Data Protection Policy

What’s available now

For employers, Recrutora now offers the Employer, Recruiter and Team packages, including a free pilot for companies, with the full real-world hiring process: job posts, applications, CV screening, tests, scheduling, video interviews, emails to candidates and offers. For candidates, the Candidate package includes AI-powered interview practice, feedback reports, practice tests, a preparation plan, recorded video interviews, camera analysis and CV uploads.

At a glance

• Recrutora is a complete recruitment platform: employers, managers, and teams can manage their entire real-world hiring process here, while candidates can also practise for real interviews with AI interview simulations. We use your data only for these purposes. We don’t sell it or use it for personalised advertising.
• If you apply for a job through Recrutora, only the employer for that job (or the recruitment agency hiring on its behalf) can see your application. They may share your CV, without your contact details, with the person making the hiring decision. The application page shows the employer’s legal name and an email address for data-related requests. The employer is responsible for your application data, and we process it only on their behalf. AI does not score, rank or reject you: a person makes the decision. For details, see section 9.
• Employers see CVs with the keywords they selected first, ranked by how important each requirement is. This is a simple rule, with no AI involved. It doesn’t remove anyone from the list, but it may affect whose CV the employer reads first.
• Your account is stored in a database in the European Union. Some of our providers also operate outside the EU, with the safeguards described in section 10. You can always see who helps us and what each provider receives: the full list is in section 7.
• Your voice from practice sessions is sent to OpenAI only to make the session work. OpenAI doesn’t use it to train its models. It usually keeps it for no more than 30 days, unless the law or protection against abuse requires a longer period. OpenAI also sees the IP address the request comes from.
• We don’t keep audio or video recordings. The video stays on your page and disappears when you close it. No employer or recruiter can see it, not even in the business packages.
• Camera analysis describes things you can see, such as your gaze, posture and gestures. Voice analysis describes your pace, pauses and volume. Neither infers emotions, identifies you or provides a psychological assessment.
• Camera analysis starts only with your separate consent. You give it before each practice session or recorded video interview, and withdraw it by turning off your camera or leaving the page. You can still use voice practice sessions and tests without it.
• Voice analysis is part of the practice session, and we tell you about it in advance. Measurements from your image and voice are deleted within 24 hours.
• Anything you delete is permanently deleted, subject to the exceptions in section 11. It can’t be recovered by you or by us.
• We don’t use your data to train AI models.
• You can download your account data and delete your account at any time from your account page. You don’t have to tell us why. For any other request, just write to us.

1. Who we are

Recrutora is a complete recruitment platform where employers, managers, and teams can manage their entire real-world hiring process. Candidates can also practise for real interviews with AI interview simulations (“Recrutora” or “we”).

We decide why and how your data is processed, which makes us the data controller under the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”). The exceptions are data you submit when applying for a job, where the employer is the controller and we process the data on their behalf (section 9), and data about your work that your company receives (section 8).

We haven’t appointed a data protection officer. If you have any questions about your data, you can email us at contact@recrutora.com.

2. Who this policy applies to

This policy applies to everyone who uses Recrutora: employers, managers, and teams that manage recruitment through Recrutora; people they invite to interview with the team; candidates who apply for their jobs; candidates who practise with interview simulations; and website visitors.

Practice and real-world hiring are separate. Your practice reports and scores never reach an employer, even if you apply for a job through Recrutora. This policy doesn’t cover how an employer uses your data outside the platform, for example in their own systems.

