What we know about you, and what we do with it

Rcrut is operated by Rcrut Technology Ltd, the data controller for the personal data described here.

Our registered postal address is available on request from hello@rcrut.com. We handle personal data in line with the UAE Personal Data Protection Law (PDPL) and, where it applies to you, the GDPR.

Things you give us

• Account — your email address, and either a password (stored hashed, never in readable form) or an identifier from Google or Apple if you sign in with them.
• Profile — name, photo, headline, summary, phone number, country and city, date of birth, gender, languages, interests, links you add (LinkedIn, portfolio, CV), skills, the roles you want, years of experience, and whether you want to be discoverable by employers.
• Career history — work experience, education, certifications and licences, projects, volunteering, featured work, and recommendations others have written for you.
• Files — CV and portfolio documents, and any files you attach to a certification or a piece of featured work.
• Practice interviews — the video and audio recording, the transcript, your answers, and the scores and written summaries generated from them.
• Skill quizzes — the questions you were served, your answers, and your scores.
• Messages — the content of conversations with employers, and read receipts.
• Career advisor conversations — what you discuss with the AI advisor, plus a longer-term memory it builds so it doesn't ask you the same thing twice.
• Anything you send support — including reports you file about other users, and deletion requests.

Things we generate

• Match scores and rankings, and the written explanation of why a job or a candidate was matched.
• Generated CVs, and every earlier version of them.
• Interview and quiz scores, bands and summaries.
• Mathematical representations of your profile (embeddings) used to find relevant roles.

Things we collect automatically

• Activity — applications, saved jobs, matches, invitations, and which employers have shown interest in you.
• Device and technical data — your IP address (used for rate limiting and abuse prevention), browser or app user-agent, and a push notification token if you allow notifications.
• Subscription state — your plan, its status and its renewal date. We never see or store your card details; Apple, Google or our payment processor handles payment.

Things we get from elsewhere

• LinkedIn import — only if you choose to use it, and only the profile data the import returns.
• Your colleagues — if you join an employer account, whoever invited you gave us your work email.
• Public job listings — we collect job postings from public sources. That is data about roles and companies, not about you.

If you use Rcrut as an employer, we hold much less: your name, work email, the company you belong to, your role in the account, and what you do inside it (postings, invitations, messages).

• To run the service you asked for — building your profile, matching you to roles, letting you apply, generating CVs, running interviews and quizzes, and delivering messages. Our basis is performance of our contract with you.
• To rank and recommend — scoring how well you fit a role, and how well candidates fit an employer's role. Our basis is our legitimate interest in making a matching product work, and our contract with you.
• To keep people safe — reviewing job postings before they go live, acting on reports, honouring blocks, detecting fraud and abuse. Our basis is our legitimate interest in a safe platform, and in some cases a legal obligation.
• To contact you — notifications about matches, messages, applications and account activity. Our basis is our contract with you, or your consent where the law requires it. You can turn push notifications off on your device at any time.
• To share verified evidence with employers — but only where you have opted in. See §5.
• To bill you, if you buy a subscription or, as an employer, a plan.
• To understand how the product is used and fix what is broken. Our basis is our legitimate interest, or your consent where required; you can opt out in the app.

We do not sell your personal data, we do not share it with data brokers, and we do not run advertising on Rcrut.

This is the part most people care about, so it is worth being precise. There are two stages.

Before you match

An employer browsing or ranking candidates sees a limited card: your name, photo, headline, top skills, years of experience and region — plus badges showing that you have completed a verified interview or skill quiz, and how you scored on quizzes relevant to their role.

They do not see your email address, your phone number, your links, your CV, or anything from your interview beyond the badge.

After you match

A match needs action from both sides. Once it happens, the employer can see your contact details and your CV, and you can see and message them. That boundary is deliberate: it is what makes it safe to be discoverable at all.

Staying out of it

You can switch off discoverability so employers cannot find you in search or ranking at all, while keeping your account and applying to roles yourself. If you can't find that switch in your version of the app, email us and we will do it for you.

