Privacy Policy

Recruit Buddy is a hiring platform operated by Workflow Corporation. Two groups of people have data in it, and the responsibility for that data is different for each:

People who use the console

Recruiters, hiring managers, interviewers and administrators with a Recruit Buddy account. For their account data (name, email, password, sign-in history) Workflow Corporation is the controller: we decide why and how it is used, and this policy is our account of it.

Candidates

People who apply for a job, are referred or sourced, or join a talent pool. Their data belongs to the employer whose workspace they applied to. The employer is the controller and decides how it is used; Workflow Corporation is its processor, holding and processing the data only to run Recruit Buddyon the employer’s instructions.

If you applied for a job through Recruit Buddy, the employer is the first place to go with a question or a request about your data: their careers site, the emails they sent you, and the status link in those emails all lead to them. If you write to us instead, we will pass your request to the right employer and help them answer it, but we will not decide on their behalf what happens to their recruiting records.

Questions about this policy go to support@workflowcorp.com; mark anything about personal data for the attention of the privacy team.

About people who use the console

• Account:name, email address, optional job title, time zone and avatar address, and a password stored only as a salted bcrypt hash. Accounts created through a sign-in provider hold that provider’s account identifier instead of a password.
• Membership: which workspaces you belong to and your role in each.
• Activity: the time of your last sign-in, and an audit record of consequential actions (inviting a member, changing a role, saving settings, issuing an API key) with the network address the request came from. Audit records exist for security and accountability.
• Your work: the notes, scorecards, decisions and messages you write about candidates belong to the workspace you wrote them in.
• A calendar you connect:if you connect your Google or Microsoft calendar, or give a private calendar feed address, so candidates are never offered a time you are busy, we store the access token your calendar provider issues (or the feed address) encrypted, and never show it to anyone. Access is read-only: we read when you are busy, and your answers to the interview invitations we sent you; the titles and details of your other events are never stored. The busy times for the next two months are kept with the connection and refreshed every few minutes while in use. Disconnecting it in Settings, My availability deletes the token and the busy times; you can also revoke access from your calendar provider’s account settings. The connection, token and busy times together, is also deleted without your asking when it can no longer be used for you in that workspace: when you leave the workspace or are removed from it, when your role there is changed to viewer, or when your account is disabled.

About candidates, on behalf of employers

• What you send:name, email, phone, location, links you provide, your CV and cover letter (the files, and the text extracted from them), and your answers to the employer’s application questions.
• What the hiring team adds: which stage your application is at and every move between stages, notes, interview schedules and the feedback interviewers submit, assessment and reference results, offers, and the emails and text messages sent to you. When an employer emails a talent pool (a campaign), the links in that email pass through Recruit Buddy first, which records which ones you clicked and when, so the employer can see whether the campaign worked. A campaign email can also carry a small image that records when it was opened, if your mail app loads images; most mail apps let you turn that off.
• Text messages: if you give a phone number and agree to texts (a box on the application form, or texting START), the employer can text you about your application, send you reminders, and, if you also agreed to hear about future roles, text you about them. We keep your number, when you agreed and when you opted out, each text sent to you and each one you send back. Texting STOP stops every text from Recruit Buddyto that number at once, until you text START. If you apply by text (texting a job’s code), we keep your number, the answers you text and how far you got, so you can pick up where you left off within a day, and the finished application like any other.
• What the AI adds: a recommendation with its reasons for each application the employer has the AI review (see the next section).
• Job alerts:if you ask an employer’s careers site to email you about new jobs, the email address you give, the kind of jobs you chose (keywords, department, location), and when you confirmed, last received an alert or unsubscribed. You do not need to apply to set one up, and it is not an application.
• Voluntary self-identification:if an employer asks equal-opportunity questions (gender, race or ethnicity, veteran status, disability, age band), your answers are optional, stored apart from your application, and never shown to the people deciding on it. The AI never reads them. They are used only to measure, in aggregate, whether the employer’s process treats groups differently, and no group smaller than five people is ever reported.

Cookies

Recruit Buddy sets only the cookies it needs to work: the sign-in session, which workspace is active, your colour theme and interface language, and a short-lived cookie that carries a workspace invitation through sign-up. There are no advertising or cross-site tracking cookies. Candidates applying through a careers site are not given a sign-in cookie at all; their status link works without one.

