RECRUITERFY PRIVACY POLICY

U.S.-focused privacy notice for an AI-assisted recruiter project-management, candidate-ranking, and candidate-tracking platform
Last Updated: September 16, 2026 | Recruiterfy Privacy Version 3.6

This Privacy Policy is a notice describing our privacy practices. It is not a contract and does not create contractual warranties. Our contractual data-processing obligations are set out in the Data Processing Addendum at Schedule B of the Terms of Service, which each customer accepts inside the product when its account is set up.

This Privacy Policy explains how Recruiterfy AI, Inc., a Delaware corporation with operations based in California, collects, uses, discloses, retains, and protects personal information through the Recruiterfy platform, including its website, software, AI-assisted recruiting workflow tools, candidate ranking tools, job workflow tools, and related services.

This Privacy Policy applies to account users, website visitors, prospects, applicants to the Founders Club and waitlist, customers, hiring managers, recruiters, administrators, and other individuals who interact with Recruiterfy.

For Candidate Data uploaded or entered by a customer, Recruiterfy generally acts as a service provider, processor, or subprocessor for privacy-law purposes, and the customer is responsible for its own privacy notices, candidate notices, consents, employment compliance, and hiring decisions. That privacy-law role does not determine whether a different employment or AI law independently imposes duties directly on Recruiterfy.

1. WHO WE ARE

Recruiterfy is a recruiter project-management, candidate-ranking, and candidate-tracking tool that helps recruiters, employers, and hiring teams create job content, organize candidate pipelines, analyze resumes, generate candidate summaries, compare candidate information to job requirements, and support human recruiting workflows. Recruiterfy is not an applicant tracking system, customer relationship management system, or system of record.

Contact: Recruiterfy AI, Inc., Attn: Privacy, Email: [email protected].

2. SCOPE AND U.S. FOCUS

Recruiterfy is a U.S.-focused SaaS platform for recruiting agencies, employers, hiring teams, and authorized business users across the United States. The services are not designed for non-U.S. recruiting, non-U.S. candidate processing, or international data transfers unless the customer confirms that such use complies with all applicable privacy, employment, data transfer, and candidate notice laws.

Recruiterfy is recruiter-driven: Candidate Data is generally entered, uploaded, or recorded by the customer’s recruiters. Where a customer’s plan includes candidate links, a candidate may provide limited information directly through a link a recruiter issues, and Recruiterfy processes it on the customer’s behalf in the same way (Section 18, Candidate Questionnaire Notice).

AI voice or video pre-screening is not part of the services, and the related personal information is not collected. The customer’s ATS/CRM remains the customer’s system of record; Recruiterfy holds the company, job, and candidate context its AI features require as a working copy and does not synchronize with the customer’s ATS/CRM.

3. THE TWO ROLES WE PLAY

Recruiterfy plays two different roles, and different parts of this policy apply to each.

As a service provider or processor, for candidate information: When a customer uploads or enters Candidate Data into Recruiterfy, the customer determines the recruiting purpose and the job-related criteria for that processing. A customer may be the business or controller in its own right, or it may be a recruiting agency acting as a service provider or processor for its employer client. Where the customer is itself a service provider or processor, Recruiterfy acts as its subprocessor. Recruiterfy processes Candidate Data on the customer’s documented instructions and under the DPA in Schedule B of the Terms. If a privacy request relates to Candidate Data controlled by one of our customers, we will direct the request to that customer or work with the customer as required. This allocation addresses privacy-law processing roles and does not waive a legal duty that another law imposes directly on Recruiterfy.
As a business or controller, where applicable, for our own users and visitors: For information about our account holders, billing contacts, website visitors, prospects, and people who apply to the Founders Club or join the waitlist, Recruiterfy decides why and how that information is processed and acts as the business or controller where those roles apply to us. Recruiterfy may not currently meet the statutory thresholds that define a “business” under the CCPA; we describe our practices and honor requests regardless. Sections 4, 16, and 17 describe those rights.

