Privacy policy

The recruitingbot.com service is operated by its administrator, referred to in this policy as "we", "us" or "RecruitingBot". For personal data about website visitors, account holders, workspace members and people who write to our support address, we are the controller within the meaning of the EU General Data Protection Regulation (GDPR). That means we decide the purposes and means of processing and answer for it.

For personal data about candidates that a customer sources, imports, contacts, screens or shortlists through the service, the customer is the controller and we act as its processor. In that role we handle candidate data only to deliver the service the customer has subscribed to, following the customer's documented instructions as set out in our Terms of Service and the data processing terms incorporated into them.

You can reach us about anything in this policy at [email protected]. We do not run a phone line or a postal channel for privacy matters, so email is the fastest and only route, and it gives both sides a written record of the request.

We collect only what we need to run accounts, take payment, keep the service secure and answer support questions. Most of it comes directly from you when you sign up, configure a workspace or contact us. Some is generated automatically while you use the service.

Every use of personal data needs a lawful basis under Article 6 GDPR. We rely on three of them, depending on the purpose.

Customers use RecruitingBot to fill roles. To do that, the service gathers candidate information from three kinds of sources: public professional profiles and open web sources, the customer's own talent database imported by CSV or from an applicant tracking system, and applications submitted through a hosted apply page. Contact details may be obtained from a people data provider. The service then scores profiles against the customer's rubric, sends outreach from the customer's mailbox, classifies replies, runs screening questions and skills tests, offers interview slots and builds a shortlist that a human at the customer approves.

Candidate data can include name, headline, location, work history, skills, public profile links, email address, phone number where available, the source and lawful basis recorded for each record, messages exchanged, screening answers, test results and scheduling choices. The service is not designed to collect special category data such as health, religion, ethnicity or political opinions, and customers are not permitted to request or record it.

Because the customer is the controller, the customer chooses the lawful basis for its outreach, usually legitimate interest in contacting suitable professionals about a specific role, and is responsible for its legitimate interest assessment. The service supports this by logging the basis and source per candidate and providing a template assessment per role. Every hiring decision is taken by a person at the customer; the service does not make automated decisions that produce legal or similarly significant effects on candidates.

If you were contacted about a role through RecruitingBot, the first message you received contains a notice under Article 14 GDPR. It names the organization that contacted you, explains why, states where your details came from, how long they will be kept and which rights you have. Every message also carries a one click opt out link. Using it stops all further outreach from that customer's workspace straight away.

You may ask the organization that contacted you for access to your data, correction, deletion, restriction or a copy in a portable format, and you may object to the processing at any time. That organization is the controller and is best placed to answer. You can also write to [email protected]. We will forward your request to the right customer without delay and help the customer fulfil it, and where the customer has instructed us to, we act on it directly.

Sourced candidates who do not reply are deleted automatically 30 days after first contact by default. Each customer can set this retention period anywhere from 30 to 180 days for its workspace. Candidates who reply, apply or move forward in a process are kept according to the retention policy the customer sets for its applicants, and the customer remains responsible for choosing a period that suits its lawful basis.

When someone opts out, the full candidate record is removed according to the workspace retention rules, but we keep a one way hash of the email address on the workspace suppression list. The hash cannot be turned back into the address. Its only purpose is to recognize the same address if it is sourced again and make sure no further message is sent. Without it, an opt out could not be honored over time.

Account data is kept while your account is active. After an account is closed, workspace content including candidate data is deleted within 30 days, unless the customer exported it beforehand or a longer period is required to resolve a dispute. Usage logs are kept for up to 24 months because they are needed to answer payment disputes and investigate security incidents. Invoices and the billing records behind them are kept for as long as tax and accounting law requires, which is typically several years. Support emails are kept for up to 24 months after the last message in the conversation.

We do not sell personal data and we do not share it for advertising. We use a small number of service providers who process data on our behalf under written agreements that require confidentiality and appropriate security. We describe them by category rather than by name.

Our primary data storage is located in the EU. Some service providers, for example an AI model provider or a mail delivery provider, may process data outside the European Economic Area. Where that happens, we rely on an adequacy decision of the European Commission where one exists, and otherwise on the standard contractual clauses adopted by the Commission, together with additional measures such as encryption in transit and data minimization where appropriate. You can ask for more information about the safeguards used by writing to [email protected].

The website and application use only cookies that are strictly necessary for them to work. Because these cookies do not track you and are needed to provide the service you ask for, the law does not require a consent banner, and you will not see one. We do not use analytics cookies, advertising cookies, social media pixels or third party tracking scripts.

Under the GDPR you have the right to access the personal data we hold about you, to have inaccurate data corrected, to have data deleted where there is no longer a reason to keep it, to restrict processing in certain cases, to receive your data in a portable format, and to object to processing based on legitimate interest. Where we rely on consent for anything, you can withdraw it at any time without affecting earlier processing.

To use any of these rights, email [email protected] from the address linked to your account, or explain how we can confirm your identity. We answer within one month, which can be extended by two further months for complex requests, in which case we tell you why. Some data may have to be kept despite a deletion request, for example invoices that tax law requires us to retain.

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, work or where the alleged infringement took place. We would appreciate the chance to resolve the issue first, but you do not have to contact us before going to the authority.

Data is encrypted in transit with TLS and stored on servers in the EU with access restricted to the people who need it to run the service. Passwords are stored only as salted hashes. Mailbox and calendar connections use OAuth tokens that can be revoked by the customer at any time. Each workspace is logically separated from every other workspace. On the Agency plan, an audit log records administrative actions and access can be tied to single sign on. We review access regularly and keep backups so that data can be restored after a failure.

No system is perfectly secure. If a personal data breach occurs that is likely to put people at risk, we notify the affected customers without undue delay so they can meet their own obligations, and where we are the controller we notify the competent authority and the people concerned as the law requires. More detail is available on our security page.

RecruitingBot is a business service for recruiters and hiring teams. It is not intended for anyone under 18, and we do not knowingly collect data from minors as account holders. Customers must not use the service to source or contact people under 18. If you believe a minor's data has been processed, contact [email protected] and we will make sure it is deleted.

We update this policy when the service or the law changes. The date at the top shows the latest version. When a change materially affects how we handle account holders' data, we notify account owners by email before it takes effect. Customers who rely on our role as processor are informed of changes to the categories of service providers in the same way, so they can review them.

For any question about this policy, a request about your own data, or a request from a candidate that needs to reach the right customer, write to [email protected]. Please include enough detail for us to find the relevant account or record, such as the email address that was contacted and the approximate date of the message.