Terms of Service

Shared Definitions

Capitalized terms used in these Terms have the meanings set out below or in the section where they first appear.

Bash: Bash AI Inc., a Delaware corporation with its principal business office at 7688 Saint Patrick Way, Dublin, California 94568, USA ("Bash", "we", "us", or "our").
Platform: Bash's hosted software, including the recruiter workspace, Ask Bash analytics, Live Co-pilot, Advocacy, Assessments, the Lite hiring flow, ATS integrations, and associated APIs, bots, and mobile surfaces.
Services: The Platform together with related support and professional services Bash provides under an Order Form.
Customer: The organization that has contracted with Bash for the Services (the "tenant"). Where in-product notices say "your organization" or name the hiring company, they refer to the Customer.
Order Form: An ordering document or agreement between Bash and a Customer specifying Services, Credits, and fees.
User: Any individual who accesses the Platform: Staff Users, Candidates, and Third-Party Participants.
Staff User: An individual authorized by a Customer to use the Platform under a role-based account (administrator, co-administrator, hiring manager, recruiter, or interviewer), or an authorized Bash operator.
Candidate: An individual who participates in a Customer's hiring process through the Platform — for example through an Advocacy conversation, an Assessment, a Lite application, or a recorded interview. Candidates do not create accounts; they access the Platform through personal, time-limited links and codes.
Verified Candidate: A Candidate who has opted into the identity-verification flow described in Privacy Policy §7 and Terms of Service §6.4.
Third-Party Participant: An individual who interacts with the Platform without an account and outside a Candidate flow: assessment collaborators invited by link, external recipients of shared reports, interviewers contributing to job-description enrichment, and participants in meetings that a Recording bot attends.
Customer Data: Data submitted to the Platform by or for a Customer, including job, pipeline, and organizational data, and including Candidate Data.
Candidate Data: Personal information about Candidates processed through the Platform on a Customer's behalf, as described in Privacy Policy §3.
Usage Data: Technical and operational data about use of the Platform (logs, metrics, diagnostics) that does not identify a Candidate except as needed for security and service integrity.
Recording: An audio, video, or transcript capture of an interview or meeting made through the Platform's meeting bots or voice features.
Credits: Prepaid usage units that meter certain Services as described in Terms of Service §8.
Sub-processor: A third-party service provider engaged by Bash to process Customer Data, Candidate Data, or other personal information to help provide, secure, support, maintain, improve, or protect the Services.

These Terms incorporate Bash's Privacy Policy and, where applicable, Bash's Data Processing Addendum. If documents conflict, the Order Form controls commercial terms, the Data Processing Addendum controls the processing of Customer Personal Data, these Terms control use of the Services, and the Privacy Policy explains Bash's public privacy practices. For personal information, the more protective commitment in the Privacy Policy or Data Processing Addendum applies.

§1 Acceptance and parties bound

These Terms of Service (the "Terms") are a legally binding agreement between Bash and the Customer that executes an Order Form, accesses the Services, or otherwise uses the Platform. Each individual User must comply with the provisions applicable to their use of the Services. If you access the Services on behalf of an organization, you represent that you have authority to bind that organization, and "Customer" refers to that organization.

Staff Users — by accepting their invitation and signing in;
Candidates — by proceeding past a consent or invitation screen: starting an Advocacy conversation, consenting on an assessment invitation page, or verifying contact details in the Lite flow;
Collaborators and report recipients — by opening their personal link and, where asked, verifying their email with a one-time code;
Meeting participants — by remaining in a meeting after notice that it is recorded (§6.3 — participation, not contract, is the basis for recording notice).

By using the Services, accepting an invitation, opening a personal access link, starting a candidate flow, submitting information, signing an Order Form, or otherwise indicating acceptance, the Customer and applicable Users agree to these Terms. If you do not agree, do not access or use the Services.

§2 The Services

Bash provides a hosted hiring-intelligence Platform that may include a recruiter workspace, candidate pipeline tools, Ask Bash analytics, AI-assisted interview kits, Live Co-pilot, Advocacy conversations, Assessments with integrity monitoring, Lite high-volume hiring workflows, optional identity verification, ATS integrations, APIs, bots, implementation support, and related professional services. Bash may update, improve, suspend, or discontinue features from time to time. During a paid subscription term, Bash will not materially reduce the core functionality of the purchased Services without providing a reasonable alternative or remedy. Beta, pilot, preview, or experimental features may be modified, suspended, or withdrawn at any time.