4. PERSONAL INFORMATION WE COLLECT

Account and Contact Information: name, business email, phone number, company name, job title, username, role, permissions, authentication identifiers, and account settings.
Billing and Subscription Information: billing contact name and email, billing address, company name, tax identifiers or exemption certificates, plan and seat count, billing term (monthly or annual), subscription and renewal dates, credit allowance and consumption, invoices, transaction history, and the last four digits, card brand, and expiry of the payment card. We do not collect or store full payment card numbers, CVV codes, or bank account numbers. Card details are entered directly with our payment processor and are held by that processor, not by Recruiterfy. See Section 10.
Founders Club and Waitlist Application Information: name, business email, company name, website, role, team size, recruiting focus, and any information voluntarily provided in an application or waitlist form on our website, together with the date of submission and the outcome of the application.
Reference Information: where a customer records a candidate’s professional references at offer stage, the reference’s name, title, relationship to the candidate, and contact details, entered by the customer’s recruiter. Recruiterfy stores this for the customer and does not contact references itself.
Customer and Business Information: company profile information, hiring team information, client information, job information, department information, hiring manager details, and business notes.
Candidate Data Entered by Customers: resumes, CVs, LinkedIn profile information provided by customers, imported contact or data-list information, work history, education history, certifications, skills, licenses, location, compensation expectations, interview notes, recruiter notes, hiring manager feedback, candidate status, contact information, and other candidate-related information submitted by the customer’s recruiters. All Candidate Data is entered, uploaded, or recorded by the customer’s recruiters; Recruiterfy does not collect information directly from candidates.
Candidate-Provided Information Through Links: where a customer’s plan includes candidate links and a recruiter sends one, the answers a candidate enters (travel or location constraints, role interest, compensation expectations, availability, notice period, willingness to take part in a background-check or drug-screening process if later requested, written screening answers, a confirmation or correction of a summary, an offer response, a message to the recruiter, or a request to stop contact or to correct or delete information), together with the technical information the link generates: IP address, browser and device information, timestamps, records of when the link was opened and used, verification records for requests made through it, and related security logs.
Recruiting Workflow Data: job descriptions, job requirements, must-have and nice-to-have criteria, screening questions, interview questions, candidate rankings, candidate summaries, scoring inputs, AI-generated outputs, pipeline and interview stages, comments, notes, and user actions.
AI Interaction Data: prompts, uploaded content, generated responses, AI-assisted summaries, rankings, scoring explanations, recommendations, user edits, and related workflow activity.
Screening and Pre-Screen Records: records of recruiter-conducted candidate pre-screening, including the recruiter-entered or recruiter-pasted text of a screening conversation, yes/no answers to job-related screening questions, AI-extracted structured answers and confidence levels, and the resulting job-fit score and fit band (for example, Ideal Fit, Good Fit, or Not a Fit). A recruiter may override the fit band.
Usage, Device, and Log Information: IP address, browser type, device type, operating system, pages viewed, features used, login activity, timestamps, referring URLs, crash reports, performance logs, security logs, and diagnostic information.
Communications: emails, support requests, demo requests, survey responses, feedback session notes, and other communications with us.
Cookies and Similar Technologies: we may use cookies, local storage, and similar technologies to operate the website and services, remember preferences, improve performance, understand usage, and protect security.

5. SENSITIVE PERSONAL INFORMATION

The services are not designed to request, collect, or use highly sensitive personal information as a ranking or screening criterion. Customers should not upload Social Security numbers, driver’s license numbers, passport numbers, financial account numbers, medical records, genetic information, biometric identifiers, immigration documents, background check reports, or government identification documents. Resumes and recruiter-provided materials may incidentally contain sensitive information; incidental presence does not authorize a customer to use protected characteristics or sensitive traits as ranking, filtering, or employment-decision criteria. Customers are responsible for ensuring that Candidate Data is collected, entered, and used lawfully.

6. HOW WE COLLECT PERSONAL INFORMATION

We collect personal information from:

You directly, when you create an account, subscribe, apply to the Founders Club, join the waitlist, request a demo, or use the services.
Customers and Authorized Users, when they upload or enter resumes, jobs, notes, candidate data, transcripts, or workflow information.
Candidates directly, through a recruiter-initiated link where the customer’s plan includes candidate links, on the customer’s behalf.
Our payment processor, which returns transaction results and limited card metadata.
Service providers used for hosting, authentication, email, support, security, and related operations; customer-selected integrations if and when enabled.
Public or business sources for company and business enrichment where permitted; and automatically through cookies, logs, and platform usage data.

Recruiterfy does not independently collect Candidate Data from candidates through candidate-facing forms, voice agents, or video interviews.