Employers can have Recruit Buddy’s AI read each application against the job’s scorecard, the weighted list of what the role needs, and recommend whether to advance it, hold it, or decline it, with the reasons. This is what the AI does and does not do:

• It reads the CV text and the application answers, compared with the scorecard. It does not read voluntary self-identification answers, ever.
• Blind screening is on by default. Before any text reaches a model, names, contact details, links, photos, dates of birth, ages, graduation years, gendered pronouns and honorifics are removed from it. An employer can switch this off; it is on unless they do.
• A person makes every decline. The AI recommends; it never rejects anyone on its own. An employer may let the AI move strong applications forward automatically, but a recommendation to decline always waits for a member of the hiring team to accept or override it.
• Every recommendation is recorded.We keep what was recommended, the reasons and the evidence quoted from the CV, which engine and which version of the instructions produced it, a fingerprint of exactly what it read, and what a person then did. Overriding a recommendation requires a reason. This is what lets an employer answer “why” for any applicant, and what an independent bias audit needs.
• You can ask for human review only.A candidate can opt out of AI review when applying, or later through the status link in the employer’s emails. Applications from candidates who opted out are never sent to a model; people review them.
• Without a model, rules. If an employer has no AI model configured, a deterministic rules engine produces the same shape of recommendation and is labelled as such.

Recruit Buddy does not use candidate data to train any model. When a model is used, the text needed for one recommendation (redacted, unless the employer has switched blind screening off) is sent to the AI model provider (see who we share with) only to produce that recommendation.

• To run the service an employer signed up for: careers sites, applications, the pipeline, interviews, offers, and the emails and text messages the employer sends to candidates. Texts go only to people who agreed to them and have not texted STOP since, and texts sent automatically or to a whole talent pool are never sent between 21:00 and 08:00 in the employer’s time zone.
• To answer questions on a careers site. Where an employer turns on the careers assistant, the question a visitor types and the last few turns of that conversation are sent to the AI model provider to write the answer, from the employer’s published jobs and answers. Nothing typed there is stored, and it plays no part in any hiring decision.
• To send the job alerts you ask for. Asking a careers site to email you about new jobs sends one confirmation email to the address you gave, and nothing more is sent unless you confirm it. Once confirmed, you get at most one email a day, only when jobs matching your alert have been posted, under the employer’s name. Every one carries an unsubscribe link, and unsubscribing stops them at once.
• To keep it secure: sign-in, session revocation, the audit trail, and investigating abuse.
• To send account messages. About their account itself, Recruit Buddy sends people who use the console exactly seven kinds of message: a workspace invitation, a password reset you asked for, a notice to you when an administrator creates a one-time reset link for your account, a confirmation link to a new sign-in address you asked for, a notice to your previous address when your account's sign-in email is changed, a notice to you when repeated wrong passwords in your settings sign your account out everywhere, and a billing notice about a workspace you own or administer (a receipt, a payment that failed, a trial that is ending or has ended, or a plan that has ended). Everything else a candidate receives (acknowledgements, interview invitations, offers, decisions) is sent by the employer, from their workspace, using their templates.
• To tell people who use the console about their work. Besides the in-app notifications, Recruit Buddy emails a member of a workspace when something there concerns them: an approval waiting for them, or a decision on one they asked for, an automation rule in the workspace that notifies them, an interview they are on, interview feedback that is due, a teammate mentioning them, a reply from a candidate they look after, a task given to them or falling due, and an invitation to apply for an internal job, for employees who said on their career profile that they are open to a move. Each person chooses, kind by kind, whether these arrive straight away, in one daily summary, or not at all (Settings, Profile, “Email me about”). An interviewer placed on an interview panel also receives that interview’s calendar invitation, so it appears in their own calendar. These emails name the candidate or the job they concern, or both, under the workspace’s name, and go only to current members of that workspace.

We do not sell personal data, do not use it for advertising, and do not combine one employer’s candidates with another’s. A person who applies to two employers on Recruit Buddy is two separate, unconnected records.

Recruit Buddy uses a small number of service providers (subprocessors), each for one job:

Cloud hosting

Google Cloud runs the application, the database and file storage, in the United States.

Email delivery

An email delivery provider transmits account messages, the work notifications and daily summaries sent to people who use the console, interview calendar invitations to panel members, the emails employers send to candidates, and job-alert emails. It receives the recipient’s address and the message.