§3 Accounts and access credentials

Staff accounts are invite-only. There is no self-serve signup. Customer administrators invite Staff Users into roles (administrator, co-administrator, hiring manager, recruiter, interviewer); the Customer is responsible for who it invites, for keeping role assignments appropriate, and for its Staff Users' credential hygiene. Invitation and password-reset links are single-use and time-limited.
Candidates never create accounts. Candidate access is through personal, time-limited links and one-time codes. Access links, codes, session cookies, and invitations are personal and must not be shared or transferred: assessment invitation links are single-use; Advocacy conversation links expire 72 hours after issue; staff invitations expire in 7 days; one-time codes expire in minutes. Sessions may be bound to a device and connection for security. Suspected misuse should be reported to the recruiter or privacy@bash.ai.
Bash operator access. Authorized Bash personnel may access a Customer's tenant, including through a support impersonation mode, solely to provide support, maintain the Services, and meet legal obligations. Such access is logged.

§4 Acceptable use

No User may: probe, disable, or circumvent security or access controls; access another person's data or another tenant's workspace; scrape or bulk-extract data; misuse AI features to generate unlawful or infringing content; introduce malware; misrepresent their identity; or use the Platform to harass or discriminate. Candidates additionally agree not to have someone else take an assessment or conversation in their place.

Staff Users additionally agree to: access Candidate Data on a need-to-know basis within their role; not export or share it beyond their organization's policies; keep review human — Platform outputs are evidence, and §5(4) commits the Customer to human review before adverse decisions; and not attempt to derive protected characteristics from Platform data. Account actions are attributable and logged.

§5 Customer obligations

The Customer controls its hiring process and is solely responsible for how it configures, deploys, uses, and relies on the Services. The Customer agrees to the following obligations:

Recording notice and consent. Before enabling the meeting bot for any interview or meeting, the Customer will (i) notify every participant — the candidate, its own personnel, and any third party — that the meeting will be recorded and transcribed by an AI notetaker, and (ii) obtain every consent required by applicable law, including the all-party-consent recording laws of states such as California, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania, and Washington. The Customer will not enable Recording for a meeting where required consent has not been obtained.
AI-in-hiring and employment-law compliance. The Customer is responsible for all employer, deployer, controller, business, accessibility, anti-discrimination, workplace-monitoring, biometric, recording, automated-decision, notice, consent, human-review, contestability, appeal, recordkeeping, impact-assessment, and bias-audit obligations that apply to its use of the Services. Bash provides decision-support technology only and does not make hiring decisions for the Customer.
Candidate notices. Where the Customer is the business/controller, the Customer will give candidates the privacy notices its jurisdictions require, and will not configure white-labeling in a way that obscures legally required disclosures.
Human review. The Customer will ensure that Platform outputs are used as decision support with human review, and that no output — score, rating, integrity signal, or summary — is used as the sole basis for an employment decision.
Lawful data. The Customer warrants it has the right to submit the Customer Data it provides, including data imported from its ATS, and that its use of the Services complies with employment, anti-discrimination, and privacy law.

§6 Candidate participation

Candidates access the Platform free of charge. This section is the participation agreement for each candidate-facing product; the Privacy Policy describes the data each one touches.

6.1 Advocacy conversations

An Advocacy conversation is a structured chat — with an AI system, which Bash discloses plainly — designed to draw out evidence of a candidate's skills before an interview. Before it starts the candidate reviews a consent screen and chooses:

required — consent to the conversation itself, and consent to share responses with the hiring team (without these the conversation cannot proceed);
optional — consent to voice-note recording for quality purposes, and consent to extended retention; declining either costs nothing.

The AI will not ask about protected characteristics (age, gender, race or ethnicity, religion, disability or health, marital or family status) or salary history. If a candidate volunteers such information, it is not recorded as evidence and will not be followed up. The candidate may stop the conversation at any point, and exercising any privacy right never affects the application (Privacy Policy §12).

6.2 Assessments

Own work. Assessments measure how the candidate works, including — where the assessment allows — how they use AI assistance. The rules stated in the assessment itself apply; no one else may take it in the candidate's place.
Monitoring consented to. The invitation page lists the exact browser signals recorded while the candidate works (Privacy Policy §9). There is no webcam, screen recording, or audio capture. Everything recorded is evidence for a human reviewer — nothing disqualifies a candidate automatically.
Accommodations. If the hiring team grants accommodations, extended time applies and activity-pattern telemetry is switched off.
Work-style questionnaire. If offered, it is optional, never part of the score, and shared only as context with a notice that it was not used to rank the candidate; declining is never shown as a red flag.
Submissions. The candidate keeps ownership of the code and content they submit, grants Bash and the Customer a license to process, store, execute, and evaluate the submissions for the hiring process, and represents the submissions do not knowingly infringe another's rights.