3. What data we collect

Data you give us

• Account: your name, email address, password (stored in an irreversibly encrypted form), the country you choose and your language.
• Profile: your field, level, target role and the date of your real interview. CV: we ask for it before your first practice session because the interview is based on it. Job post, if you choose to provide one. For employers: job post details, including the employer’s legal name and an email address for data requests, which candidates can see.
• Your CV (in candidate accounts): Your browser reads the file (PDF or Word) on your device, and it never reaches us. We only receive and keep the text. Before storing it, we try to automatically remove contact details and other personal information unrelated to work. This removal uses simple rules and may miss something. That’s why you can see exactly what text is stored on the CV page, edit it before saving, and delete it at any time. Candidate accounts provide a CV at the start because all practice interviews are based on it. You can also save the job ad you’re interested in, if you want. We use these only so the AI recruiter can ask you questions about them in your practice sessions and recorded video interview, and so your report can tell you what you highlighted. To do this, we send them to OpenAI only during the session and when generating the report. No other user, including Team administrators, can see your CV or job ad.
• Practice sessions and tests: your answers, notes, test results, reports and scores. We use the conversation text only until the report is generated.
• Your preparation plan: the role or field, level, interview date, steps you’ve checked off and answers you write for the exercises. Your written answers are for your eyes only: we don’t send them to anyone, including AI services, and they’re deleted when you delete the plan or account.
• Your tailored CV and prep sheet: When you request them, we send the text of your CV, your saved job ad and, for the prep sheet, the stronger answers from your reports to OpenAI to create them. We show you the result on the page and don’t store it.
• Voice and image: your voice during practice sessions and, during video interviews, your image. We don’t keep them (section 5).
• Payments: your chosen plan, the amount paid, your subscription status, paid periods, your Stripe customer ID, and when you asked to start immediately. You provide your card and billing details directly to Stripe and Link on the checkout page. We can’t see or store them.
• Communications: messages you send us. If you have a paid subscription, this also includes messages sent through the ticket form on the Contact page: the subject and message, along with your name, email address, account code and package.
• How you heard about us: Whatever you choose during sign-up, if you choose anything. This is optional and helps us understand what’s working. We keep it for as long as you have an account (our legitimate interest).
• Your feedback: Anything you choose to tell us after cancelling or withdrawing, when you close a Team, or at the end of a pilot. This is optional. We keep it with your account so we can respond to you and improve Recrutora.
• Records: which version of the Terms you accepted and which version of the Policy you read, the language, date and time, the boxes you checked before paying, the camera consent box for each use and, for companies, acceptance of the data processing agreement.

Data generated when you use the platform

• Image and voice measurements, calculated temporarily for video analysis. We explain these in detail in section 5.
• Technical data: simulation times, an IP address fingerprint used only in abuse-prevention counters, and cookies (section 14). We don’t collect device or browser data, and we don’t keep IP address logs. We count visits to public pages only as daily totals: the page, the site the visitor came from, the campaign name in the link, if any, the next page, the country, and the language. This counting doesn’t use cookies or retain any information about an individual. As with any website, the services in section 7 can see your IP address while they deliver pages or handle the call.

Data we don’t ask for

We don’t need information about your health, religion, ethnicity, sexual orientation, political opinions, family situation, or other sensitive data. Please don’t include it in your CV or answers. If it does come up, we use it only to generate the feedback you requested and don’t analyze it separately.

4. Why we use your data and our legal basis

When we rely on legitimate interests, you can object at any time. When we rely on your consent, you can withdraw it at any time, just as easily as you gave it. Withdrawal won’t affect any processing carried out beforehand.

For data from job applications, you can find the legal basis in section 9.

We don’t use your data for personalized advertising, sell it, or “share” it as defined by California state laws.

5. Video analysis and biometric data

This section is especially important, so we explain it in detail.

What the analysis does

During a recorded video interview or a simulation with the camera on, your browser analyses the image to describe behaviours anyone could observe: gaze direction, posture, gestures and visible expressions (such as smiling). To do this, it temporarily calculates facial and body landmarks. During voice simulations, your browser measures your speaking pace, pauses and voice volume.

Recorded video interview

For recorded video interviews, your browser analyzes the camera footage on your device using a program that runs there (MediaPipe, served from recrutora.com). The recording isn’t sent to us or anyone else: it stays in the open page so you can watch it again or download it, and disappears when you close the page. Only a few figures for each answer are sent to recrutora.com: how much of the time you looked toward the camera, how much your head moved, how upright you sat, how much you gestured, how much you smiled, how you were framed, and how bright the image was. The audio for each answer is sent once to OpenAI, which turns it into text. We don’t store the audio, and we delete the text as soon as the report is generated (any unfinished answer is deleted within two days at most). We keep only the report, including its observations and scores.