Text message delivery

A text message provider transmits the texts employers send to candidates (one at a time, to a selection, to a talent pool, or by a rule) and receives the texts candidates send back, including STOP and START and applications by text. It receives the phone number and the text.

Calendar providers

When someone who uses the console connects their Google or Microsoft calendar, Recruit Buddy reads their busy times (and their answers to our interview invitations) from that provider, with read-only access they granted and can revoke. Nothing about candidates is sent to it.

AI model providers

Two, each for one kind of work. When an employer uses AI features with a model configured, the first writes recommendations (screening an application, matching a past applicant to a new job, summarising interview feedback): it receives the text needed for that one recommendation, redacted unless the employer has switched blind screening off. It is never sent self-identification answers, and never sent anything about a candidate who asked for human review only. The second writes what a person asks for on screen: it receives the notes for a first draft of a role, a job advertisement to check its wording or to draft it in another language, the facts an offer suggestion is worked out from, the brief a recruiter writes when they ask for a first draft of a campaign, and a campaign’s own wording when they ask for a draft of it in another of the careers site’s languages (never anyone’s details), and, where an employer’s careers site has the assistant turned on, a visitor’s question with the last few turns of that conversation, to write the answer. What the second provider is sent is used to write a draft or an answer for a person to read, never for a decision about anyone, and the campaign briefs, campaign wording and visitors’ questions are not stored by Recruit Buddy.

Support chat

The public marketing pages carry Workflow’s own support chat. It is not loaded on sign-in pages, in the console, or on careers sites.

Employers can connect Recruit Buddyto their own systems (webhooks, the API, a background-check or assessment service). Data that goes to those systems goes where the employer directed it, under the employer’s responsibility. We disclose data to authorities only where the law requires it.

Your account

Until you delete it from Settings. Deleting it removes your sign-in, memberships, sessions and notifications. Notes, stage moves and messages you wrote in a workspace that carries on stay with that workspace without your name, and so do interview scorecards you submitted, approval decisions you recorded and referrals you made: they are the workspace’s hiring history.

Candidate records

As long as the employer keeps them. An employer can set a retention period: candidates with no activity for that long are anonymised automatically, which blanks every personal field and deletes their files while keeping counts and stage history for the employer’s reports. Without a retention period, records stay until the employer deletes them or the candidate’s deletion request is acted on.

AI decision records

With the application they belong to, so the “why” survives as long as the decision does.

A deleted workspace

Every row in it is deleted at once, and its stored files are erased from storage straight after.

Backups

Encrypted database backups exist for disaster recovery and expire on a rolling schedule, so deleted data leaves them as they roll over rather than instantly.

Depending on where you live you may have the right to see the data held about you, correct it, have it deleted, object to or restrict its use, take a copy, and not be subject to a decision made solely by automated means. Recruit Buddy is built so that last one is always available: no application is declined without a person.

If you are a candidate

• Use the status link in the employer’s emails to see where your application stands, withdraw it, ask for human review only, or ask for your data to be deleted.
• Ask the employer why a decision was made. The reasons recorded for every AI recommendation, and the reason a person gave for overriding one, are what they can tell you.
• If you cannot reach the employer, write to support@workflowcorp.com and we will route it.

If you use the console

• Change your details in Settings, Profile. Delete your account in Settings, Delete account; you do not need a workspace to do it.
• For anything else, write to support@workflowcorp.com.

• Everything travels over TLS. Passwords are stored only as bcrypt hashes.
• CVs, cover letters and offer letters are never given a public address. Every download passes through a check that the person asking may see that candidate.
• Inside a workspace, access is by role: hiring managers and interviewers see only the jobs whose hiring team they are on, interviewers never see pay, and viewers see reports but no individual candidate.
• Links sent to candidates, referees and agencies carry single-purpose tokens that are stored only as hashes, and API keys are stored only as hashes.
• Signing out everywhere, changing a password and an administrator’s suspension all end existing sessions.

Report a vulnerability to support@workflowcorp.com.

Recruit Buddyis a tool for employers and is not directed at children. Console accounts are for adults. Employers must not use it to recruit anyone below the minimum working age that applies to the job. If you believe a child’s data is held here in breach of that, write to support@workflowcorp.com and we will work with the employer to remove it.

When this policy changes, the new version is published here with its effective date at the top, and workspace owners are told of a material change before it takes effect. The Terms of Service say how notice is given.