisted output is reviewed by MIRACHAEL SHINES where required before operational use. Hiro does not permit AI alone to make the final decision on employment, rejection, work-pass eligibility, IPA approval, MOM approval or placement.

Candidates may request correction of inaccurate information or human review of an AI-assisted score or match. Where practical, only information reasonably necessary for the relevant AI purpose will be processed, and identifying or sensitive information will be reduced or masked.

A Hiro score, readiness band or match recommendation is an internal recruitment and profile-readiness tool. It is not a MOM assessment and does not guarantee an interview, employment, IPA, work-pass approval, entry into Singapore or placement.

Employers may use Hiro Swipe Search to review approved masked candidate cards. An employer may pass on a candidate or add the candidate to a shortlist.

Candidates may see the number of unique employers who currently have their profile actively shortlisted. The counter does not reveal the employer’s identity, logo or confidential hiring details before Hiro authorises disclosure.

The active-shortlist count may increase or decrease when an employer adds or removes a shortlist, closes a hiring request, loses access or when a shortlist is otherwise no longer active. Duplicate actions by the same employer should not be counted as separate employers.

Hiro may notify a candidate when the active shortlist count increases. Hiro does not generally send a separate negative notification when an employer removes a shortlist.

Shortlist additions and removals may be recorded with the employer, candidate, hiring request, action, date and time for operations, analytics, compliance and dispute evidence.

Hiro may mask candidate names, contact details, photographs, videos, documents and other identifying information before employer disclosure.

Hiro may also withhold an employer’s company name, logo and identifying information from candidates until an interview is confirmed or disclosure is otherwise authorised.

Before receiving identifiable candidate information, an employer may be required to accept Employer Candidate Introduction and Placement Terms and a candidate-specific introduction record.

Identifying information should be disclosed only to authorised persons for a genuine recruitment, interview, work-pass or placement purpose.

Candidate information held by the main Hiro platform will not automatically become visible to other employment agencies. Any future sharing with another EA would require a lawful purpose, appropriate notice or consent, masking, controlled access and recorded responsibilities.

We may disclose personal data only where reasonably necessary, authorised or legally permitted, including to:

• authorised employers and employer representatives considering a candidate;
• candidates receiving authorised employer or interview information;
• authorised overseas partners, introducers or service providers;
• hosting, form, database, authentication, email, communications, document-storage, analytics and AI service providers;
• professional advisers, insurers, auditors or debt-recovery providers where reasonably necessary;
• MOM, PDPC, IRAS, law-enforcement bodies, courts and other authorities where required or permitted; and
• a successor or purchaser in connection with a genuine business restructuring, subject to appropriate safeguards.

Service providers are expected to process personal data only for authorised purposes and to apply appropriate protection.

Hiro may use authorised service providers or partners whose systems, personnel or facilities are located outside Singapore.

Where personal data is transferred outside Singapore, we will take reasonable steps to ensure that the recipient provides a standard of protection comparable to the requirements of Singapore’s Personal Data Protection Act.

Overseas processing will be used only where reasonably necessary for Hiro’s operations, communications, technology, recruitment, work-pass or placement services.

Hiro may send necessary service communications concerning registrations, accounts, profiles, verification, shortlists, interviews, work-pass processes, payments and placements.

Promotional or marketing messages require separate optional consent where required. Marketing messages will identify Hiro or MIRACHAEL SHINES and provide a reasonable way to stop future marketing messages.

Withdrawing marketing consent will not prevent necessary operational, security, contractual or case-related communications.

Where Singapore’s Do Not Call requirements apply to a specified marketing message sent to a Singapore telephone number, we will rely on clear and unambiguous consent or perform the required registry checks and comply with applicable identification and contact requirements.

Hiro does not routinely record Zoom, WhatsApp or other interviews at MVP launch.

Neither an employer nor a candidate may make an audio recording, video recording, screenshot, screen recording, livestream, AI transcription or automated meeting-bot record unless Hiro and every participant are informed beforehand and clearly agree.

Hiro may retain necessary written administrative records such as the interview date, attendees, attendance, outcome and relevant notes.

Certain screens and documents may be marked confidential and may restrict copying, printing, downloading, forwarding or sharing. Hiro may display user-specific watermarks and record access or download activity.