Camera-on practice sessions

You can also turn on your camera during simulations by checking the box before each one. Your browser analyzes the camera footage on your device using the same program (MediaPipe, served from recrutora.com). We don’t record anything, and the footage isn’t sent to us, OpenAI, or anyone else: the AI recruiter receives only the audio. Only a few figures for each minute of the interview are sent to recrutora.com, the same ones as for recorded video interviews. We don’t store these figures; only the observations in the report remain.

Voice analysis in voice practice sessions

During a voice simulation, your browser measures voice volume and intonation on your device. Only a few figures for each answer are sent to recrutora.com (how long it lasted, how many pauses it had, and how much the volume dropped or the pitch rose at the end), not the audio. We use these figures and the text of your answers to calculate your pace, pauses, filler words and “Voice firmness”. This shows whether your tone falls or rises at the end, not how you feel. We don’t keep the figures; only the observations in the report remain. Voice analysis is part of the service: it is based on the contract, not a consent checkbox, and we tell you about it before the simulation. It does not infer emotions.

What the analysis doesn’t do

• It doesn’t infer emotions, mental states, or personality traits.
• It doesn’t identify or recognize you by your face or voice, or create a permanent biometric profile.
• It doesn’t diagnose anything and isn’t a psychological assessment.
• It doesn’t make decisions about you and isn’t used in real hiring.

Your consent

Camera analysis starts only after you give explicit consent, separately from accepting the Terms, by ticking the dedicated box before each practice session or recorded video interview. The checkbox applies only to camera analysis. Your answers’ audio is not covered by it: it is sent to OpenAI to make the interview work, and we explain this on the page. If you don’t tick the box, the practice session will use voice only, and the recorded video interview won’t start, because image analysis is its purpose. Without giving consent, you can still use voice practice sessions and tests.

You can withdraw your consent by turning off the camera or leaving the page. You can delete the body language section from a report. We keep proof of your consent, as explained in section 11.

If you live in a country or state with special rules for biometric data (for example, Illinois, Texas or Washington in the US), checking this box is your written consent, and we’ll send you a copy on request.

How long we keep it

• Image and voice measurements are automatically deleted within 24 hours of the report being generated. Only the scores and observations in the report remain.
• We don’t keep audio or video recordings. The footage stays on your page and disappears when you close it.

Who can access it

Only you and the technical services needed for the analysis to work, which process data strictly on our instructions (section 7). Your employer cannot access reports or measurements, including under company plans.

We don’t sell, rent, or otherwise profit from this data.

6. Artificial intelligence

• The recruiters in simulations are generated by artificial intelligence. We always make it clear when you’re speaking with an AI. In real-world hiring, everyone is a real person. AI helps the employer write job posts and, with the candidate’s consent, turns video interviews into text to provide feedback to the person who conducted the interview.
• Feedback, scores, and suggestions are generated automatically and may contain errors. They’re intended as guidance for practice.
• We don’t make automated decisions that have legal effects on you or similarly affect you (Article 22 GDPR). Practice results aren’t shared with employers.
• In real hiring, AI doesn’t read CVs to assess them, read candidates’ test answers or score, rank or reject anyone. The employer can sort the CV list by their own keywords using a simple rule, without AI. A person makes all decisions about candidates (section 9).
• We don’t use your answers or CV to train AI models. The technical services we use are not allowed to use your data to train their own models.

7. Who else can access your data

We don’t sell your data or share it with other companies for them to use for their own purposes, such as advertising.