7. HOW WE USE PERSONAL INFORMATION

We may use personal information to: provide, operate, maintain, and improve the services; create and manage accounts; take payment, manage subscriptions and renewals, measure credit usage, issue invoices, and prevent payment fraud; evaluate and respond to Founders Club and waitlist applications; process Customer Data and Candidate Data on behalf of customers; generate AI-assisted job descriptions, summaries, rankings, recommendations, questions, reports, and workflow outputs; support recruiting workflow and candidate pipeline management; provide customer support; communicate about the services and send service, security, billing, renewal, and administrative notices; send marketing communications where permitted, which you can opt out of at any time; analyze usage and improve performance; detect, prevent, and investigate fraud, abuse, security incidents, and unauthorized access; enforce our Terms of Service; comply with legal obligations; protect the rights, safety, and security of Recruiterfy, customers, users, candidates, and third parties; and develop aggregated or de-identified insights that do not identify individuals.

For Customer Data and Candidate Data, these purposes are limited by the DPA and Section 12; a general reference to product improvement does not authorize model training or reuse of candidate content for general development or evaluation. Service, security, billing, and renewal notices are not marketing and cannot be opted out of while an account is active.

8. AI-ASSISTED PROCESSING

Recruiterfy uses artificial intelligence and application logic to process Customer Data and Candidate Data, including generating and enhancing job descriptions and Position Packets, generating and validating suggested screening and interview questions, enriching company information, parsing and structuring resumes, extracting cited job-related evidence, generating candidate summaries, producing rankings and fit indicators against customer-defined job requirements, extracting structured answers from recruiter-provided screening transcripts, generating candidate observations and briefings, and re-computing rankings after an Agency Interview.

AI services may extract evidence and generate text. Recruiterfy’s application logic may calculate scores or fit bands from the job criteria, configured weighting, and evidence available in the customer workspace. AI processing uses the enterprise AI provider identified in Section 10 under written terms restricting the use of Customer Data and Candidate Data to train or fine-tune AI models without Recruiterfy’s permission or instruction. Recruiterfy does not give that permission or instruction. Section 12 describes our broader no-training and model-development restrictions.

Recruiterfy does not make final hiring decisions, and customers remain responsible for meaningful human review and employment-related decisions.

9. AUTOMATED DECISIONMAKING, PROFILING, AND EMPLOYMENT AI NOTICES

Recruiterfy provides AI-assisted workflow tools. The services may generate rankings, scores, fit indicators, summaries, or recommendations that help customers review candidate information. These outputs are advisory and are not final employment decisions. A recruiter can adjust or override a score or fit band. The services do not automatically advance, reject, rank out, or otherwise dispose of a candidate based on a merit score. Customers must not use Recruiterfy output as the sole basis for an automated employment decision without meaningful human review.

Federal, state, or local laws may require customers to provide notices, obtain consents, complete bias audits or impact assessments, provide opt-out, appeal, accommodation, or alternative-process rights, retain records, or explain the use of automated or AI-assisted tools. Customers are responsible for determining and satisfying obligations that apply to their own recruiting and employment activities. Where applicable law imposes a duty directly on Recruiterfy, Recruiterfy is responsible for that duty and these allocations do not waive or transfer it. Where Candidate Data is controlled by a customer, Recruiterfy will assist the customer as required by contract or law.

Recruiterfy does not use automated decisionmaking to produce legal or similarly significant effects concerning its own account holders, applicants to the Founders Club, or website visitors.

10. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information to the following categories of recipients:

Service Providers and Subprocessors. We separate our providers into three categories, because they do different things with different information. Where a location or setting below is marked “to be confirmed”, we will state it in the next update of this Policy.

Category 1. DPA subprocessors. These providers process personal information that our customers control, on Recruiterfy’s behalf, to provide the Services. They are subject to Schedule B of the Terms, and we give at least thirty (30) days’ notice before adding or replacing one, subject to the urgent-change exception and objection rights in Schedule B.

