Data Processing Overview

RecrutFlo processes CV inbox data to transform unstructured candidate emails and attachments into organized, searchable records for recruitment administration.

Processing is limited to mailbox intake, CV detection, structured extraction, candidate organization, duplicate handling, review, search, export, audit, security, billing administration and support.

Customers are expected to act as controllers for candidate data they choose to process through RecrutFlo. Customers decide which mailboxes are connected, which data is imported, how long records are retained, who has access, and how exports are used. Customers are solely responsible for having a lawful basis for that processing.

RecrutFlo acts as a processor when it processes candidate data on the customer's behalf, strictly on the customer's documented instructions. RecrutFlo may act as an independent controller for limited data needed for its own account administration, security, billing, compliance, service analytics and legal obligations.

Candidate data may include identity and contact data, CV content, employment and education history, professional skills, language information, location, role context, email metadata and customer review notes.

RecrutFlo does not verify the authenticity of CVs, validate employment history, confirm qualifications, perform background checks, determine legal work eligibility, or guarantee that extracted data is accurate or that information a candidate submitted is truthful. CVs and candidate emails are third-party content outside RecrutFlo's control, and RecrutFlo disclaims responsibility for their accuracy. The service organizes data for review by authorized users; it does not validate it.

As of the date above, RecrutFlo's subprocessors are: Hostinger (hosting, database and transactional email delivery), OpenAI (AI-assisted CV field extraction), and Stripe (subscription billing and payment processing). This list is updated as providers change; see the Privacy Policy for the current version.

Stripe is used for all payment processing. RecrutFlo does not collect, transmit, access or store card numbers, card security codes, bank account credentials or payment authentication data at any point - these are entered directly into Stripe's own systems. Issues specific to payment method authentication, bank declines, payment disputes and Stripe-hosted payment processing are between the customer, Stripe and the customer's bank or card issuer.

The service includes tenant isolation, authenticated sessions, role-aware access controls, audit events, controlled export paths and operational safeguards. Customers remain responsible for their own user access reviews and for the secure handling of data once exported from RecrutFlo.

Where security, legal, operational, provider or payment conditions require it, RecrutFlo may restrict, suspend or stop processing for a workspace or service area to protect candidates, customers, the platform or legal compliance, and accepts no liability for the consequences of doing so where reasonably necessary.

The processing model is intended to support GDPR principles including purpose limitation, data minimisation, accuracy review, storage limitation, integrity, confidentiality and accountability. RecrutFlo's lead supervisory authority, as a Slovak-registered business, is the Slovak Office for Personal Data Protection (Úrad na ochranu osobných údajov Slovenskej republiky).

For UK customers, a UK GDPR and Data Protection Act 2018 addendum may be needed, including UK transfer wording and UK supervisory authority references.

Questions about this data processing overview, or requests relating to it, can be sent to privacy@recrutflo.com. See the Privacy Policy for the current Data Protection Officer position.