Your data may be shared with others only in these situations:

• Technical services essential to the platform: data hosting, speech-to-text, question generation, payment processing and email delivery. They process data only on our instructions, under a contract (data processing agreement), and may not use it for any other purpose. These services are:
  • Cloudflare (Cloudflare, Inc.): website hosting and the account database. The database is stored in the European Union. Cloudflare also relays video and audio between employers and candidates during video interviews (using Cloudflare Realtime), only for the duration of the interview and without recording it.
  • Brevo (France): sends emails about your account and payments, confirmations, invitations, tests, and messages to candidates and colleagues, as well as tips, updates, and offers, but only with your consent. Messages sent through “Get help” and the ticket form on the Contact page also reach us via Brevo at contact@recrutora.com, and you receive a confirmation. Emails other than tips and updates have a designed layout, so Brevo adds an open-tracking counter to them. It isn’t linked to you, and we can’t see who opened an email or what they clicked. Tips and updates are plain text and don’t have a counter.
  • Namecheap (Namecheap, Inc., USA): hosts the contact@recrutora.com mailbox. Messages and requests for help that you send us arrive there, including everything you write in them.
  • OpenAI (OpenAI Ireland Ltd, Ireland, together with OpenAI, L.L.C., USA): provides the AI voice and converts your voice to text during simulations, then writes feedback based on the text of the conversation. It receives the simulation’s audio and text, the job you selected (the job posting, if you add one, and the round you selected), and the text of your CV (excluding data extracted automatically; see section 3), but not your account name or email address. During simulations, your browser connects directly to OpenAI, so OpenAI also sees the IP address the call is made from. It also receives a code generated from your account that doesn’t reveal who you are, so it can identify abuse. OpenAI usually keeps this data for no more than 30 days, unless the law or abuse prevention requires it to be kept longer. We don’t keep the job posting on recrutora.com. We don’t keep the text of the conversation on recrutora.com, only the feedback report. For a recorded video interview, OpenAI receives the job, level and text of your CV to write the questions, then the audio of each answer to convert it to text, and, for the report, the text of your answers and CV, along with figures measured by your browser, without your name, email address or image. OpenAI also writes questions for practice tests and descriptions of profiles in work-style tests. For this, it receives only the test type, level and job you selected; for the profile, it receives the scores for each dimension, without your name, email address or other information about you. If you view AI-generated text in another language, OpenAI translates it, and we keep the translated copy alongside the original. OpenAI also writes the preparation plan: it receives the job or field, level, interview date, job posting if you add one, and the scores and notes from your simulations, without your name, email address or conversation text. In Employer accounts, OpenAI writes job postings, reviews job postings, suggests words for requirements, writes test questions and creates interview guides. It receives only the job text (title, level, requirements and the employer’s answers), never CVs or candidates’ answers. For a video interview, only if the candidate has chosen this option, what is said is converted to text by OpenAI, which then uses the text to write feedback for the person who conducted the interview. We delete the text afterwards. Also in Employer accounts, the AI assistant in “Get help” sends your question and the latest messages in your conversation with it to OpenAI, which uses them to write an answer based on the platform guide. Email addresses and phone numbers in your question are automatically removed. The rest is sent to OpenAI as you wrote it, so don’t include information about candidates. We don’t keep conversations with the assistant on the platform. When you contact our team, your request is sent by email and we keep it on the platform so we can resolve it. Your conversation with the assistant is included only if you tick the relevant box. If you use Recrutora in a language other than Romanian, OpenAI, our AI provider, automatically translates the emails we send you into your language. Email addresses, links and phone numbers are not sent to OpenAI, and the translated text is not stored.
  We update the list whenever we add or change a service.
• Stripe and Link (Sold through Link, LLC and the other companies in the Stripe group): Subscriptions are sold through Stripe Managed Payments. Payment is collected by Sold through Link, LLC, the merchant of record, which sends you the invoice and handles taxes. We remain responsible for providing the service to you. You enter your payment and billing details directly with them on the checkout page, which opens only when you choose a subscription. They use this information as an independent controller, in accordance with their privacy policy. We share your account email address, an internal account ID, the package you selected and when you asked to start immediately. We store only your plan, subscription status and paid periods.
• Your company, only if you use Recrutora through a team on the Team plan, and only within the limits set out in section 8.
• The employer you’re applying to (or the agency recruiting on its behalf), and only for your application (section 9). During a team interview, the employer can see and hear you for the duration of the interview, along with up to 3 people the employer has invited.
• Authorities, only when required by law and only to the extent strictly necessary.
• A potential buyer, if Recrutora is sold or merges with another company. We’ll let you know beforehand, and your data will remain at least as well protected as it is now.