Provider	What it receives	Purpose	Where	Contract	Retention	Candidate Data
Google Cloud Platform (Cloud Run, Cloud SQL for PostgreSQL, Cloud Storage, Memorystore cache, Cloud Logging, Secret Manager)	All Customer Data and Candidate Data stored or processed by the Services, including resume files, and application logs	Application hosting, database, file storage, cache, logging, and secrets	United States (us-central1)	Google Cloud Platform Terms of Service with the Cloud Data Processing Addendum	Retained as described in Section 13; automated database backups are kept for seven (7) days on a rolling basis	Yes
Google Cloud Vertex AI (Gemini models)	Text extracted from resumes, profiles, notes, and recruiter-supplied transcripts; job descriptions and Position Packet text	AI evidence extraction, summaries, ranking, question generation, and embeddings	United States	Google Cloud Platform Terms of Service, the Cloud Data Processing Addendum, and Google’s generative AI terms, under which Google does not use customer content to train its models	Google does not retain prompts or outputs for model training; any short-term abuse-monitoring retention is governed by Google’s terms (configured setting to be confirmed)	Yes
Cloudflare	Network traffic to and from the Services, including request metadata and IP addresses; static assets it caches	DNS, TLS termination, content delivery, and protection against attacks for the website and the application	Global network; traffic is served from the location nearest the user	Cloudflare Customer Terms with the Cloudflare Data Processing Addendum	Cloudflare may cache static assets at its edge and retains request logs for its standard period; application data is stored on Google Cloud, not by Cloudflare (configured cache and log settings to be confirmed)	In transit
SMTP2GO	Recipient name and email address, and the content of transactional email sent by the Services (invitations, hiring-manager share notices, candidate-flow messages, account and billing notices)	Transactional email delivery	Routing region to be confirmed	SMTP2GO Terms of Service and Data Processing Addendum	Delivery logs retained per SMTP2GO settings (retention period to be confirmed)	Yes, where a message is sent to or about a candidate

Category 2. Providers for Recruiterfy’s own operations. These providers support our account administration, billing, sign-in, website, and analytics. They receive information about our customers’ users, prospects, and website visitors. They are not subprocessors for Candidate Data, because the Services do not send Candidate Data to them.

Provider	What it receives	Purpose	Where	Contract	Candidate Data
Stripe	Billing contact name and email, company name, payment method details, invoices, and subscription status	Payment processing and subscription billing	United States	Stripe Services Agreement	No
Google (Sign in with Google)	The signing-in user’s name, email address, and Google account identifier	Authentication for Authorized Users who choose Google sign-in	United States	Google API Services User Data Policy and Google Terms of Service	No
Microsoft (Microsoft Entra ID sign-in)	The signing-in user’s name, email address, and Microsoft account identifier	Authentication for Authorized Users who choose Microsoft sign-in	United States	Microsoft Services Agreement and Microsoft Identity Platform terms	No
Website hosting for recruiterfy.ai (WordPress; provider to be named)	Website visitor requests; the entries submitted on our Founders Club, waitlist, and pilot application forms (WPForms), which are stored in the website database and emailed to Recruiterfy	Public website and application forms	To be confirmed	Hosting provider terms	No
Microsoft 365 (Exchange Online, SharePoint, OneDrive)	Email to and from Recruiterfy addresses, including support and privacy requests and any attachments a customer sends; Recruiterfy’s own business documents	Company email, calendar, and document storage; support mailbox	United States (tenant data-location setting to be confirmed)	Microsoft Customer Agreement and Microsoft Products and Services Data Protection Addendum	Only where a customer or candidate emails it to us
Slack	Names, email addresses, and messages of Founders Club members who join the shared channel	Founders Club community channel	United States (workspace plan and data-residency setting to be confirmed)	Slack Customer Terms of Service	No; members must not post it (Schedule A, clause A16)
Microsoft Teams or Zoom (the session invitation names which)	Names, voices, and video of participants who join a recorded session; the recording itself	Weekly Founders Club sessions and their recordings	United States (to be confirmed before the first session)	Microsoft Customer Agreement and Data Protection Addendum, or Zoom Terms of Service and Global DPA (Recordings retained twenty-four (24) months after the session)	No; participants must not disclose it (Schedule A, clause A16)
HubSpot (legacy)	Waitlist and Founders Club form entries submitted before September 2026, when the website forms ran on HubSpot	None today; any entries collected before the forms moved to WPForms remain in HubSpot until deleted	United States	HubSpot Customer Terms of Service	No
Google Fonts	The visitor’s IP address and browser request when a web page loads a font	Web fonts on the public website	Google’s global network	Google Fonts terms	No
Vimeo	The visitor’s IP address and player interactions when a page with an embedded video loads	Video playback on the public website	Vimeo’s global network	Vimeo Terms of Service	No

Category 3. Customer-selected integrations. Where an Authorized User connects a tool of the customer’s own choosing, information flows to that tool under the customer’s own agreement with it, not under Schedule B, and the tool is not a Recruiterfy subprocessor. Today the Services offer one such integration: a recruiter may connect their own Google Workspace (Gmail) or Microsoft 365 (Outlook) mailbox so that messages composed in the Services are sent from the recruiter’s own address. Messages sent that way, including any candidate name and email address they contain, are processed by Google or Microsoft under the customer’s own agreement with that provider.