6.3 Interviews and recording

Interviews scheduled through the Platform may be recorded and transcribed by an AI notetaker bot that joins the call visibly identified. The hiring company is responsible for notifying the candidate, and every other participant, before recording, and for obtaining any consent required by the participant's state law (§5(1)). By remaining in a meeting after such notice, a participant consents to the Recording described. Questions or objections about a recorded interview go to the hiring company, or to privacy@bash.ai.

6.4 Optional identity verification (Verified Candidates)

Some hiring processes offer identity verification. It is a separate, express opt-in, and this section is the written notice for it:

What is collected: facial data from the ID photo and a live selfie, used once to confirm the candidate is the document holder ("facial recognition" in the narrow, one-to-one sense). Bash stores the selfie and the result — never the ID document images, and never date of birth, gender, or nationality.
Purpose and term: identity verification for this hiring process only. The verification badge lasts up to 365 days; the selfie is destroyed when the badge expires or earlier on request, per Data Retention Policy §4.
Storage: in access-controlled private storage with the safeguards in Privacy Policy §14.
No sale: biometric data is never sold, leased, or traded, and is never used for automated hiring decisions.
Signature: checking the verification consent box (with name and date recorded) is the candidate's written consent to this processing.
Separate reuse choice: allowing the verified photo to be shown at the interview for comparison is its own optional checkbox; saying no does not affect the application in any way.
Declining verification entirely is allowed; where a role requires verification, the hiring company will say so and offer its alternative process.

§7 Guests: Third-Party Participants without accounts

Recipients of shared reports, assessment collaborators, and contributors to job-description chats access the Platform by personal link, verified by a one-time code where shown. They agree to treat shared reports and candidate materials as confidential, use them only for the purpose they were shared for, and not re-share them; access expires with the link. As between Bash and the Customer, the Customer is responsible for the individuals it invites.

§8 Fees and Credits

Fees are set in the Order Form. Metered Services (currently Assessments) are charged in prepaid Credits, which work as follows and only as follows:

Admission check. Sending an assessment requires sufficient Credit balance for the estimated cost of the batch; if the balance is insufficient the send is refused and nothing is charged.
Reserve, then reconcile. When a candidate starts, the estimated cost is reserved. On completion, the reservation is reconciled against actual metered usage. Actual usage above the reservation is capped at the reservation — an admitted candidate is never charged past what was reserved.
Voided attempts are fully refunded. Invalidated or abandoned sessions release their reservation in full.
Exhaustion pauses, never surprises. When Credits run out, further metered sends are refused until the balance is topped up under the Order Form; low-balance alerts fire before that point.
Ledger. All Credit movements are recorded in an append-only ledger available to the Customer on request.

Credit top-ups, invoicing, payment terms, taxes, and any treatment of unused Credits at termination are governed by the applicable Order Form. Unless an Order Form states otherwise, fees are non-cancelable and non-refundable, payment obligations are due in accordance with the Order Form, and the Customer is responsible for applicable taxes other than taxes based on Bash's net income.

§9 Customer Data; ownership

As between Bash and the Customer, the Customer owns Customer Data, including Candidate Data. Bash processes Customer Personal Data as a service provider, processor, or equivalent role in accordance with the Data Processing Addendum and Customer Instructions. Bash may use Usage Data and aggregated, de-identified, or synthetic information to operate, secure, maintain, test, analyze, and improve the Services, provided such information does not identify an individual or reveal a Customer's confidential hiring process. Bash will not use Customer Data or Candidate Data to train generalized AI models shared across customers unless the Customer expressly agrees in writing and the use is permitted by applicable law.

§10 Bash IP and output license

Bash owns the Platform, its software, models, workflows, templates, report formats, documentation, know-how, and all related improvements. During the applicable term, the Customer receives a limited, non-exclusive, non-transferable right to use the Services for its internal hiring purposes, subject to these Terms and the Order Form. As between the parties, the Customer owns reports generated from its Customer Data. Bash does not claim ownership of candidate submissions. Feedback may be used by Bash without restriction or obligation.