8. Team accounts

If you hire through Recrutora as part of a team on the Team plan, paid for by your company:

• Team administrators can see your name, email and role, your jobs and their figures (how many candidates are at each stage, how many interviews and how many hires), how many video interviews you’ve held this month, the date of the last activity on a candidate’s application, and each person’s monthly report. They also receive the report by email on the 1st of the month.
• In larger teams split into groups, your group lead can see the same information about people and jobs in your group as administrators can.
• Only you can see candidates, CVs, ratings and notes for your jobs. Your colleagues can only see that a candidate has also applied for one of their jobs, which job it is, and that you’re handling the candidate.
• Jobs published by a team belong to the company. You can hand a job over to a colleague, and an administrator can do this for you. When you leave the team, are removed from it or delete your account, your team jobs, along with their candidates, are transferred to the colleague chosen by an administrator or to the person paying for the subscription.
• Job templates you save for the company carry your name so the team knows who created them.
• When an administrator invites you, your email address stays in the invitation for up to 37 days so the team can see whether it has been accepted.

For information about your work that it receives (your jobs, their figures and the monthly report), your company becomes the controller and is responsible for how it uses that information. We remain the controller of your account data.

9. Applying for a job through Recrutora

Some employers post jobs and receive applications through Recrutora. If you apply for one of these jobs, here’s what happens to your data.

Who is responsible for your data

The data controller for your application is the company that posted the job or the agency, as stated on the application page, along with its legal name and an email address for data-related requests. Below, we refer to it as the “employer”. We process your data only on its behalf, as a processor (Article 28 GDPR), to support applications, tests, interviews, and messages. We do not use it for any other purpose or share it with other employers.

The same applies when you apply through a company’s careers page on recrutora.com. The page doesn’t use cookies.

Legal basis for using your data

The employer uses your data to assess your application at your request, before any potential employment (Article 6(1)(b) GDPR), and on the basis of its legitimate interest in choosing the right people for the job (Article 6(1)(f)). The checkbox on the application page only confirms that you have read how your data is used. It is not consent. The employer will tell you if it uses your data in other ways.

What the employer receives

• Your name, email address and phone number, if you provide it.
• The text of your CV. Your browser reads the file on your device, and it never reaches us. We try to automatically remove contact details and other information unrelated to work from the text. This removal uses simple rules and may miss something. That’s why you can review and edit the text before submitting it.
• Your answers to the questions for the job.
• Where you came across the job (for example, LinkedIn, a job site or a referral), if the application link tells us. We read this from the link, without cookies, so the employer can see where their job ads are reaching people.
• If an employer sends you a test: your answers and score. The test has fixed answers that are checked by the software. If you leave the test before finishing, it ends with the answers you have given, and the employer can see that it was interrupted. If the employer sends it to you a second time because of a technical issue, they can also see your first attempt. After the test, you receive a short conclusion by email, made up of two sentences selected by the software, which we keep with your application. Only the employer can see the full result, along with the average score of people who took the same test. You can request it at any time.
• If an employer sends you the “Work Style” questionnaire: your answers and how they add up across different themes, with fixed text selected by the software. There are no right answers, it isn’t scored, and it isn’t a psychological assessment. AI generates the statements based on the job post, but doesn’t read your answers. After the questionnaire, you’ll receive a short, two-sentence summary by email, selected by the software. Only the employer can see the full results, but you can request them at any time.
• The interview scheduling details and, after the interview, the employer’s ratings and notes. If it was a team interview, this also includes ratings against the job requirements from the people invited.
• Messages an employer sends you through Recrutora are sent by email and stay with your application so the employer can read them again, until your application data is deleted.