This section lists Recruiterfy’s current Candidate Data subprocessors and certain other key operational providers. The Candidate Data subprocessor list in Category 1 is complete; Categories 2 and 3 name the providers that receive personal information about our users, prospects, and visitors and may not name every internal tool that receives none. We do not list a provider as a Candidate Data subprocessor unless the actual data flow supports that classification. The list may otherwise be updated as the services evolve and as required by law; Section 24 governs notice of changes.

What we do not use for candidate screening or advertising: Recruiterfy does not use an AI voice pre-screen vendor and does not use third-party advertising or cross-context behavioral advertising in the authenticated platform. We do not currently use session-recording tools in the authenticated platform. If these practices materially change, we will update this Policy and provide any notice or choice required by applicable law.

Customers and Authorized Users: information uploaded to a customer workspace may be visible to that customer’s Authorized Users based on account permissions.
Integrations: if the customer connects third-party tools, we may disclose information as needed to operate the integration.
Legal and Compliance Recipients: we may disclose information if required by law, subpoena, court order, regulatory or government request, legal process, or to protect rights, safety, security, and property.
Business Transfers: we may disclose information in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction. A successor’s handling of transferred Customer Data is governed by the contractual obligations it assumes under the Terms and DPA and by applicable law. If a successor materially changes the privacy practices described in this Policy, it must provide any notice and rights required by applicable law.
Professional Advisors: we may disclose information to attorneys, accountants, auditors, insurers, advisors, and consultants.

Recruiterfy does not sell personal information and does not share personal information for cross-context behavioral advertising as defined under California privacy law. If Recruiterfy later uses advertising or retargeting technologies that constitute sale or sharing under applicable privacy laws, we will update this Privacy Policy and provide required opt-out rights before doing so.

12. USE OF CUSTOMER DATA FOR MODEL TRAINING

Recruiterfy will not use Customer Data or Candidate Data to train or fine-tune any AI model, including any foundation, general-purpose, shared, Recruiterfy-specific, or customer-specific model, and will not authorize a subprocessor or model provider to do so. Recruiterfy also will not use that data to develop or improve an AI model, or as testing or validation data for those purposes.

Recruiterfy may process Customer Data and Candidate Data as necessary to operate, troubleshoot, secure, and verify the correct functioning of the services for the customer, including quality checks necessary to deliver the customer’s requested processing. This permission does not authorize reuse of customer or candidate content as a standing development, benchmarking, or evaluation dataset for AI models or the Services. Customer-instructed or legally required compliance and bias-assessment assistance remains subject to the DPA and does not authorize model training.

Recruiterfy may use aggregated or de-identified information to measure service usage, reliability, security, and performance and to improve non-model product functionality, provided the information does not identify a customer, authorized user, candidates, applicants, employees, or other individuals. Recruiterfy will maintain reasonable measures against re-identification and will not attempt to re-identify the information. Aggregation or de-identification is not an exception to the no-training and model-development restrictions, which also apply to information derived from Customer Data or Candidate Data.

Recruiterfy does not use hiring outcomes as training data. Whether a candidate was hired, placed, rejected, or retained is never used as a training label, target variable, or feedback signal for any ranking, scoring, or matching model.

13. DATA RETENTION

We retain personal information for as long as reasonably necessary to provide the services, maintain accounts, comply with law, resolve disputes, enforce agreements, maintain security, support backups, and operate our business. Retention periods may vary based on the type of information, customer settings, legal requirements, contract requirements, and operational needs.

