Privacy Policy

This Privacy Policy explains how CopilotHr B.V. (“CopilotHr,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal data when you use our AI hiring platform (the “Service”) or otherwise interact with us.

CopilotHr is a data controller for the personal data of our customers (employers and recruiters) and a data processor for the personal data of candidates that customers upload or collect through the Service. When you upload candidate data, you remain the controller of that data and CopilotHr processes it on your behalf under our Terms of Service and any applicable Data Processing Agreement.

We process the following categories of personal data:

• Account data: name, work email, company name, job title, and password credentials provided when you create a recruiter or employer account.
• Candidate data: resumes/CVs, cover letters, contact details, work history, skills, assessments, and any notes your team records about a candidate.
• Interview data: async interview responses, transcripts, video and audio recordings, and the AI-generated scores, summaries, and rankings derived from them.
• Usage data: pages visited, feature usage, device type, IP address, browser, and approximate location derived from IP.
• Communications: the content of messages you send to support, sales, or other candidates through the Service.
• Optional profile data: profile photo, social handles, or integrations you connect (e.g., calendar, ATS, or email providers).

We process personal data for the following purposes:

• To provide, maintain, and improve the Service.
• To parse CVs, score and rank candidates, and generate interview questions, summaries, and reports.
• To create and manage your account, authenticate you, and secure the Service.
• To communicate with you about product updates, support requests, and contractual matters.
• To process payments and issue invoices and tax documents.
• To monitor for fraud, abuse, and security incidents and to comply with legal obligations.
• To analyze and improve the accuracy and fairness of our AI models, including aggregated, de-identified analytics.

CopilotHr uses automated processing, including machine-learning models, to extract information from CVs, evaluate candidate responses, and produce rankings and recommendations. Under Article 22 of the GDPR, candidates have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

Our scoring is designed to support, not replace, human decision-making. A human reviewer is always in the loop before any hiring decision is made. We disclose the key factors that influence a score in the product UI and allow recruiters to inspect and override AI output. We do not use special-category data (such as race, religion, or health) as model features.

For users in the EU/EEA and UK, we rely on the following bases:

• Performance of a contract— to deliver the Service you signed up for.
• Legal obligation— to comply with tax, employment, and record-keeping laws.
• Legitimate interests— for security, fraud prevention, and product improvement, balanced against your rights.
• Consent— for optional analytics, marketing communications, and cookies that require it.

When customers upload candidate data, the customer (as controller) is responsible for establishing an appropriate legal basis and informing candidates.

We use essential cookies to keep you logged in and remember your preferences. We also use analytics tools to understand aggregate usage and improve the product. Analytics cookies are only set after you give consent through our cookie banner.

You can withdraw consent or manage cookies at any time through your browser settings or our cookie preferences tool. Disabling non-essential cookies will not prevent you from using the Service.

We do not sell personal data. We share it only with the following categories of recipients:

• Cloud infrastructure providers that host the Service and store data.
• AI/ML providers that power parsing, transcription, and scoring features.
• Payment processors that handle billing and card data.
• Support & communication tools used to respond to your requests.
• Professional advisors (legal, accounting) where necessary.
• Authorities where required by law or to protect our rights.

A current list of subprocessors is available on request. All subprocessors are bound by written agreements requiring GDPR-level protection.

CopilotHr is headquartered in the Netherlands, but some of our providers process data outside the EU/EEA (for example, in the United States). Where this occurs, we rely on appropriate safeguards such as Standard Contractual Clauses, the EU–US Data Privacy Framework, or another valid transfer mechanism, and we assess each transfer for adequacy.

We keep personal data only as long as necessary for the purposes set out in this policy:

• Customer accounts: retained while your account is active and for up to 90 days after closure, unless law requires longer.
• Candidate data: controlled by you as controller. You can delete candidates or set retention policies; we will honor those settings and purge data on schedule.
• Backups: may contain deleted data for a limited recovery window, after which it is overwritten.
• Logs & telemetry: retained for up to 12 months for security and debugging.

We protect personal data with industry-standard measures including encryption in transit (TLS) and at rest, role-based access controls, regular security reviews, and employee training. Access to production data is strictly limited and logged. Despite these measures, no system is perfectly secure; we will notify affected users and authorities of any personal-data breach as required by law.

Depending on where you live, you may have the following rights over your personal data:

• Access— request a copy of the data we hold about you.
• Rectification— correct inaccurate or incomplete data.
• Erasure— request deletion (“right to be forgotten”).
• Restriction— limit how we process your data.
• Portability— receive your data in a structured, machine-readable format.
• Objection— object to processing based on legitimate interests or for direct marketing.
• Withdraw consent— at any time, without affecting processing done before withdrawal.

To exercise any right, email privacy@copilothr.app. We respond within one month. You can also lodge a complaint with your local data-protection authority, such as the Dutch Autoriteit Persoonsgegevens.

The Service is intended for businesses and is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy as the Service evolves. We will notify customers of material changes by email or in-app at least 30 days before they take effect, and we will update the “last updated” date above.

If you have any questions about this Privacy Policy or your personal data, please contact us:

CopilotHr B.V.
Keizersgracht 123, 1015 CJ Amsterdam, the Netherlands
Email: privacy@copilothr.app