The employer doesn’t receive anything from your Recrutora account, if you have one—not your practice interviews, reports or practice tests.

Who can see your application

Only the employer that published the job. If a recruitment agency published the job for a client, the agency’s recruiter will see your application; the application page always tells you which company you’re applying to and who is recruiting for it. The person handling the job can send a shortlist to the person making the hiring decision: your future manager or, if an agency is recruiting, the client company. That person can view your name and CV, without your contact details, through a link valid for up to 7 days, and decide whether you move forward. They can’t see ratings, tests or messages. Their decision stays with the job and is deleted along with your application. If the agency shares your data with the client in another way, outside the platform, the agency is responsible for that. We don’t review applications unless you ask us for help or we’re required to by law.

If the company hires through a team (the Team package), your application is visible to the person on the company’s team responsible for the job. If they hand the job over to a colleague, for example while they’re on leave, the colleague can see your application from then on. If you apply for several jobs at the same company, each person responsible for one of those jobs can see that you’ve applied for the others, which jobs they are and who is responsible for them—but not the CV, ratings or notes for those applications. This helps prevent two people at the same company from contacting you without knowing about each other.

The employer can hold one team interview with each candidate, inviting up to 3 people from the company you’d be working at, such as your future manager or colleagues. Your interview invitation tells you who they’ll be. They can join only that interview, using a link sent by email, and can’t see your application, CV, ratings or notes.

The recruiter’s candidate database

For jobs posted using the Recruiter or Team package, the application page has a separate, unticked box that lets you ask the company to keep your CV for 12 months and notify you about other suitable jobs. You can apply without ticking it. Only if you tick it will the recruiter (the agency or company that posted the job) keep your name, email address, CV text, the job you applied for and how far you progressed in its own database for 12 months from the date you ticked the box. The legal basis is your consent (Article 6(1)(a) GDPR).

The recruiter can read your CV and email you about their open jobs; you decide whether to apply. With the Team package, the database belongs to the company and is used by its recruitment team for the company’s jobs. No client of the recruiter or anyone else can see the database. You can opt out at any time with one click using the link in every email; if you withdraw your application, you’re also removed from the database. After 12 months, the data in the database is automatically deleted. If you check the box again when applying for a new job, a new 12-month period begins.

If a company invites you to apply

If you’ve sent a company your CV or expressed interest in a job, the company can send you an application link through Recrutora. We receive your email address and, if the company enters it, your name, solely to send that email; we don’t store them on the platform. We keep only a code for up to 8 days to make sure you don’t receive the same invitation twice. The company is responsible for having permission to contact you, and you only apply if you want to.

If you’re invited to a team interview

The employer gives us your name and email address only so we can send you the interview time and link; you do not need an account. Your image and audio are shared with the others only for the duration of the interview, through Cloudflare Realtime, without being recorded. Your email address and the link are deleted after the interview; your name remains in the data for that interview until the application is deleted.

What you say in the interview is transcribed by OpenAI in the US solely to provide feedback to the person who conducted the interview, and the text is deleted afterwards. The same applies to the interviewer. You’ll both be informed before the interview. The legal basis for both of you is legitimate interest, with this notice (Article 6(1)(f) GDPR): the employer’s interest in providing feedback. You can object by contacting the employer or us.

If the company hires using the Team package, you can use the same link to rate the candidate against the job requirements (from 1 to 4) and add a few words about them, from the interview time until 3 days after the interview. You can do this for in-person interviews too. Only the person responsible for the job can see your feedback—not the other people invited or the candidate. For these interviews, your email address and the link are deleted 3 days after the interview, while your ratings are kept for as long as the candidate’s application is kept.