General guidelines:

Account information is retained while the account is active and for a reasonable period after closure.
Customer Data and Candidate Data are retained according to customer settings, contract terms, legal requirements, and backup cycles. Core records (candidate profiles, resumes, notes, pipeline records) are retained while the customer’s account is active until the customer deletes them or the account is closed. Archiving a record does not itself delete it. After a subscription ends, Customer Data remains available for export for thirty (30) days and is deleted from active systems within ninety (90) days after that window closes, as described in Section 28 of the Terms of Service.
Ranking records: Recruiterfy retains ranking results and the evidence supporting them for at least four (4) years from creation or receipt as a baseline designed to support employment-recordkeeping obligations that may apply to automated recruiting tools, including California FEHA requirements where applicable. If applicable law measures retention from a later personnel action, a legal hold applies, or another law requires a longer period, the legally required period controls to the extent the later date or obligation is known to Recruiterfy. A customer remains independently responsible for its own recordkeeping obligations. Before Recruiterfy deletes ranking records retained under this rule, Recruiterfy will make an export available to the customer. Recruiterfy may de-identify its retained copy only where doing so is consistent with applicable recordkeeping, legal-hold, and evidentiary obligations. A deletion request does not require deletion while applicable law requires Recruiterfy to retain the record.
Billing and transaction records are retained for the period required by tax, accounting, and audit law, generally seven years.
Founders Club and waitlist applications are retained while the program is open and for a reasonable period afterwards, and are deleted on request.
Security logs and support communications are retained for security, fraud-prevention, quality, and legal purposes.
De-identified or aggregated data may be retained without time limit.

Deletion on request: A customer may ask us to delete its account and data at any time by writing to [email protected]. We will confirm the request and delete data from active systems within thirty (30) days of confirmation, except for records subject to a legal hold, applicable retention duty, billing or tax requirement, security requirement, or ordinary backup cycle. If a customer cancels without requesting immediate account deletion, the thirty-day export window and post-termination deletion schedule in Section 28 of the Terms apply.

A candidate may ask the customer, or ask us at [email protected], to delete their record; we verify the requester’s identity where the request comes to us directly, and once the customer confirms or does not object within ten days, we delete the record from the customer’s active use within thirty days of confirmation, subject to legal holds and retention duties and to residual encrypted backups that expire on the ordinary cycle, keep only the four-year evaluation record under an internal identifier, and keep any request the candidate made to stop contact so that it keeps working. A candidate who is later imported again by the same customer is a new record.

Deletion of an account is carried out by Recruiterfy on request; the Services do not yet offer a self-service control for deleting an account or an individual candidate record, so a request by email is the mechanism. Deleted information is removed from active systems and is not ordinarily recoverable through the services; residual encrypted backup copies expire on the normal backup cycle. Information deleted from the active service may persist in encrypted backups for a limited period before being overwritten.

Customers may have separate legal obligations to retain employment, candidate, applicant, AI-use, consent, notice, and decision records; deleting data from Recruiterfy does not remove those obligations. Deletion requests are honored for personal information that Recruiterfy is legally permitted to delete. If Recruiterfy must retain particular records, we will tell the customer, where required and reasonably practicable, what category was retained, the basis for retention, and the applicable period.

14. SECURITY

We use commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information, including encryption of data in transit and at rest, password hashing, access controls and role-based permissions, tenant isolation enforced at the application layer on authenticated requests, and logging of platform-administrative actions and billing changes. Two-factor authentication for user sign-in is not yet available; single sign-on through Google, Microsoft, or a customer’s own OpenID Connect provider is.

No online service is fully secure. Customers and users are responsible for protecting login credentials, limiting account access, using strong authentication, and promptly reporting suspected unauthorized access.

Recruiterfy does not currently hold a SOC 2, ISO 27001, or equivalent security certification, and has not completed a third-party penetration test. We say so plainly rather than leave it to be inferred.

Security incidents: Recruiterfy will notify an affected customer of a security incident involving Customer Personal Information without unreasonable delay after we discover it or become aware of facts that create a reasonable belief that one has occurred; we do not wait for confirmation. Where California Civil Code section 1798.82(b) or another applicable law requires a more specific or faster notice, Recruiterfy will follow that requirement. The DPA in Schedule B of the Terms contains the operative incident definition, notice standard, and cooperation terms. We notify individuals directly where applicable law requires Recruiterfy to do so.

15. CUSTOMER RESPONSIBILITIES FOR CANDIDATE DATA

Customers are responsible for: providing privacy and candidate notices required for their own recruiting activities; obtaining required consents; confirming that Candidate Data was collected lawfully; complying with employment, anti-discrimination, privacy, AI, recordkeeping, and recruiting laws that apply to them; responding to rights requests for Candidate Data they control; using AI-assisted tools with meaningful human review; ensuring Recruiterfy is not used as the sole basis for final employment decisions; and completing audits, assessments, or records retention required of the customer. These customer responsibilities do not displace a duty that applicable law imposes directly on Recruiterfy.

