Privacy policy
This policy explains how RecruiterHQ handles personal data on this website, in the RecruiterHQ platform (app.recruiterhq.app), on careers pages and in the candidate portal. We keep it as short and concrete as we can.
1. Who we are
RecruiterHQ makes recruitment software. For questions about privacy, or to use your rights, e-mail recruiterhqapp@protonmail.com.
2. Two roles: for our customers, and for ourselves
When an organisation recruits with RecruiterHQ
Organisations (our customers) use RecruiterHQ to publish jobs and handle applications. For the data of their candidates and their own staff, that organisation is the controller: it decides what happens with the data and how long it is kept. RecruiterHQ is the processor and processes this data only on the organisation's instructions, under a data processing agreement.
Applied for a job? For questions about your application data, contact the organisation you applied to. You can see in your candidate portal how long your data is kept and whether you agreed to the talent pool. If you contact us, we pass your request on to that organisation.
When we decide ourselves
RecruiterHQ is the controller for data about visitors of this website, people who ask us to get in touch, the user accounts of our customers (to run and secure the service) and billing.
3. What we process and why
| Whose data | What | Why (legal basis) | How long |
|---|---|---|---|
| Website visitors | IP address, browser, pages requested, time (server logs). No analytics or tracking. | Security and troubleshooting (legitimate interest) | A limited period, then deleted |
| People who ask us to get in touch | Name, work e-mail, company, type of team, message, whether you'd like a demo | Answering your request (steps before a contract / legitimate interest) | As long as needed to follow up, at most 12 months unless you become a customer |
| Users of the platform (recruiters, hiring managers, interviewers, admins) | Name, e-mail, language, password (hashed), two-factor secret (encrypted), sessions (browser, IP address, times), activity log, notification preferences | Providing the service to our customer (contract) and keeping it secure (legitimate interest) | While the account exists; the activity log as long as the organisation's account exists |
| Billing contacts of customers | Organisation name, billing e-mail, plan, invoices, payment status | Contract and legal obligations (bookkeeping) | As long as the law requires (in the Netherlands: 7 years for bookkeeping) |
| Candidates (we act as processor) | Contact details, CV and documents, motivation, answers, messages, status history, interviews, internal reviews and feedback, talent-pool choice, AI analyses | Determined by the organisation you applied to | The retention period set by that organisation, shown in your candidate portal |
We don't sell personal data and don't use it for advertising.
4. AI features
RecruiterHQ offers AI features: reviewing and translating job ads, matching applications against a job's requirements and finding fitting people in an organisation's talent pool. These features run only when a user of the organisation starts them.
- Only what the feature needs is sent: the job text, and for matching the text of the CV with the name and contact details removed first.
- The AI model is provided by Anthropic PBC (United States) through its API. Under Anthropic's commercial terms, this data is not used to train its models.
- AI never decides. It shows what the documents say, with quotes as evidence; people at the organisation make every decision. Nobody is rejected automatically, so there is no automated decision-making as meant in Article 22 GDPR.
- Candidates who don't agree to the talent pool, or who asked for deletion, are left out of talent-pool matching.
5. Where your data is stored
The RecruiterHQ platform and its database are hosted in the European Union, on servers in Germany. E-mail is sent through an EU region. Some service providers (see below) are based outside the EU; for them we use the safeguards required by the GDPR.
6. Who helps us (sub-processors)
| Provider | What for | Where |
|---|---|---|
| Hosting provider | Servers and database of the platform | Germany (EU) |
| Mailgun Technologies, Inc. (Sinch) | Sending e-mails (notifications, sign-in links) | EU region |
| Stripe | Payments and invoices for customers. Card details go directly to Stripe; we never see them. | EU and United States |
| Anthropic PBC | AI features (see section 4) | United States |
Organisations can also connect Slack or Microsoft Teams themselves. They then receive a short notice of a new application (job and department; the candidate's name only if the organisation switches that on).
For transfers outside the EU we rely on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, where the provider is certified) or the European Commission's Standard Contractual Clauses.
7. Security
- Encrypted connections (HTTPS) everywhere.
- Two-factor authentication is required for everyone who works in an organisation's environment.
- Access by role and department or client, checked on the server for every request. Each organisation's data is also kept apart in the database itself.
- Passwords are stored as hashes, two-factor secrets encrypted. Documents are only available after signing in.
- Important actions are recorded in an activity log.
Found a security problem? Please tell us at recruiterhqapp@protonmail.com.
8. Your rights
You have the right to access, correct and delete your personal data, to restrict or object to processing, to data portability and to withdraw consent at any time. Candidates can do much of this directly in their portal, such as changing their talent-pool choice or asking for deletion.
E-mail recruiterhqapp@protonmail.com to use your rights. We answer within one month. If the data is processed for an organisation (see section 2), we forward your request to them.
You can also file a complaint with a data protection authority; in the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).
9. Changes
When we change this policy we update the date at the top. If a change matters for you, we let our customers know in advance.