§11 AI outputs; not consumer reports

AI outputs are probabilistic and may be incomplete, inaccurate, or context-dependent. They are intended to support human review, not replace it. Bash does not warrant the accuracy, completeness, legal sufficiency, fairness, or suitability of any output. The Customer acknowledges and agrees that:

Bash is not a consumer reporting agency, and nothing produced by the Services — including scores, summaries, integrity signals, ratings, verification results, or reference notes — is intended to be a consumer report under the Fair Credit Reporting Act;
the Customer will not use the Services or their outputs as a factor in establishing eligibility for credit or insurance, as a substitute for a background check or consumer report, or for any other FCRA-permissible-purpose function;
the Customer is responsible for any adverse-action process applicable law requires of it as an employer.

§12 Confidentiality

Each party will protect the other's non-public information using at least reasonable care, use it only to perform or receive the Services, and disclose it only to personnel, affiliates, contractors, advisors, auditors, or legal representatives who need to know it and are bound by appropriate confidentiality obligations. Confidential information may be disclosed if required by law, provided the receiving party gives notice where legally permitted and reasonably cooperates to limit disclosure. Confidentiality obligations survive for three years after termination; trade-secret obligations survive for as long as the information remains a trade secret.

§13 Warranties and disclaimers

Bash will provide the Services with commercially reasonable skill and care and substantially as described in the applicable Order Form and product documentation. EXCEPT AS EXPRESSLY STATED, THE SERVICES AND ALL OUTPUTS ARE PROVIDED "AS IS" AND "AS AVAILABLE." TO THE MAXIMUM EXTENT PERMITTED BY LAW, BASH DISCLAIMS ALL OTHER WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, NON-INFRINGEMENT, ACCURACY, AVAILABILITY, AND ANY WARRANTY THAT AI OUTPUTS WILL BE COMPLETE, RELIABLE, ERROR-FREE, UNBIASED, OR SUITABLE FOR A PARTICULAR HIRING DECISION. Bash does not warrant hiring outcomes or the Customer's compliance with employment, privacy, AI, biometric, recording, accessibility, or anti-discrimination laws.

§14 Limitation of liability

TO THE MAXIMUM EXTENT PERMITTED BY LAW, NEITHER PARTY WILL BE LIABLE FOR INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, PUNITIVE, OR ENHANCED DAMAGES, OR FOR LOST PROFITS, LOST REVENUE, LOSS OF GOODWILL, BUSINESS INTERRUPTION, OR LOSS OF DATA, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. EXCEPT FOR EXCLUDED CLAIMS, EACH PARTY'S TOTAL AGGREGATE LIABILITY ARISING OUT OF OR RELATING TO THESE TERMS, THE SERVICES, OR ANY ORDER FORM WILL NOT EXCEED THE FEES PAID OR PAYABLE BY THE CUSTOMER TO BASH FOR THE AFFECTED SERVICES IN THE 12 MONTHS BEFORE THE EVENT GIVING RISE TO THE CLAIM. EXCLUDED CLAIMS ARE THE CUSTOMER'S PAYMENT OBLIGATIONS, THE CUSTOMER'S INDEMNITY OBLIGATIONS, A PARTY'S WILLFUL MISCONDUCT, AND LIABILITY THAT CANNOT BE LIMITED BY LAW. For data-protection claims, the Data Processing Addendum applies together with the liability limitations in these Terms, unless applicable law requires otherwise.

§15 Indemnification

By Bash. Bash will defend and indemnify the Customer against third-party claims alleging that the Platform, as provided by Bash and used as permitted under these Terms, infringes U.S. intellectual-property rights. Bash may, at its option, procure continued use rights, modify the Services, replace the affected functionality, or terminate the affected Order Form and provide any refund expressly required by that Order Form.
By the Customer. The Customer will defend and indemnify Bash against third-party claims arising from: (i) the Customer's hiring decisions, employment practices, or employment-law obligations; (ii) the Customer's failure to provide recording notices or obtain required recording consents; (iii) the Customer's failure to provide biometric, AI-in-hiring, privacy, accessibility, or workplace-monitoring notices or obtain required consents; (iv) use of outputs in violation of these Terms; or (v) Customer Data that the Customer had no right to provide or process through the Services.
Process. The indemnified party must promptly notify the indemnifying party of the claim, reasonably cooperate, and allow the indemnifying party to control the defense and settlement, provided that no settlement may admit fault or impose non-monetary obligations on the indemnified party without its consent.