16. PRIVACY RIGHTS

Depending on where you live and how your information is processed, you may have rights to: know what personal information we collect, use, disclose, or retain; access personal information; correct inaccurate personal information; delete personal information; opt out of sale or sharing; limit use or disclosure of sensitive personal information where applicable; receive a copy of personal information in a portable format; opt out of certain profiling or automated decisionmaking where applicable; appeal a privacy request decision where applicable; and not be discriminated against for exercising privacy rights.

To submit a request, contact [email protected]. We may need to verify your identity.

A request to stop contact is different: we honor it directly and at once, keyed to your email address or name and phone, for every message a customer would send you through Recruiterfy, and it survives the deletion of your record; the only message you will still receive is one you ask for, such as a verification email. You may knowingly withdraw a stop-contact request by a verified request to us or in writing to the customer’s recruiter, who records it; otherwise it stays in force. We will respond within the time the applicable law requires, generally forty-five (45) days, and will tell you if we need an extension.

If your request relates to Candidate Data controlled by one of our customers, we will direct you to that customer or work with that customer to respond. We are the service provider for that information, not the business that decides how it is used.

17. CALIFORNIA PRIVACY NOTICE

This section applies to California residents where California privacy law applies.

Categories Collected: in the last 12 months we may have collected identifiers (name, email, phone, IP address, account ID); customer records (account, business contact details, billing contact and billing address); commercial information (service usage, subscription plan, transaction and purchase history); financial information limited to payment card brand, last four digits, and expiry – we do not collect full card numbers; internet or network activity (log, device, browser, feature usage, security logs); professional or employment-related information (job title, company, resumes, work history, education, certifications, skills, recruiting notes); education information; inferences (candidate job-fit scores and fit bands, AI-extracted screening answers, match indicators, workflow recommendations); and sensitive personal information only if uploaded by a customer or included in user-submitted content.
Sources: users, customers, and Authorized Users; candidates through customer-entered materials (and, where a recruiter enters or pastes it, the content of a screening conversation); applicants to the Founders Club and waitlist; our payment processor; service providers and integrations; cookies and logs; and publicly available or business sources where permitted.
Purposes: to provide the services, process customer-entered data, support AI-assisted recruiting workflows, manage accounts, take payment and manage subscriptions, evaluate program applications, provide support, improve the services, protect security, comply with law, and enforce agreements.
Disclosures: to service providers and subprocessors, customers, Authorized Users, customer-selected integrations, professional advisors, legal authorities, and parties involved in business transfers.
Sale or Sharing: we do not sell personal information and do not share personal information for cross-context behavioral advertising.
Sensitive Personal Information: we do not use sensitive personal information to infer characteristics unless permitted by law and necessary to provide the services requested by the customer.
Retention: we retain each category for as long as reasonably necessary for the purposes described in Section 13, subject to customer instructions, legal requirements, security needs, backup cycles, and dispute resolution.
California Rights: California residents may have the right to know, access, delete, correct, opt out of sale or sharing, limit use of sensitive personal information, access information about certain automated decisionmaking technology, opt out of certain automated decisionmaking technology, and not be discriminated against for exercising privacy rights, where applicable. Submit requests to [email protected].

18. NOTICE AT COLLECTION

Account Provisioning Notice: We collect your name, business email, company name, role, login information, billing contact and billing address, device information, and usage information to provide and secure Recruiterfy, take payment, support users, and improve the product. We keep this information while your account is active and afterwards only as described in Section 13, which sets out how long we retain each category and the criteria we use. We do not sell your personal information or share it for cross-context behavioral advertising. See this Privacy Policy for details.

Founders Club, Waitlist, and Pilot Application Notice: We collect the information you enter on our application or waitlist form to evaluate your application, contact you about it, and send you product updates you have asked for. Submitting a form is an acknowledgment of this Privacy Policy, not agreement to a contract; the Terms of Service govern your use of Recruiterfy only if your application is accepted and you activate an account. Submission does not guarantee admission or reserve a Founder number. We keep applications while the program is open and for a reasonable period afterwards, and delete them on request. You can withdraw and ask us to delete your application at any time by emailing [email protected]. We do not sell this information. This notice must appear on the application form itself, at or before the point of submission.

