Privacy Policy

RecrutFlo is operated by an individual entrepreneur (self-employed sole trader) registered in the Slovak Republic, trading as "RecrutFlo".

For most candidate data processed through a customer's workspace, RecrutFlo acts as a processor and the customer is the controller - see "Purpose and lawful use" below. For questions about this policy, or to exercise a data protection right described below, contact privacy@recrutflo.com (or support@recrutflo.com for general support).

RecrutFlo may process account data, tenant and user settings, session data, mailbox configuration, email metadata, email content relevant to candidate intake, CV attachments, extracted candidate fields, review notes, processing logs, audit events and export metadata.

Candidate data may include name, email address, phone number, location, professional summary, employment history, education, skills, languages, role context, source mailbox and other information contained in a CV or candidate email.

RecrutFlo does not collect, transmit, access or store payment card numbers, card security codes, bank account credentials or payment authentication data at any point, for customers or candidates. Paid subscription payment data is entered directly into Stripe's own systems and never passes through RecrutFlo.

RecrutFlo processes data only for the purpose of providing the service: mailbox intake, CV detection, structured extraction, candidate organization, duplicate handling, search, review, export, audit, security, billing administration and support.

The customer decides which mailboxes are connected and which candidate data is processed. The customer is normally the controller of candidate data and is responsible for having a lawful basis to process it. RecrutFlo acts as a processor when it hosts and processes candidate data on the customer's behalf, except where it processes limited data for its own legal, security, billing or service administration purposes as an independent controller.

When a customer explicitly connects a supported mailbox, RecrutFlo requests only the OAuth permissions needed to provide mailbox intake and candidate-organization features. RecrutFlo uses authorized mailbox data only to identify candidate emails, read relevant message content and metadata, retrieve CV attachments, and create or update candidate records and related processing history in the customer's workspace.

For Gmail, RecrutFlo requests read-only access through Google OAuth. RecrutFlo's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

For Microsoft 365 and Outlook, RecrutFlo uses Microsoft OAuth and Microsoft Graph with Mail.Read and offline_access permissions. Mail.Read permits read-only access to messages and attachments; offline_access permits RecrutFlo to maintain the connection until the customer or their organization revokes it.

RecrutFlo does not use Google or Microsoft mailbox access to send, modify or delete messages. Mailbox data is not used for advertising, profiling unrelated to recruitment administration, or sale to third parties. Access is limited to the user-facing features described in this policy.

OAuth credentials are encrypted at rest. A customer can stop future mailbox access by removing the connected mailbox in RecrutFlo or revoking RecrutFlo's permissions from their Google Account, Microsoft account, or Microsoft 365 organization. Data already imported into a workspace remains subject to the retention, deletion and rights provisions below.

Automated extraction may produce incomplete, outdated or inaccurate results because CVs and emails vary in format, language, quality and context. RecrutFlo does not guarantee the validity, completeness or current accuracy of extracted data, and disclaims liability for decisions made in reliance on it.

Separately, RecrutFlo has no means of independently verifying the truthfulness of information a candidate chooses to submit in a CV or email - identity, qualifications, employment history and similar claims are third-party content outside RecrutFlo's control. RecrutFlo accepts no responsibility for false, misleading or fraudulent candidate-submitted information.

Recruiters and customer administrators must review candidate records before using them. The service is intended to organize information, not to validate credentials, verify employment history, assess suitability, rank candidates or make hiring decisions. No output of the service is used to make a decision producing legal or similarly significant effects about a candidate without human review.

RecrutFlo shares data only with service providers strictly needed to operate the product. As of the date above, these are: Hostinger (hosting, database and transactional email delivery), OpenAI (AI-assisted CV field extraction), and Stripe (subscription billing and payment processing). This list is updated as providers change.

Each subprocessor is contractually or by its own terms restricted to processing data only as needed to provide its service to RecrutFlo, and only for the purposes described in this policy.

Where a subprocessor is located outside the EEA or UK, or processes data outside the EEA or UK, RecrutFlo relies on an adequacy decision, Standard Contractual Clauses, or another valid transfer mechanism recognized under GDPR or UK GDPR for that transfer.

Customer workspaces should retain candidate data only for as long as needed for the recruitment administration purpose or as required by law. Customers are responsible for defining their own recruitment retention rules and deleting or exporting records when appropriate. RecrutFlo does not currently run automatic time-based deletion of workspace data; a deletion request will be actioned within a reasonable period, subject to data RecrutFlo is legally required to retain (e.g. billing records).

Individuals may have rights to access, rectify, erase, restrict, object to processing, data portability and to lodge a complaint with a supervisory authority. Requests relating to candidate records should normally be directed first to the customer that controls the recruitment mailbox, since the customer is typically the controller; RecrutFlo will assist customers with such requests where technically possible. Requests directed to RecrutFlo can be sent to privacy@recrutflo.com.

RecrutFlo is designed with GDPR principles in mind: lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability. As a Slovak-registered business, RecrutFlo's lead supervisory authority is the Slovak Office for Personal Data Protection (Úrad na ochranu osobných údajov Slovenskej republiky), without prejudice to a data subject's right to lodge a complaint with the supervisory authority of their own EU member state of residence.

For UK processing, equivalent UK GDPR and Data Protection Act 2018 obligations may apply. UK-specific controller notices, transfer wording and regulatory references should be reviewed before UK-focused launch materials are finalized.

RecrutFlo has not appointed a Data Protection Officer. Based on the nature and current scale of processing, RecrutFlo does not consider itself subject to a mandatory DPO requirement under GDPR Article 37, and will reassess this as the business and its processing activities grow. This does not affect a customer's own, independent assessment of whether it requires a DPO as controller of the candidate data it processes.