What AI does—and doesn’t do

• AI doesn’t read your CV to assess it, read your test answers or score, rank or reject you.
• Employers see CVs with the keywords they selected first, ranked by how important each requirement is, such as a software tool or a profession. This is a simple rule, with no AI involved. It doesn’t remove anyone from the list, but it may affect whose CV the employer reads first. Keywords relating to personal life can’t be used.
• Your answers to Yes or No questions are shown to the employer alongside the job requirements. They don’t automatically reject anyone.
• The employer makes a decision about each person individually. No one is rejected as a group. A person makes the decision.

Video interviews

• The interview takes place in your browser. Neither video nor audio is recorded. They’re shared with the other participants live, only for the duration of the interview, through Cloudflare Realtime.
• Before you begin, you confirm that you’ve read how the interview works. This is a confirmation, not consent. The legal basis is the one described above: assessing your application at your request and the employer’s legitimate interest. If you don’t want to appear on camera, tell the employer; they can offer an in-person or phone interview instead.
• The video interview is transcribed. Before joining, you tick a separate box to consent to this, in addition to the confirmation above. What the person conducting the interview says is always sent to OpenAI in the USA for transcription; what you and invited colleagues say is sent there only with your consent. The transcript is then deleted.
• If you don’t agree: you won’t be able to join the video interview, but your application won’t be affected. Select “Request a different type of interview”, and the employer may offer you an in-person or phone interview without transcription. The employer will be told that you made this request so they can offer an alternative.
• Feedback for the interviewer: we use the transcript to provide feedback on how they conducted the conversation: what they asked, how they listened and what they could do better. The feedback does not show what you answered. Only they can see it, and it is deleted when your application is deleted. It does not rate you, compare you with others or say whether you are a good fit. The legal basis is your consent (Art. 6(1)(a) GDPR), and the employer is the data controller.
• Thank-you email: after the interview, you receive a standard thank-you email written without AI.
• You can withdraw your consent at any time before the interview ends, including from the interview room, by selecting “Stop transcription”. Anything you said up to that point will be deleted, the interview will continue, and feedback will be based only on what the interviewer said. We’ll keep only a record of your choice, as described in Section 11.

Employer systems

If an employer connects its own system, such as a CRM, your name, contact details, job, stage, interview dates and, if requested, your CV are also sent there. The employer is responsible for this data as the controller and you can contact them directly with any questions about your data.

How long we keep your data

Your application data is automatically deleted after the number of days the employer chooses once they close the job (30, 90 or 180), and in any case no later than 365 days after you apply. The application page shows the retention period for the job you’re applying for.

Your rights

You can withdraw your application at any time using the link in the confirmation email. Your data will then be deleted. To exercise your other rights (access, rectification, erasure, restriction, objection and portability), you can contact the employer at the email address on the application page, or contact us at contact@recrutora.com. If you write to us, we’ll forward your request to the employer and help them respond. For advice emails, contact us directly.

Tips and updates from Recrutora

The application page also has an unticked box for tips, news and offers from Recrutora. This is separate from your application: we are the data controller for this, and the employer won’t know what you choose (section 4).

10. Transfers outside the European Economic Area

The account database is hosted in the European Union. Some services listed in section 7 are provided by US companies (Cloudflare, OpenAI and Namecheap), and OpenAI also processes the voice from practice interviews outside the European Economic Area. Video and audio from video interviews between employers and candidates pass through Cloudflare’s network, usually at a location near the participants, and aren’t recorded. Stripe and Link may transfer payment data outside the European Economic Area, including to the US and India, subject to the safeguards in their privacy policies, such as the Standard Contractual Clauses and the EU-US Data Privacy Framework.

If technical services used by the platform process some data outside the European Economic Area, we rely on European Commission adequacy decisions (including the EU–U.S. Data Privacy Framework, where applicable) or standard contractual clauses approved by the Commission, together with additional safeguards. You can request a copy of these safeguards at any time.