Candidate Upload Notice: When a recruiter uploads or enters resumes, candidate profiles, notes, transcripts, or other candidate information, Recruiterfy processes that information on behalf of the customer to provide AI-assisted recruiting workflow tools. Recruiterfy may extract job-related evidence, generate summaries or questions, and calculate advisory rankings or fit indicators. The services do not automatically advance or reject candidates based on a merit score. The customer is responsible for required candidate notices, consents, and meaningful human review. Recruiterfy does not make final hiring decisions and does not sell Candidate Data.

Candidate Questionnaire Notice: If a recruiter sends you a link to a Recruiterfy page, the answers you enter (for example your travel or location constraints, role interest, compensation expectations, availability, notice period, and whether you would be willing to take part in a background-check or drug-screening process if later requested, which is not authorization for one) are collected by Recruiterfy on behalf of the recruiting organization that sent the link and are recorded to your candidate record for that organization to review. They are not scored when you submit them; after a recruiter has reviewed them and confirmed them with you, certain answers may be used as job-related facts in later comparisons or rankings for that role. That organization decides how your information is used and is the business responsible for it (or a service provider for its employer client); Recruiterfy processes it as that organization’s service provider, processor, or subprocessor and does not sell it. Recruiterfy keeps it for as long as that organization keeps your record, subject to Section 13. To exercise privacy rights over it, contact the recruiting organization, or write to [email protected] and we will route your request to them. The page names the recruiting organization and gives its contact, and shows this notice, the full Candidate Privacy Notice, and the Candidate Link Use Notice before you enter anything; you acknowledge having read them. Those notices supplement, and do not replace, the notice the recruiting organization must give you under applicable law.

19. COOKIES

We use cookies and similar technologies to keep users logged in, remember preferences, and protect security. As of the date of this Policy the public website loads no third-party analytics or advertising tag, and the authenticated application uses no third-party analytics or session-recording tools; if we add one, we will update this Section first. You can control cookies through your browser settings; some features may not work properly if cookies are disabled. We do not use cookies for cross-context behavioral advertising.

20. GLOBAL PRIVACY CONTROL

pIf required by applicable law, we will honor legally recognized opt-out preference signals, such as Global Privacy Control. Because we do not sell or share personal information for cross-context behavioral advertising, opt-out preference signals may not change your experience unless our practices change.

21. CHILDREN

The services are intended for business users and are not directed to children under 16. We do not knowingly sell or share personal information of individuals under 16. If you believe a child provided personal information to us, contact [email protected].

22. INTERNATIONAL USERS

The services are operated from the United States. Our primary application hosting, database, and file storage are in the United States. Certain network, authentication, email-delivery, support, website, and similar providers may use global infrastructure, as disclosed in Section 10. We do not offer contractually committed data residency in any country. If you access the services from outside the United States, your information is transferred to and processed in the United States. Recruiterfy is intended for U.S.-based recruiting workflows unless Recruiterfy agrees otherwise in writing.

23. APPLICABLE LAW

Our privacy practices are subject to applicable federal and state law, including California law where applicable. This Privacy Policy is a notice of practices and does not create a separate contractual dispute regime. Contractual disputes between a Customer and Recruiterfy are governed by the Terms of Service.

24. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. If changes are material, we will notify users by email, in-platform notice, website notice, or another reasonable method, at least thirty (30) days before the change takes effect where practicable. The Last Updated date shows when this Privacy Policy was last revised. We keep prior versions available on request.

25. CONTACT US

Questions or privacy requests may be sent to:
Recruiterfy AI, Inc.
Attn: Privacy
Email: [email protected]

APPENDIX A – CANDIDATE-FACING AI NOTICE TEMPLATE (FOR CUSTOMER USE)

This template is a general starting point. Customers should adapt it for the location of the job, candidate, and customer, the workflow being used, and any jurisdiction-specific notice, consent, accommodation, appeal, or automated-employment-tool requirement that applies. Customer is responsible for the content and timing of its candidate notice.

“Our recruiting team may use Recruiterfy, an AI-assisted recruiting workflow tool, to help organize candidate information, compare resumes and candidate materials to job-related criteria, extract job-related evidence, generate summaries and interview questions, and produce advisory rankings or fit indicators for human review. Recruiterfy does not make final hiring decisions and does not automatically advance or reject candidates based on a merit score. A trained human reviewer will consider the candidate information before an employment decision is made. If you have questions about how your information is used, or if you need an accommodation, alternative review process, or additional information, please contact [CUSTOMER CONTACT].”