§16 Term, suspension, and termination

These Terms apply for the term stated in the applicable Order Form. Either party may terminate an Order Form for material breach if the breach is not cured within 30 days after written notice. Bash may suspend access immediately, in whole or in part, if Bash reasonably believes continued access may create a security risk, legal risk, service-integrity risk, payment default, violation of these Terms, violation of law, or risk to another customer or individual. Upon termination or expiration, the Customer may export Customer Data during any reasonable export period made available by Bash, unless prohibited by law, security requirements, or the Customer's breach. Bash will delete or de-identify Customer Personal Data in accordance with the Data Processing Addendum, Privacy Policy, applicable law, and Bash's then-current retention procedures. Provisions that by their nature should survive termination will survive, including confidentiality, ownership, restrictions, disclaimers, limitations of liability, indemnities, payment obligations, governing law, dispute provisions, and data-protection obligations that continue under the Data Processing Addendum.

§17 Communications

By providing an email address or phone number in a Platform flow, a User agrees to receive the transactional messages needed to run it — invitations, links, status updates, and one-time verification codes by SMS. Message and data rates may apply to SMS; reply STOP to opt out of SMS (which may end a verification flow that requires it). Bash does not send marketing messages to Candidates.

§18 Governing law, arbitration, and disputes

These Terms and any dispute arising out of or relating to them, the Services, or an Order Form are governed by the laws of the State of California, without regard to conflict-of-law rules. Unless a signed Order Form or written agreement between the parties states a different dispute-resolution process, the dispute provisions in this Section apply to the maximum extent permitted by law.

Before starting arbitration or litigation, the party raising a dispute must give written notice describing the dispute and the relief sought. The parties will try in good faith to resolve the dispute informally for 30 days after notice, unless urgent relief is needed or applicable law requires a shorter period.

Except for the carve-outs below, any dispute, claim, or controversy arising out of or relating to these Terms, the Services, the Platform, a User's access to the Services, or an Order Form will be resolved by final and binding arbitration administered by the American Arbitration Association (AAA) under its applicable rules. The arbitration will take place in Alameda County, California, unless the parties agree otherwise or the arbitration provider permits remote proceedings. The arbitrator will have exclusive authority to resolve disputes about arbitrability, enforceability, interpretation, and scope of this arbitration agreement, except that a court will decide issues relating to the class-action waiver below. The arbitrator may award the same individual relief that a court could award, subject to the limitations and exclusions in these Terms.

To the maximum extent permitted by law, each party and each User agrees that disputes must be brought only on an individual basis and not as a class, collective, consolidated, representative, mass-arbitration, or private attorney general action. No arbitrator may consolidate claims of different persons or entities, preside over any class or representative proceeding, or award relief on behalf of anyone other than the individual claimant, unless Bash expressly agrees in writing. If this class-action waiver is found unenforceable for a particular claim, then that claim must proceed in court and not in arbitration, while the remainder of this Section will continue to apply to all arbitrable claims.

The following disputes are not required to be arbitrated and may be brought in court: claims for injunctive or equitable relief relating to intellectual-property rights, confidentiality, trade secrets, unauthorized access, security abuse, misuse of the Services, or actual or threatened harm to the Services or other users; claims to collect unpaid fees; and claims that qualify for small-claims court. For disputes not subject to arbitration, the parties consent to the exclusive jurisdiction and venue of the state and federal courts located in Alameda County, California, and waive any objection based on inconvenient forum or lack of personal jurisdiction.

§19 General

Legal notices to Bash must be sent to legal@bash.ai and by mail to Bash AI Inc., 7688 Saint Patrick Way, Dublin, California 94568, USA. Privacy questions and rights requests may be sent to privacy@bash.ai.
Security incidents, processing of Customer Personal Data, Sub-processors, audits, international transfers, privacy-rights assistance, and deletion are handled under the Data Processing Addendum where applicable.
Service levels. Any uptime, support, service-level, or maintenance commitments apply only if expressly stated in the applicable Order Form or a written service-level agreement signed by Bash.
Export and sanctions. Each party will comply with applicable US export-control and sanctions laws, and the Customer will not permit use of the Services by restricted parties.
Assignment requires consent, except to an affiliate or in a merger or sale of substantially all assets.
Entire agreement. The Order Form, these Terms, the Data Processing Addendum, the Privacy Policy, and any written policy or addendum expressly incorporated by reference form the entire agreement for their subject matter and replace all prior or contemporaneous understandings on that subject matter.