11. How long we keep your data

Deletion is permanent

When you delete your preparation plan, CV or entire account, the data is permanently deleted and can’t be recovered by you or by us. The exceptions are listed in the table above: hashes used to prevent abuse, proof of consent and contract, and backups, which are kept until the periods shown there. Reviews remain anonymous, and invoices are retained by Stripe and Link.

12. Your rights

Wherever you live, you have at least the following rights:

• Access: find out what data we hold about you and receive a copy.
• Rectification: correct inaccurate or incomplete data.
• Erasure: ask us to delete your data.
• Restriction: ask us to temporarily stop processing your data.
• Data portability: receive your data in a format you can use elsewhere.
• Objection: object to processing based on our legitimate interests.
• Withdraw your consent, at any time, for anything you’ve separately agreed to.
• Not to be subject to a decision based solely on automated processing that significantly affects you. Recrutora does not make such decisions.
• File a complaint with a supervisory authority: in Romania, with the National Supervisory Authority for Personal Data Processing (dataprotection.ro), or with the authority in the country where you live.

If you live in California

You have the right to know what data we collect, correct it, delete it, and opt out of its sale or “sharing.” We don’t sell or share data in this sense. We use sensitive data only to provide the service you’ve requested. We won’t treat you differently for exercising these rights.

If you live in another country

We also respect the rights you have under the laws of your country, for example in the United Kingdom, Switzerland, Canada, Brazil or other US states. Most of these rights are already covered by the rights listed above.

How to exercise your rights

You can exercise most of your rights directly from your account page, where you can download your account data and delete your account. For a complete copy or any other request, email us at contact@recrutora.com. We’ll respond free of charge within 30 days at most. In complex cases, we may extend the deadline by up to two months. We may refuse requests that are clearly unfounded or excessive. We may ask you to verify your identity to make sure we don’t give your data to someone else.

13. Children

Recrutora accounts are for people aged 18 or over. We don’t knowingly create accounts for minors. If we learn that an account belongs to a minor, we’ll close it and delete the data.

You can apply for a job without an account. If you’re 16 or 17 and the law allows you to work, you can apply, and the employer is responsible for your application. Recrutora’s terms don’t impose any obligations on you when you apply.

14. Cookies and similar technologies

• Strictly necessary: for authentication and security. These can’t be disabled because the platform won’t work without them.
• Analytics: we don’t use any.
• Advertising: we don’t use any.

We use only technical cookies: one that keeps you logged in (__Host-recrutora, valid for 30 days or until you log out) and, while the website is closed, the access cookie (__Host-recrutora-acces, valid for 30 days). The platform administrator’s account has a separate cookie (__Host-recrutora-admin). Some pages store temporary data in your browser only until you close the tab. That’s why we don’t ask for your consent to use cookies. The email open counter is described under Brevo, in the section about who receives your data. The Stripe payment page, which opens only when you choose a subscription, may use its own cookies that are strictly necessary for payment and fraud prevention. If we ever add analytics cookies, we’ll use them only after you accept them, with equally visible “Accept” and “Reject” buttons, and we’ll respect the “Global Privacy Control” signal sent by your browser.

15. How we protect your data

• We encrypt your data both while it’s being sent over the internet and while it’s stored.
• Access to data is limited to what’s strictly necessary. The administrator account is accessed using a code sent by email.
• We test the platform before every change we publish on the site.
• If a personal data breach occurs, we’ll notify the authority within 72 hours when required by law. We’ll also notify you without delay if there’s a high risk to your rights.

16. Changes to this policy

If we make an important change to this policy, we’ll notify you by email and in your account at least 30 days in advance. If a change requires your consent, we’ll ask you for it again. We’ll email you previous versions on request.

17. Contact

Recrutora is operated by Ioana Becheru Persoană Fizică Autorizată (authorized natural person), with its registered office at 136 Bucureștii Noi Blvd., ground floor, apt. 5, District 1, Bucharest, Romania, registered with the Trade Register under no. F40/4049/2022, tax ID 46759727.

• Email: contact@recrutora.com