A web app cannot guarantee that every browser, device or external camera is technically prevented from taking a screenshot. Masking, controlled disclosure, watermarks, access logs and contractual restrictions are therefore used together.

Unauthorised recording or sharing may result in an interview being stopped, deletion being requested, account access being suspended, and relevant evidence being preserved.

Hiro and authorised service providers may use cookies, local storage, logs or similar technologies that are necessary to:

• operate forms and account sessions;
• authenticate users;
• protect accounts and prevent misuse;
• remember essential settings;
• diagnose errors and performance issues;
• measure service and campaign effectiveness; and
• improve Hiro.

If Hiro later introduces non-essential advertising, behavioural tracking or analytics technologies, additional notice or choice will be provided where required.

We take reasonable administrative, technical and organisational measures to protect personal data against unauthorised access, collection, use, disclosure, copying, modification, loss, disposal or similar risks.

Measures may include:

• role-based access controls;
• authentication and account-security controls;
• masking and controlled identity disclosure;
• secure or expiring document links;
• restricted file and database permissions;
• access, change and download logs;
• watermarks on confidential screens;
• staff and service-provider confidentiality duties;
• backups, monitoring and incident-response procedures; and
• regular review of access and retention.

No website, electronic transmission or storage system can be guaranteed completely secure. Users must protect their login credentials and notify Hiro promptly of suspected unauthorised access.

We retain personal data only for as long as it is reasonably needed for the relevant purpose or to satisfy legal, MOM, accounting, audit, complaint, dispute, fraud-prevention, security or evidential requirements.

Our working retention schedule includes:

• Interest Forms that do not progress: normally up to 12 months after the last meaningful contact;
• inactive candidate or employer profile information: normally up to 24 months after account closure or last activity, unless a longer period is required;
• recruitment and referral records required by MOM: at least one year from the relevant referral;
• work-pass application and renewal documents required by MOM: at least three years from the relevant application or renewal;
• invoices, payment and related company records: at least five years from the relevant Year of Assessment; and
• complaints, investigations, disputes and legal evidence: for as long as reasonably necessary to resolve or defend the matter.

When personal data is no longer required, we will take reasonable steps to delete, anonymise or securely dispose of it.

Subject to applicable law and reasonable identity verification, an individual may contact our Data Protection Officer to:

• request access to personal data held about them;
• request correction of inaccurate or incomplete data;
• withdraw consent where legally permitted;
• request account closure;
• stop optional marketing communications; or
• request human review of an AI-assisted Singapore-Ready Score, readiness band or match.

We will normally respond to an access or correction request within 30 days. If more time is needed, we will inform the requester within that period and provide an indication of when we expect to respond.

We may request information to verify the requester’s identity and authority. A reasonable fee may be charged for an access request where permitted, and the requester will be informed beforehand.

Withdrawal of consent may prevent Hiro from maintaining a profile, arranging an interview, processing a work-pass matter or continuing placement services.

MIRACHAEL SHINES may continue retaining or using records where required or permitted for legal, MOM, accounting, contractual, complaint, dispute, fraud-prevention, security or audit purposes.

Where we become aware of a suspected personal-data incident, we may investigate, contain and assess the matter, preserve relevant evidence and take appropriate corrective action.

We will notify the PDPC and affected individuals where notification is required by applicable law.

Users should promptly report suspected unauthorised access, disclosure, loss, recording or sharing to our Data Protection Officer.

Hiro may link to or use third-party forms, communications, meeting, authentication, storage or other services. Those providers may have their own privacy notices and security practices.

When a third-party service processes personal data on our behalf, we will take reasonable steps to appoint and manage it appropriately. Where a user independently leaves Hiro for an unrelated third-party service, that third party’s own terms and privacy practices may apply.

We may update this Privacy Policy to reflect changes in Hiro, legal requirements, service providers or operational practices.

The updated date will be shown at the top of this page. Where a change is material, we may provide additional notice through Hiro, email or another appropriate channel.

Where translations are provided for convenience, the English version will prevail to the extent permitted by law if there is an inconsistency.

Questions, requests or complaints concerning personal data may be directed to:

Please do not send passwords, recovery codes, secret keys, full payment-card details or unnecessary identity documents by email.