Privacy Policy

1. Introduction

"Arcruit" SIA ("Arcruit," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our AI-powered recruitment automation platform at arcruit.com (the "Services").

We are established in Latvia (registration number 40203656930) with our registered office at Gaiļezera iela 15–6, Rīga, LV-1079, Latvia. For GDPR purposes, we act as:

• Data Controller for account registration, website usage, and our direct communications with you.
• Data Processor for recruitment data (resumes, candidate information, assessments) that you upload and manage through the Services.

2. Information We Collect

2.1 Account & Company Data

When you register and use our Services:

• Account information: Name, email, password, profile picture
• Company details: Company name, industry, size, culture, values, logo, social links
• Team data: Information about invited team members and their roles
• Integration credentials: API keys for BambooHR and other integrations (encrypted)

2.2 Recruitment Data

Data you upload or create for recruitment purposes:

• Candidate information: Resumes, CVs, contact details, work history, education, skills
• Position data: Job descriptions, requirements, interview questions
• Assessment data: AI-generated match scores, personality insights, screening results
• Communications: Notes, comments, and correspondence about candidates

2.3 Usage & Technical Data

• Usage logs: Features used, actions taken, API usage statistics
• Device data: IP address, browser type, operating system
• Cookies: Session cookies and authentication tokens

2.4 Public Application Data

When candidates apply through public job links:

• Application details and uploaded resumes
• Email verification data
• CAPTCHA verification results

3. How We Use Your Information

3.1 Service Provision

• Process and analyze resumes using AI technology
• Generate candidate match scores and personality assessments
• Enable team collaboration on recruitment activities
• Integrate with third-party ATS systems like BambooHR
• Send notifications about candidate applications

3.2 AI Processing

We use AI models from OpenAI (ChatGPT) and Anthropic (Claude) to:

• Parse and extract information from resumes
• Generate compatibility scores and assessments
• Create interview questions and job descriptions
• Analyze candidate responses

Important: We configure these AI providers so your data is not used to train their models. We do not use your data to train any generalized AI models.

3.3 Legal Bases (GDPR)

We process personal data based on:

• Contract: To provide the Services you've requested
• Legitimate interests: For security, fraud prevention, and service improvements
• Legal obligations: To comply with applicable laws
• Consent: Where specifically requested (e.g., marketing communications)

4. Information Sharing

We share your information only:

• With your team: Other users in your company account as per assigned roles
• Service providers: AWS for hosting, AI providers for processing (under strict data protection agreements)
• Integrations: With services you explicitly connect (e.g., BambooHR)
• Legal requirements: If required by law or to protect rights and safety
• Business transfers: In case of merger, acquisition, or sale (with notice)

We never sell personal data to third parties.

5. Data Retention

• Active accounts: We retain data while your account is active
• Deleted data: Removed within 30 days of deletion request
• Backups: May persist up to 90 days in backup systems
• Legal requirements: Some data may be retained longer if legally required

6. Your Rights (GDPR)

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your data ("right to be forgotten")
• Portability: Receive your data in a machine-readable format
• Restriction: Limit how we process your data
• Object: Oppose certain processing activities
• Withdraw consent: Where processing is based on consent

To exercise these rights, contact us at support@arcruit.com. We'll respond within 30 days.

For candidates: If you're a job applicant, please contact the company that posted the position to exercise your rights regarding your application data.

7. Security Measures

We implement industry-standard security measures including:

• Encryption in transit (TLS) and at rest (AES-256)
• Regular security audits and vulnerability testing
• Access controls and authentication requirements
• Employee training and confidentiality agreements
• Incident response procedures

While we strive to protect your data, no system is 100% secure. Please use strong passwords and keep your credentials confidential.

8. International Data Transfers

Your data may be processed outside the European Economic Area (EEA):

• AWS servers: Located in various regions with appropriate safeguards
• AI providers: OpenAI and Anthropic (US-based) with data protection agreements

We ensure appropriate safeguards through Standard Contractual Clauses and other GDPR-compliant mechanisms.

9. Children's Privacy

Our Services are not intended for people under 18. We don't knowingly collect data from children. If we learn we've collected such data, we'll delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy occasionally. For material changes, we'll notify you via email or in-app notification at least 30 days before the changes take effect. Continued use after the effective date means you accept the updated policy.