Rcrut uses AI throughout: to read and normalise your skills, to rank matches and write the explanation next to them, to draft CVs, to generate and score skill quizzes, to conduct and analyse practice interviews, and to power the career advisor. The providers that process this data for us are listed in §6.

Practice interviews specifically

• Recording is something you start. We tell you before it begins, and you can stop.
• Recordings and transcripts are stored in private storage that only our servers can read. They are not public and are not indexed.
• Employers never receive the raw video, audio or transcript. There is no setting that shares them.
• If — and only if — you switch on interview sharing, an employer you have matched with can see a written summary and your scores. It is off until you turn it on, and you can turn it back off whenever you like.

We send your conversation content to the AI providers named below in order to produce these outputs. We do not permit them to use your data to train their own models.

Employers, as described in §4.

Service providers who process data on our behalf, under contract, only for the purposes below. This is the complete list:

Authorities, where we are legally required to disclose something, or where it is necessary to protect someone's safety or our legal rights.

A buyer, if the business is ever sold or merged. You would be told before your data moved, and the buyer would be bound by this policy.

• While your account exists, we keep your profile and career data — it is the product.
• When you delete your account, we erase it. Requests from inside the app happen immediately; requests from the web are completed within 30 days of us confirming the request is yours, and the data ages out of encrypted backups within a further 30 days. Backups are never used to restore a deleted account.
• After deletion we keep only: records the law requires (principally billing and tax records, for the period the law requires); a minimal record of an account suspended for abuse, so the same actor cannot simply re-register; aggregate counts that cannot be traced back to a person; and a deletion log recording that the erasure happened, which contains no name or email.
• Reports you file about other users are kept while we act on them and for a reasonable period afterwards, so a pattern of behaviour by one person remains visible to us.
• Employer copies are not ours to delete. See §1.

The full breakdown of what deletion covers is on our support page.

These apply to everyone who uses Rcrut, wherever you live. We do not run a two-tier policy depending on your passport, and we never charge for any of them.

• See what we hold — ask and we'll send you a machine-readable export, within 30 days.
• Correct something — most fields you can edit yourself; email us for anything you can't reach, including a score you believe is wrong.
• Delete your account, or part of your data — including deleting just your interview recordings or quiz results and keeping the rest. Use the form at rcrut.com/support#data-deletion, which needs no sign-in.
• Object, or withdraw consent — turn off interview sharing, leave employer search, opt out of analytics, or object to automated scoring.
• Restrict or port — ask us to pause processing, or to send your data to you or someone else in a portable format.
• Complain — to us first, at hello@rcrut.com, and to your data-protection regulator if we don't resolve it.

• Encrypted in transit and at rest.
• Interview recordings live in a private bucket that only our servers can read — they are never publicly addressable.
• Database access is row-level restricted, so one user's session cannot read another's data.
• Access to production data by our team is limited to those who need it.
• Passwords are hashed by our authentication provider. Nobody at Rcrut can see your password, and we will never ask you for it.

No system is perfectly secure. If you find a vulnerability, please tell us at hello@rcrut.com before publishing it — we won't come after anyone acting in good faith.

We operate across the UAE, Saudi Arabia and Lebanon, and the providers in §6 are largely in the United States and the European Union. So your data will be transferred outside your country.

Where it is, we rely on the safeguards the applicable law provides — standard contractual clauses, adequacy decisions, or the equivalent — and our contracts with each provider require them to protect it to the standard described here.

Rcrut is for people aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a younger person has an account, tell us at hello@rcrut.com and we will remove it.

When we change this policy we update the date at the top. If a change materially affects what we do with your data, we will tell you in the app or by email before it takes effect — not quietly.

Data protection and privacy: hello@rcrut.com
Everything else: hello@rcrut.com
Practical help, and the deletion form: rcrut.com/support

Rcrut Technology Ltd.